FILE_OBJECT filename

Hello

When my driver receives an IRP_MJ_WRITE, the irp points to a file
object. This file object's FileName points to a filename. My driver
hex-dumps this unicode string. However, sometimes when IRQL=2 a get a
bug check D1h. So my question is: is this unicode string allocated in
nonpaged or paged pool?

Doron
Fri Mar 10 10:15:42 CST 2006

PagedPool.

d

--
Please do not send e-mail directly to this alias. this alias is for
newsgroup purposes only.
This posting is provided "AS IS" with no warranties, and confers no rights.


"Vetzak" <ptrshrn@gmail.com> wrote in message
news:1141999730.836736.49040@i40g2000cwc.googlegroups.com...
>
> Hello
>
> When my driver receives an IRP_MJ_WRITE, the irp points to a file
> object. This file object's FileName points to a filename. My driver
> hex-dumps this unicode string. However, sometimes when IRQL=2 a get a
> bug check D1h. So my question is: is this unicode string allocated in
> nonpaged or paged pool?
>

Dejan
Fri Mar 10 20:06:44 CST 2006


FileObject->FileName is only valid in Pre-Create path. While it MAY
seem to be valid elsewhere this is not the case, and is only
coincidental.

Vetzak wrote:

> Hello
>
> When my driver receives an IRP_MJ_WRITE, the irp points to a file
> object. This file object's FileName points to a filename. My driver
> hex-dumps this unicode string. However, sometimes when IRQL=2 a get a
> bug check D1h. So my question is: is this unicode string allocated in
> nonpaged or paged pool?

--
Kind regards, Dejan M.
http://www.alfasp.com E-mail: dejan@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32
developers.
Alfa File Monitor - File monitoring library for Win32 developers.

Vetzak
Mon Mar 13 03:54:44 CST 2006

Do you mean that the filename is only valid when IRP_MJ_CREATE is sent?

Doron
Mon Mar 13 10:12:12 CST 2006

yes, that is correct

d

--
Please do not send e-mail directly to this alias. this alias is for
newsgroup purposes only.
This posting is provided "AS IS" with no warranties, and confers no rights.


"Vetzak" <ptrshrn@gmail.com> wrote in message
news:1142243684.592431.166690@i40g2000cwc.googlegroups.com...
> Do you mean that the filename is only valid when IRP_MJ_CREATE is sent?
>