Check file on IRP_MJ_CREATE

NTFSD
1

I need read file contens on IRP_MJ_CREATE. Is this pseudocode correct?

retrieve file name from IRP
if(FILE_COMPLETE_IF_OPLOCKED is not set){
ZwCreateFile
ZwReadFile
ZwClose
} else {
// file is on local disk
queue work item and wait for it
}

work item:
ZwCreateFile
ZwReadFile
ZwClose

  1. Is this correct?

  2. Is a qood idea using work item? Or is better launch my owm
    thread?

Petr Balas (petr at petrbalas dot cz)

2

> I need read file contens on IRP_MJ_CREATE. Is this pseudocode correct?

If you need to read the same file as is being opened, remember to use
noncached read - using cached read there will cause BSOD in the cache
manager later if the file in question is the executable being opened in
CreateProcess.
Looks like the above is FASTFAT problem - it BSODs if the same file object
will have both data and an image sections initialized.

Max

3

I think you are talking about reading using the same file object, that is
without reopening the file again. But Peter (according to his original
message) )re-opens the file again, so he can
read the file by caching or non-caching the file, that does not matter.

The problem you mention with FASTFAT only happens when you try to use the
original file object to issue an IRP_MJ_READ.

Inaki.

-----Original Message-----
From: Maxim S. Shatskih
Sent: viernes 31 de marzo de 2000 19:08
To: File Systems Developers
Subject: [ntfsd] Re: Check file on IRP_MJ_CREATE

> I need read file contens on IRP_MJ_CREATE. Is this pseudocode correct?

If you need to read the same file as is being opened, remember to use
noncached read - using cached read there will cause BSOD in the cache
manager later if the file in question is the executable being opened in
CreateProcess.
Looks like the above is FASTFAT problem - it BSODs if the same file object

will have both data and an image sections initialized.

Max

You are currently subscribed to ntfsd as: xxxxx@pandasoftware.es
To unsubscribe send a blank email to $subst(‘Email.Unsub’)