Open with FILE_FLAG_OPEN_REPARSE_POINT flag

Hi,

I implemented a mini-filter with hooks on IRP_MJ_CREATE pre and post. From a user space app, I’m calling CreateFile for reparse point file with the flag FILE_FLAG_OPEN_REPARSE_POINT. Should I get a hook for that and catch it on pre/post create as I don’t seem to get it?

Thanks,
Yaniv

Yes, you would get an IRP_MJ_CREATE for it.
You most likely returned from IRP_MJ_CREATE before checking the
particular file, or incorrectly checked the flags.

I implemented a mini-filter with hooks on IRP_MJ_CREATE pre and post. From
a user space app, I’m calling CreateFile for reparse point file with the
flag FILE_FLAG_OPEN_REPARSE_POINT. Should I get a hook for that and catch it
on pre/post create as I don’t seem to get it?

So, I have a reparse point and I am getting the pre create but for certain processes (such as SearchIndexer.exe), I do not get the post create callback.
Is there something (other mini filter) that blocks me?