Question

What Windows kernel API(s) do I use to obtain the base file name of a path from a driver? (I am assuming that I don’t have to search the string for the last ‘\’)

eg obtain bar.txt from c:\foo\bar.txt

Answer 1

You might consider constructing a loop using FsRtlDissectName until the remaining path argument is empty.

Something like this might do what you want (although you’ll need to handle things like ADS stream names, as well as adding proper error checking):

void FetchFileName( IN PUNICODE_STRING pSourceString, OUT PUNICODE_STRING pFileName )
{
    UNICODE_STRING current = *pSourceString; // structure copy.
    UNICODE_STRING remaining;
    for(;;)
    {
        // Fetch the next path component.
        FsRtlDissectName( current, pFileName, &remaining );
        if( remaining.Length == 0 )
        {
            // Nothing left to parse.  pFilename will 
            // contain the last filename found.
            break;
        }

        // Advance down the string.
        current = remaining;                // structure copy.
    }
}