Question

I have this function which gives the full file name(path) from the file handle. The only problem is CreateFileMapping fails for directory handles. Is there a workaround for it?

I get the handle using NtCreateFile()

   ULONG status = NtCreatefile(&f, GENERIC_ALL, &oa, iosb, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN, FILE_OPEN_BY_FILE_ID , NULL, 0);
    printf("status: %X, handle: %x\n", status, f);

AND

   BOOL CHouseKeeper::GetFileNameFromHandle(HANDLE hFile) 
{
  BOOL bSuccess = FALSE;
  TCHAR pszFilename[MAX_PATH+1];
  HANDLE hFileMap;

  // Get the file size.
  DWORD dwFileSizeHi = 0;
  DWORD dwFileSizeLo = GetFileSize(hFile, &dwFileSizeHi); 

  if( dwFileSizeLo == 0 && dwFileSizeHi == 0 )
  {
     _tprintf(TEXT("Cannot map a file with a length of zero.\n"));
     return FALSE;
  }

  // Create a file mapping object.
  //It fails here if a directory handle is passed, it returns 0
  hFileMap = CreateFileMapping(hFile, 
                NULL, 
                PAGE_READONLY,
                0, 
                1,
                NULL);

  if (hFileMap) 
  {
    // Create a file mapping to get the file name.
    void* pMem = MapViewOfFile(hFileMap, FILE_MAP_READ, 0, 0, 1);

    if (pMem) 
    {
      if (GetMappedFileName (GetCurrentProcess(), 
                         pMem, 
                         pszFilename,
                         MAX_PATH)) 
      {

        // Translate path with device name to drive letters.
        TCHAR szTemp[BUFSIZE];
        szTemp[0] = '\0';

        if (GetLogicalDriveStrings(BUFSIZE-1, szTemp)) 
        {
      TCHAR szName[MAX_PATH];
      TCHAR szDrive[3] = TEXT(" :");
      BOOL bFound = FALSE;
      TCHAR* p = szTemp;

      do 
      {
        // Copy the drive letter to the template string
        *szDrive = *p;

        // Look up each device name
        if (QueryDosDevice(szDrive, szName, MAX_PATH))
        {
          size_t uNameLen = _tcslen(szName);

          if (uNameLen < MAX_PATH) 
          {
            bFound = _tcsnicmp(pszFilename, szName, uNameLen) == 0
                     && *(pszFilename + uNameLen) == _T('\\');

            if (bFound) 
            {
              // Reconstruct pszFilename using szTempFile
              // Replace device path with DOS path
              TCHAR szTempFile[MAX_PATH];
              StringCchPrintf(szTempFile,
                        MAX_PATH,
                        TEXT("%s%s"),
                        szDrive,
                        pszFilename+uNameLen);
              StringCchCopyN(pszFilename, MAX_PATH+1, szTempFile, _tcslen(szTempFile));
            }
          }
        }

        // Go to the next NULL character.
        while (*p++);
      } while (!bFound && *p); // end of string
    }
  }
  bSuccess = TRUE;
  UnmapViewOfFile(pMem);
} 

CloseHandle(hFileMap);
  }else {

  wcout<<GetLastError()<<endl;
  }
  _tprintf(TEXT("File name is %s\n"), pszFilename);
  return(bSuccess);
}

Answer 1

You can use NtQueryInformationFile with FileNameInformation to retrieve the name associated with a file handle.