Do FLT FILE CONTEXTs register per hard link or per “file”?
Pretty sure that they are per file (per inode if you like).
The FILE_CONTEXTS hang off a PVOID* which is plugged into the FSRTL_ADVANCED_FILE_SYSTEM_HEADER and that pretty much by definition is to do the the stream and not the DIRENT
Sure, but how does that plug into hard links, in practice?
I presumed per node also, meaning all hard links share the same
FLT_FILE_CONTEXT.
all hard links share the same
I cannot see how they couldn’t, but its an easy test.