rename minifilter

#include <fltkernel.h>


DRIVER_INITIALIZE DriverEntry;
NTSTATUS
DriverEntry(
    _In_ PDRIVER_OBJECT DriverObject,
    _In_ PUNICODE_STRING RegistryPath
);

NTSTATUS
FLTAPI
Unload(
    _In_ FLT_FILTER_UNLOAD_FLAGS Flags
);

FLT_PREOP_CALLBACK_STATUS
FLTAPI
RenamePreSetInformation(
    _Inout_ PFLT_CALLBACK_DATA Data,
    _In_ PCFLT_RELATED_OBJECTS FltObjects,
    _Outptr_result_maybenull_ PVOID *CompletionContext
)
{
    FILE_INFORMATION_CLASS fileInfoClass = Data->Iopb->Parameters.SetFileInformation.FileInformationClass;
    PFLT_FILE_NAME_INFORMATION nameInfo = NULL;
    PFLT_FILE_NAME_INFORMATION nameInfo2 = NULL;
    PFLT_FILE_NAME_INFORMATION destinationNameInfo = NULL;
    PFILE_RENAME_INFORMATION renameInfo = (PFILE_RENAME_INFORMATION)Data->Iopb->Parameters.SetFileInformation.InfoBuffer;

    if (FileRenameInformation != fileInfoClass && FileRenameInformationEx != fileInfoClass)
    {
        return FLT_PREOP_SUCCESS_NO_CALLBACK;
    }

    NTSTATUS status = FltGetDestinationFileNameInformation(FltObjects->Instance,
        FltObjects->FileObject,
        renameInfo->RootDirectory,
        renameInfo->FileName,
        renameInfo->FileNameLength,
        FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT,
        &destinationNameInfo
    );
    if (NT_VERIFY(NT_SUCCESS(status)))
    {
        DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "PRE FltGetDestinationFileNameInformation %wZ\n", destinationNameInfo->Name);
    }

    status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo);
    if (NT_VERIFY(NT_SUCCESS(status)))
    {
        DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "PRE FltGetFileNameInformation,normalized,default: %wZ\n", &nameInfo->Name);
        FltReleaseFileNameInformation(nameInfo);
    }

    status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_FILESYSTEM_ONLY, &nameInfo2);
    if (NT_VERIFY(NT_SUCCESS(status)))
    {
        DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "PRE FltGetFileNameInformation,normalized,fs only: %wZ\n", &nameInfo2->Name);
        FltReleaseFileNameInformation(nameInfo2);
    }

    *CompletionContext = destinationNameInfo;
    return FLT_PREOP_SUCCESS_WITH_CALLBACK;
}

FLT_POSTOP_CALLBACK_STATUS
FLTAPI
RenamePostSetInformationSafe(
    _Inout_ PFLT_CALLBACK_DATA Data,
    _In_ PCFLT_RELATED_OBJECTS FltObjects,
    _In_opt_ PVOID CompletionContext,
    _In_ FLT_POST_OPERATION_FLAGS Flags
)
{
    UNREFERENCED_PARAMETER(Flags);
    NTSTATUS status = STATUS_UNSUCCESSFUL;
    PFLT_FILE_NAME_INFORMATION preNameInfo = (PFLT_FILE_NAME_INFORMATION)CompletionContext;
    PFLT_FILE_NAME_INFORMATION tunneledNameInfo = NULL;
    PFLT_FILE_NAME_INFORMATION nameInfo = NULL;
    PFLT_FILE_NAME_INFORMATION nameInfo2 = NULL;
    PFLT_FILE_NAME_INFORMATION destinationNameInfo = NULL;
    PFILE_RENAME_INFORMATION renameInfo = (PFILE_RENAME_INFORMATION)Data->Iopb->Parameters.SetFileInformation.InfoBuffer;

    if (!NT_SUCCESS(Data->IoStatus.Status))
    {
        return FLT_POSTOP_FINISHED_PROCESSING;
    }

    if (preNameInfo)
    {
        status = FltGetTunneledName(Data, preNameInfo, &tunneledNameInfo);
        if (NT_VERIFY(NT_SUCCESS(status)))
        {
            if (tunneledNameInfo)
            {
                DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "POST FltGetTunneledName: %wZ\n", &tunneledNameInfo->Name);

