Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


different IRP_MJ_CREATE

ragothamanragothaman Member Posts: 8
edited March 16 in NTFSD

I am developing a basic file system minifilter. I have two questions
1) How to detect if a new file created was manually created (by right clicking the mouse and creating) or programmatically created (using CreateFile()).
2) Once a file is created there are lots of IRP_MJ_CREATE requests raised (about 4-5) what is the concept behind what do they signify?

Comments

  • Don_BurnDon_Burn Member - All Emails Posts: 1,690

    What you call a manual create still becomes a CreateFile so you cannot tell. The reason there are so many IRP_MJ_CREATE's is that in many circumstances the program doing the create wants to set attributes, and in many cases this is done in a standalone model that assumes that takes a pathname, rather than a handle.

  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,123

    When your right click in explorer then it is the program calling CreateFile() so your first question makes no sense...

    As for your second, you can look in the debugger and see who is calling you. I’d bet that one is explorer and another is antivirus but you’ll only find out by looking..

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 15 Jun 2020 LIVE ONLINE
Writing WDF Drivers 22 June 2020 LIVE ONLINE
Internals & Software Drivers 28 Sept 2020 Dulles, VA