CreateFile Vs DuplicateHandle [and IRP_MJ_CREATE]

NTDEV
1

Hi All,
Just want to confirm (and refresh) my understanding about this. lets say that there are two processes. Process A and Process B. Process A opens a handle to a device, the driver gets IRP_MJ_CREATE call.

  1. Then process B calls DuplicateHandle API to create a copy for it’s use.

    In my understanding when process B calls DuplicateHandle, the driver will NOT get a notification at all (IRP_MJ_CREATE will not get called). Just the reference count on the handle will get incremented. Is this correct?

  2. Process B is done with the handle and it calls CloseHandle (on the “duplicate” handle).

    This will NOT result in a call to IRP_MJ_CLOSE, since the reference count on the handle is still not zero (Process A still has it). Is this correct?

  3. After Process B closed the handle (step-2 above) the process A also closes the handle.

    This call will result in call to IRP_MJ_CLOSE, as now the reference count on the object is zero.

Is this understanding correct?

Please let me know. Appreciate the time.

  • Aj
2

This is correct if you replace “reference count” with “HANDLE count” and “IRP_MJ_CLOSE” with “IRP_MJ_CLEANUP”