如何实现驱动里文件改名啊?

  如何在驱动里实现文件改名,比如将\??\c:\aaa.txt改为\??\c:\bbb.txt

build一个irp发到下层驱动,major 和minor以及格式自己去查

是在IRP_MJ_CREATE里面build新的IRP么？

Two cases you have to tackle:

1. Rename on the same volume:
In MJ_CREATE you can call ZwSetInformationFile() and pass in an un-documented FILE_RENAME_INFORMATION structure

        typedef struct {
            BOOLEAN Replace;
            HANDLE RootDir;
            ULONG FileNameLength;
            WCHAR FileName[1];
        } FILE_RENAME_INFORMATION;

    You can refer to OSR's document "Cracking Rename Operations" which is provided in IFS document.

2. Rename on different volume:
There's no single IRP for you to do it. You have to open->read-write-delete by yourself using ZwOpenFile, ZwCreateFile, ZwReadFile, ZwWriteFile, etc.

But what I'm thinking is that you are trying not to rename a file in MJ_CREATE but to create the file with different file name but still shows original file name to user. If this is true, then that's a complete different story.

Windows Driver Kit: Installable File System Drivers
FILE_RENAME_INFORMATION
The FILE_RENAME_INFORMATION structure is used to rename a file.

typedef struct _FILE_RENAME_INFORMATION {    BOOLEAN ReplaceIfExists;    HANDLE RootDirectory;    ULONG FileNameLength;    WCHAR FileName[1];} FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
Members
ReplaceIfExists
Set to TRUE to specify that if a file with the given name already exists, it should be replaced with the given file. Set to FALSE if the rename operation should fail if a file with the given name already exists.
RootDirectory
If the file is not being moved to a different directory, or if the FileName member contains the full pathname, this member is NULL. Otherwise, it is a handle for the root directory under which the file will reside after it is renamed.
FileNameLength
Length, in bytes, of the new name for the file.
FileName
The first character of a wide-character string containing the new name for the file. This is followed in memory by the remainder of the string. If the RootDirectory member is NULL, and the file is being moved to a different directory, this member specifies the full pathname to be assigned to the file. Otherwise, it specifies only the file name or a relative pathname.

Headers
Declared in ntifs.h. Include ntifs.h or fltkernel.h.

Comments
The FILE_RENAME_INFORMATION structure is used to rename a file. This operation can be performed in either of the following ways:

Call FltSetInformationFile or ZwSetInformationFile, passing FileRenameInformation as the value of FileInformationClass and passing a caller-allocated, FILE_RENAME_INFORMATION-structured buffer as the value of FileInformation. The FileHandle parameter specifies the file to be renamed.
Create an IRP with major function code IRP_MJ_SET_INFORMATION.

File system minifilters must use FltSetInformationFile, not ZwSetInformationFile, to rename a file.

Renaming a file requires DELETE access to the file so that the directory entry may be removed from the current parent directory, as well as the appropriate access to create the new entry in the new parent directory file.

The file name string in the FileName member must be specified in one of the following forms.

A simple file name. (The RootDirectory member is NULL.) In this case, the file is simply renamed within the same directory. That is, the rename operation changes the name of the file but not its location.
A fully qualified file name. (The RootDirectory member is NULL.) In this case, the rename operation changes the name and location of the file.
A relative file name. In this case, the RootDirectory member contains a handle to the target directory for the rename operation. The file name itself must be a simple file name.

General rules for rename operations:

A file or directory can only be renamed within a volume. In other words, a rename operation cannot cause a file or directory to be moved to a different volume.
A volume's root directory cannot be renamed.
If ReplaceIfExists is set to FALSE, and the target exists, the rename operation will fail.
Even if ReplaceIfExists is set to TRUE, the rename operation will still fail if a file with the same name already exists and is a directory, a read-only file, or a currently executing file.
A volume's files and directories cannot be renamed if the volume is a read-only volume, such as a CDFS volume or a read-only NTFS volume.

Special rules for renaming open files:

A file cannot be renamed if it has any open handles, unless it is only open because of a batch opportunistic lock (oplock) and the batch oplock can be broken immediately.
A file cannot be renamed if a file with the same name exists and has open handles (except in the batch-oplock case described earlier).
A directory cannot be renamed if it or any of its subdirectories contains a file that has open handles (except in the batch-oplock case described earlier).

Special rules for renaming NTFS data streams:

The source handle cannot be opened with FILE_DIRECTORY_FILE.
The source handle cannot be a directory opened without either FILE_DIRECTORY_FILE or FILE_NON_DIRECTORY_FILE.
The new name for the stream must begin with a colon (:).
A data stream can only be renamed within a file. In other words, a rename operation cannot cause a data stream to be moved to a different file.
A stream on a directory cannot be renamed to the default data stream.
If ReplaceIfExists is set to TRUE, the rename operation will succeed only if a stream with the same name exists and is a zero-length data stream.
"Renaming" the default data stream is allowed, but this is not a true rename, because it leaves behind a zero-length default data stream.

The size of the FileInformation buffer passed to ZwSetInformationFile or FltSetInformationFile must be >= sizeof(FILE_RENAME_INFORMATION) plus the size in bytes of the FileName string.