                FltReleaseFileNameInformation(tunneledNameInfo);
            } else
            {
                DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "POST FltGetTunneledName: No tunneling.\n");
            }
        }
        FltReleaseFileNameInformation(preNameInfo);
    }

    status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo);
    if (NT_VERIFY(NT_SUCCESS(status)))
    {
        DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "POST FltGetFileNameInformation,normalized,default: %wZ\n", &nameInfo->Name);
        FltReleaseFileNameInformation(nameInfo);
    }

    status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_FILESYSTEM_ONLY, &nameInfo2);
    if (NT_VERIFY(NT_SUCCESS(status)))
    {
        DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "POST FltGetFileNameInformation,normalized,fs only: %wZ\n", &nameInfo2->Name);
        FltReleaseFileNameInformation(nameInfo2);
    }

    status = FltGetDestinationFileNameInformation(FltObjects->Instance,
        FltObjects->FileObject,
        renameInfo->RootDirectory,
        renameInfo->FileName,
        renameInfo->FileNameLength,
        FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT,
        &destinationNameInfo
    );
    if (NT_VERIFY(NT_SUCCESS(status)))
    {
        DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "POST FltGetDestinationFileNameInformation: %wZ\n", &destinationNameInfo->Name);
        FltReleaseFileNameInformation(destinationNameInfo);
    }

    return FLT_POSTOP_FINISHED_PROCESSING;
}

FLT_POSTOP_CALLBACK_STATUS
FLTAPI
RenamePostSetInformation(
    _Inout_ PFLT_CALLBACK_DATA Data,
    _In_ PCFLT_RELATED_OBJECTS FltObjects,
    _In_opt_ PVOID CompletionContext,
    _In_ FLT_POST_OPERATION_FLAGS Flags
)
{
    if (FlagOn(Flags, FLTFL_POST_OPERATION_DRAINING))
    {
        if (CompletionContext)
        {
            FltReleaseFileNameInformation((PFLT_FILE_NAME_INFORMATION)CompletionContext);
        }
        return FLT_POSTOP_FINISHED_PROCESSING;
    }

    FLT_POSTOP_CALLBACK_STATUS status;
    FltDoCompletionProcessingWhenSafe(Data, FltObjects, CompletionContext, Flags, RenamePostSetInformationSafe, &status);

    return status;
}

static const FLT_OPERATION_REGISTRATION gCallbacks[] = {
    {
        IRP_MJ_SET_INFORMATION,
        FLTFL_OPERATION_REGISTRATION_SKIP_PAGING_IO,
        RenamePreSetInformation,
        RenamePostSetInformation
    },
    { IRP_MJ_OPERATION_END }
};

static FLT_REGISTRATION gRegistration = {
     sizeof(FLT_REGISTRATION),
    FLT_REGISTRATION_VERSION,
    0,
    NULL,
    gCallbacks,
    Unload,
    NULL,
    NULL,
    NULL,
    NULL,
    NULL,
    NULL,
    NULL
};

PFLT_FILTER gFilter;

NTSTATUS
DriverEntry(
    _In_ PDRIVER_OBJECT DriverObject,
    _In_ PUNICODE_STRING RegistryPath
)
{
    UNREFERENCED_PARAMETER(DriverObject);
    UNREFERENCED_PARAMETER(RegistryPath);

    NTSTATUS status = FltRegisterFilter(DriverObject, &gRegistration, &gFilter);
    NT_VERIFY(NT_SUCCESS(status));

    status = FltStartFiltering(gFilter);
    NT_VERIFY(NT_SUCCESS(status));

    return STATUS_SUCCESS;
}

NTSTATUS
FLTAPI
Unload(
    _In_ FLT_FILTER_UNLOAD_FLAGS Flags
)
{
    UNREFERENCED_PARAMETER(Flags);

    FltUnregisterFilter(gFilter);

    return STATUS_SUCCESS;
}