CreateFile in IRP_MJ_CREATE!

NTFSD
1

Hi,

Iam trying to open a file(by using ZwCreateFile) in IRP_MJ_CREATE, but it
blue screens.

Is it not possible to open a file in IRP_MJ_CREATE?

Does native calls like ZwCreateFile results in recursive IRP_MJ_CREATE??

With Regards,
A.Ilamparithi

2

Yes, it is possible to open a file in IRP_MJ_CREATE.

I don’t see why it bug-checks. Give us a code sample
or attach a debugger and let us know what the problem
is. Do you roll your own Irp? Please provide us with
more details.

Yes, opening a file using ZwCreateFile can result in a
recursive IRP_MJ_CREATE (also called re-entrancy)
being seen in your filter driver, but there are
various methods to avoid that. Search the list archive
for this topic as it has been discussed many times
before.

Best regards,
Razvan

— “A.Ilamparithi” wrote:
> Hi,
>
> Iam trying to open a file(by using ZwCreateFile) in
> IRP_MJ_CREATE, but it
> blue screens.
>
> Is it not possible to open a file in IRP_MJ_CREATE?
>
> Does native calls like ZwCreateFile results in
> recursive IRP_MJ_CREATE??
>
> With Regards,
> A.Ilamparithi
>
>

__________________________________
Do you Yahoo!?
New and Improved Yahoo! Mail - 100MB free storage!
http://promotions.yahoo.com/new_mail

3

Hi,

This is the code sample i used.

swprintf( loggerPath, L"\Device\HarddiskVolume1\glDriver_logger.txt");

RtlInitUnicodeString( &fileName, loggerPath );
InitializeObjectAttributes(&ObjectAttributes, &fileName,
OBJ_CASE_INSENSITIVE,
NULL, NULL);

Status =
ZwCreateFile(&fileHandle,GENERIC_WRITE,&ObjectAttributes,
&IoStatusBlock,NULL,FILE_ATTRIBUTE_NORMAL,0,
FILE_CREATE,FILE_SYNCHRONOUS_IO_NONALERT,NULL,0);

if ( NT_SUCCESS( Status ) )
{
file://Close opened file and signal that we can log.
DbgPrint(“File Opened successfully”);
Status=ZwClose( fileHandle );
if(NT_SUCCESS(Status))
{
DbgPrint(“File Closed Successfully”);
}
}
else
{
if(IoStatusBlock.Information ==FILE_CREATED)
DbgPrint(“File Created”);
else if(IoStatusBlock.Information ==FILE_OPENED)
DbgPrint(“File opened”);
else if(IoStatusBlock.Information ==FILE_OVERWRITTEN)
DbgPrint(“File Written”);
else if(IoStatusBlock.Information ==FILE_SUPERSEDED)
DbgPrint(“File superseed”);
else if(IoStatusBlock.Information ==FILE_EXISTS)
DbgPrint(“File exist”);
else if(IoStatusBlock.Information ==FILE_DOES_NOT_EXIST)
DbgPrint(“File not exist”);
else
DbgPrint(“UNKNOWN return value”);
}

It works correctly when i try this with my IOCTL.

But when i try to do this in IRP_MJ_CREATE it blue screens.

I get unexcepted_kernel_mode_trap.

The trap number is sometimes 0x00000005 or 0x00000008.

With Thanks,
A.Ilamparithi.

“Razvan Hobeanu” wrote in message
news:xxxxx@ntfsd…
> Yes, it is possible to open a file in IRP_MJ_CREATE.
>
> I don’t see why it bug-checks. Give us a code sample
> or attach a debugger and let us know what the problem
> is. Do you roll your own Irp? Please provide us with
> more details.
>
> Yes, opening a file using ZwCreateFile can result in a
> recursive IRP_MJ_CREATE (also called re-entrancy)
> being seen in your filter driver, but there are
> various methods to avoid that. Search the list archive
> for this topic as it has been discussed many times
> before.
>
> Best regards,
> Razvan
>
> — “A.Ilamparithi” wrote:
> > Hi,
> >
> > Iam trying to open a file(by using ZwCreateFile) in
> > IRP_MJ_CREATE, but it
> > blue screens.
> >
> > Is it not possible to open a file in IRP_MJ_CREATE?
> >
> > Does native calls like ZwCreateFile results in
> > recursive IRP_MJ_CREATE??
> >
> > With Regards,
> > A.Ilamparithi
> >
> >
>
>
>
>
>
> __________________________________
> Do you Yahoo!?
> New and Improved Yahoo! Mail - 100MB free storage!
> http://promotions.yahoo.com/new_mail
>