Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

Open with FILE_FLAG_OPEN_REPARSE_POINT flag

yanivnacyanivnac Member Posts: 2

Hi,

I implemented a mini-filter with hooks on IRP_MJ_CREATE pre and post. From a user space app, I'm calling CreateFile for reparse point file with the flag FILE_FLAG_OPEN_REPARSE_POINT. Should I get a hook for that and catch it on pre/post create as I don't seem to get it?

Thanks,
Yaniv

Comments

  • Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 224
    via Email
    Yes, you would get an IRP_MJ_CREATE for it.
    You most likely returned from IRP_MJ_CREATE before checking the
    particular file, or incorrectly checked the flags.

    > I implemented a mini-filter with hooks on IRP_MJ_CREATE pre and post. From
    > a user space app, I'm calling CreateFile for reparse point file with the
    > flag FILE_FLAG_OPEN_REPARSE_POINT. Should I get a hook for that and catch it
    > on pre/post create as I don't seem to get it?
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
Developing Minifilters 29 July 2019 OSR Seminar Space
Writing WDF Drivers 23 Sept 2019 OSR Seminar Space
Kernel Debugging 21 Oct 2019 OSR Seminar Space
Internals & Software Drivers 18 Nov 2019 Dulles, VA