In a recent work on a project, a specific software is hook save as operation, for the rest of the file, save as processing
The idea is to use a hook hook software save too use GetSaveFileNameW API
GetSaveFileNameW prototype below
BOOL GetSaveFileName (LPOPENFILENAME Ipofn)

Hooked the GetSaveFileName in our success, and then read the inside of the lpofn content, strange things happened,
Lpofn lpstrFile stored inside the file path, but only to the name of the file, no suffix,
For example, save as file is F: \ Doc \ test Doc, but lpofn - & gt; LpstrFile content only F: \ Doc \ test this part, no suffix,

Arguably GetSaveFileName is to write a good API, even different applications, but after using this API, return should be the same, why this application will be quality,

Then we hooked NtCreateFile again, and generated files and become a complete path with suffix, mystery, still hope you glad indeed

CodePudding user response:

The lpstrFileTitle members containing the file suffix?

CodePudding user response:

The

reference 1/f, 7-eleven's reply:

lpstrFileTitle members that contains the file suffix?

This value is empty

CodePudding user response:

System does not display the extension?

CodePudding user response:

Like all don't go after Windows 7 this API, still use XP?

CodePudding user response:

reference 4 floor ZWFGDLC response:

if don't go after Windows 7 this API, still use XP?

Indeed, after Vista system don't have the API
Is to develop the software needs to be compatible with the old operating system, so want to use,

Then understand what is the check GetSaveFileName OPENFILENAME structure, found a with NULL space inside contain multiple suffix lpstrFilter string, and in nFileExtension=0 and nFilterIndex!=0, move through the address lpstrFilter string nFilterIndex * 2 times of strlen (lpstrFilter), you can get the save as file suffix,
Will get suffixes and lpstrFile joining together after, you can get the full file name,
Because the suffix lpstrFilter is null, the two null at the end, so the beginning use APImonitor can open only to the first suffix, later all could not see,