Hi all,
When intercept a file open request, if I look at the file object fields got
through SoftIce, the following seems always FALSE.
ReadAccess, WriteAccess, DeleteAccess, SharedRead,
SharedWrite,SharedDelte.
I open the file with GENERAL_READ through CreateFile win32 API.
Am I looking the wrong place to detect the intended user operation mode ?
Thanx,
Jack Cheng
(Curriculum Corp.)