mirrors/reactos
0
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-12-03 00:13:32 +08:00
Code Issues Packages Projects Releases Wiki Activity

[NTOSKRNL] Also try to extract name from FCB when leaking VACB

Browse Source
This commit is contained in:
Pierre Schweitzer 2018-04-27 19:01:35 +02:00
parent 43836b0fbb
commit 2ea6de8a42
No known key found for this signature in database
GPG Key ID: 7545556C3D585B0B
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ntoskrnl/cc/view.c
View File

@ -1143,6 +1143,13 @@ CcRosDeleteFileCache (
{
DPRINT1("File was: %wZ\n", &FileObject->FileName);
}
else if (FileObject->FsContext != NULL &&
((PFSRTL_COMMON_FCB_HEADER)(FileObject->FsContext))->NodeTypeCode == 0x0502 &&
((PFSRTL_COMMON_FCB_HEADER)(FileObject->FsContext))->NodeByteSize == 0x1F8 &&
((PUNICODE_STRING)(((PUCHAR)FileObject->FsContext) + 0x100))->Length != 0)
{
DPRINT1("File was: %wZ (FastFAT)\n", (PUNICODE_STRING)(((PUCHAR)FileObject->FsContext) + 0x100));
}
else
{
DPRINT1("No name for the file\n");