The FILE_RENAME_INFORMATION structure must be LONG-aligned.

//改名 szFileName1 to szFileName2
NTSTATUS Rename(PCHAR szFileName1,PCHAR szFileName2)
{
  FILE_RENAME_INFORMATION fri;
  IO_STATUS_BLOCK iostatus;
  OBJECT_ATTRIBUTES oa;
  UNICODE_STRING pathnameW;
  ANSI_STRING    pathnameA;
  NTSTATUS status;
  HANDLE hfile =NULL;
  CHAR szFileNameL[MAXPATHLEN];
  strcpy(szFileNameL,"\\\\DosDevices\\\\");
  strcat(szFileNameL,szFileName1);
  RtlInitAnsiString(&pathnameA,szFileNameL );
  RtlAnsiStringToUnicodeString(&pathnameW,&pathnameA,TRUE);
  InitializeObjectAttributes(&oa, &pathnameW, OBJ_CASE_INSENSITIVE, NULL, NULL);
  status = ZwCreateFile(&hfile, DELETE, &oa, &iostatus, NULL, 0, FILE_SHARE_READ,FILE_OPEN, FILE_SYNCHRONOUS_IO_NONALERT, NULL,0);
  RtlFreeUnicodeString(&pathnameW);
  if(!NT_SUCCESS(status))
  {
    goto done;
  }
  strcpy(szFileNameL,\"\\\\DosDevices\\\\\");
  strcat(szFileNameL,szFileName2);
  RtlInitAnsiString(&pathnameA,szFileNameL );
  RtlAnsiStringToUnicodeString(&pathnameW,&pathnameA,TRUE);
  fri.FileNameLength=pathnameW.Length;
  memcpy(fri.FileName,pathnameW.Buffer,pathnameW.Length);
  fri.ReplaceIfExists=0;
  fri.RootDirectory=0;
  status = ZwSetInformationFile(hfile,&iostatus,&fri,sizeof(fri),FileDispositionInformation);
  RtlFreeUnicodeString(&pathnameW);
done:
  if(hfile)
  {
    ZwClose(hfile);
  }
  return status;
}

或者:

文件的Rename
    类似于Delete，Rename是向FSD发送IRP_MJ_SET_INFORMATION的IRP，把IrpSp->Parameters.SetFile.FileInformationClass设置为FileRenameInformation，填充buffer为FILE_RENAME_INFORMATION结构。

    fri.ReplaceIfExists=TRUE;
    fri.RootDirectory=0;//Set fri.FileName to full path name.
    fri.FileNameLength=wcslen(filename)*2;
    wcscpy(fri.FileName,filename);//If the RootDirectory member is NULL, and the file is being moved to a different directory, this member specifies the full pathname to be assigned to the file.

    irpsp->MajorFunction=IRP_MJ_SET_INFORMATION;
    irpsp->Parameters.SetFile.Length = sizeof(FILE_FILE_RENAME_INFORMATION);
    irpsp->Parameters.SetFile.FileInformationClass = FileRenameInformation;

为什么SfRenameW(L"d:\\111.txt",L"d:\\222.txt")改不了

NTSTATUS
SfRenameW(
    IN PCWSTR FileName1,
    IN PCWSTR FileName2
    )
{
    FILE_RENAME_INFORMATION fri;
    IO_STATUS_BLOCK            iostatus;
    OBJECT_ATTRIBUTES        oa;
    UNICODE_STRING            FileNameW;
    NTSTATUS                status;
    HANDLE                    hfile =NULL;
    WCHAR                    wFileName[MAXNAMELEN];
    
    ZEROMEM(wFileName,MAXNAMELEN*sizeof(WCHAR));
    wcscpy(wFileName,L"\\\\DosDevices\\\\");
    wcscat(wFileName,FileName1);

    RtlInitUnicodeString(&FileNameW,wFileName);
    InitializeObjectAttributes(&oa,
        &FileNameW,
        OBJ_CASE_INSENSITIVE,
        NULL,
        NULL);
    status = ZwCreateFile(&hfile,
        DELETE,
        &oa,
        &iostatus,
        NULL,
        0,
        FILE_SHARE_READ,
        FILE_OPEN,
        FILE_SYNCHRONOUS_IO_NONALERT,
        NULL,
        0);
    if (!NT_SUCCESS(status)) {
        goto done;
    }

    ZEROMEM(wFileName,MAXNAMELEN*sizeof(WCHAR));
    wcscpy(wFileName,L"\\\\DosDevices\\\\");
    wcscat(wFileName,FileName2);

    RtlInitUnicodeString(&FileNameW,wFileName);
    fri.FileNameLength=FileNameW.Length;
    memcpy(fri.FileName,FileNameW.Buffer,FileNameW.Length);
    fri.ReplaceIfExists=0;
    fri.RootDirectory=0;
    status = ZwSetInformationFile(hfile,
        &iostatus,
        &fri,
        sizeof(fri),
        FileDispositionInformation);

done:
    if(hfile) {
        ZwClose(hfile);
    }
    return status;
}