How to determine read and write in IRP_MJ_CREATE pre operation

I tried to determine the read and write in pre create to decide whether to perform a simple redirect. If it is a read operation, I will not make any changes, otherwise I will simply redirect it using simrep.

I know that there is a variable whose name is like satisfying this need.

FltObjects->FileObject->ReadAccess

But it doesn’t seem to work

In addition, in a post in 2005, it was said that Create cannot determine whether it is a read or write operation, and can only judge whether it is opened or created. for reference only.

thanks everyone…

You can check the DesiredAccess but opening a file for writing does not imply the file will be written later.

file for writing does not imply the file will be written later
Nor vice versa. Kernel modules can write to local disks on any file object.

@rod_widdowson said:

file for writing does not imply the file will be written later
Nor vice versa. Kernel modules can write to local disks on any file object.

Well, that’s true too.