Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.IRP_MJ_CREATE
ragothaman
Member Posts: 8
in NTFSD
whenever there are certain actions say folder opening, file creation, etc there are a bunch of IRP_MJ_CREATE requests raised by various exe's. I have found the process which generates it using the process id. Let us say some 20 IRO_MJ_CREATE requests have been raised for creating a new file, Now is there something common in those 20 IRP requests generated stating that it was meant for file creation.
Howdy, Stranger!
It looks like you're new here. If you want to get involved, click one of these buttons!
Quick Links
| Upcoming OSR Seminars | ||
|---|---|---|
| OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | Kernel Debugging | 30 Mar 2020 | OSR Seminar Space |
| Developing Minifilters | 20 Apr 2020 | LIVE ONLINE |
| Writing WDF Drivers | 11 May 2020 | LIVE ONLINE |
| Internals & Software Drivers | 28 Sept 2020 | Dulles, VA |
Comments
Please stop asking the same question. yes lots and lots of things open files. Embrace it, understand it, spend a week looking at procmon output.
Read this page and search for disposition