Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-12-28 18:15:11 +00:00
Code Issues Projects Releases Packages Wiki Activity

[NTOSKRNL] Also try to extract name from FCB when leaking VACB

Browse source
This commit is contained in:
Pierre Schweitzer 2018-04-27 19:01:35 +02:00
parent 43836b0fbb
commit 2ea6de8a42
No known key found for this signature in database
GPG key ID: 7545556C3D585B0B
1 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
ntoskrnl/cc/view.c
View file

@ -1143,6 +1143,13 @@ CcRosDeleteFileCache (
{
DPRINT1("File was: %wZ\n", &FileObject->FileName);
}
else if (FileObject->FsContext != NULL &&
((PFSRTL_COMMON_FCB_HEADER)(FileObject->FsContext))->NodeTypeCode == 0x0502 &&
((PFSRTL_COMMON_FCB_HEADER)(FileObject->FsContext))->NodeByteSize == 0x1F8 &&
((PUNICODE_STRING)(((PUCHAR)FileObject->FsContext) + 0x100))->Length != 0)
{
DPRINT1("File was: %wZ (FastFAT)\n", (PUNICODE_STRING)(((PUCHAR)FileObject->FsContext) + 0x100));
}
else
{
DPRINT1("No name for the file\n");