Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting... Please check out the Community Guidelines in the
Announcements and Administration Category.

Change create disposition or force parent directory create

I am changing the file path in pre create hook in my mini-filter. But the directory I want the file to be in doesn't exist. In NtCreateFile I can set FILE_OPEN_IF. Is there any possibility to set this flag in pre create? or I have to create these directories myself?


  • This is how I can get it:

    (Data->Iopb->Parameters.Create.Options >> 24) & 0xff

    But how to change it?
  • It seems like FILE_OPEN_IF is simply ignored when I do

    Data->IoStatus.Information = IO_REPARSE;
    Data->IoStatus.Status = STATUS_REPARSE;

    So should I create the parent directory myself with FltCreateFile?
  • <QUOTE>
    So should I create the parent directory myself with FltCreateFile?

    Yes, you need to create the parent directories yourself.

    It may not matter for you, but just wanted to note that directories have
    security descriptors. If you want to create a new directory that is
    equivalent to some existing directory you may need to copy the security
    descriptor of the existing directory to the new directory.



Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!