FltGetFileNameInformation returns STATUS_FLT_INVALID_NAME_REQUEST

ciprian kapa 1 Reputation point
2022-02-13T13:33:23.837+00:00

I am trying to create a driver that does on the fly encryption and decryption by intercepting read and write operations. I use FltGetFileNameInformation in order to make those operations only on files with a specific name. It works well on .txt files, but now i am trying to make a .vhd file that stores a disk that I will attach to the system. I want the .vhd file to be encrypted and decrypted on the fly. My driver encryption is done in pre write function and decryption in the post read function. FltGetFileNameInformation works well in the pre-write functions but returns STATUS_FLT_INVALID_NAME_REQUEST in the post-read function so I am not able to check if the read operation I intercept is on the the file I want to target (the .vhd one). I have search the Microsoft documentation of this function https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/fltkernel/nf-fltkernel-fltgetfilenameinformation and checked the reasons for which it may return that error code. I called the KeAreAllApcsDisabled function as suggested in the documentation and it turns out that is the problem. I found a way to get the name without calling the function. The name can be found this way Data->Iopb->TargetFileObject->FileName.Buffer Where Data is the PFLT_CALLBACK_DATA parameter of the function, but now I get Bug Check 0xA: IRQL_NOT_LESS_OR_EQUAL error. Any idea why this is happening or how I could fix it?

Windows Hardware Performance
Windows Hardware Performance
Windows: A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.Hardware Performance: Delivering / providing hardware or hardware systems or adjusting / adapting hardware or hardware systems.
1,553 questions
0 comments No comments
{count} votes