DesiredAccess Flag

NTFSD
1

My filter driver has a different behavior when it intercepts two
different temp files that
are opened by application internally. After I compare these two
IRP_MJ_CREATE, I find only
difference is in Parameters.Create.DesiredAccess flag. In one file, it
is 0X00120196. In other
file, it is 0X0012019F. How can I know the meaning of the DesiredAcess
flag? I searched the
DDK document and couldn’t find where the DesiredAcess came from. I guess
the filter
driver miss up something when it processes one of the file opening.

Thanks in advance.

2

> DDK document and couldn’t find where the DesiredAcess came from. I guess

GENERIC_READ and friends.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

3

On Wed, 12 May 2004 20:49:27 -0500, David Wu wrote:

DesiredAccess is the value passed to NtCreateFile, which is again
the value passed to Win32 CreateFile in the parameter also called
DesiredAccess.

User mode documentation on these flags is extensive and mostly complete.

However for quick reference, I generally open winnt.h from the Platform
SDK,
the comments in that file are brief and often more to the point than the
more
extensive prose in the documentation, but only if you have read the
documentation
before.

> My filter driver has a different behavior when it intercepts two
> different temp files that
> are opened by application internally. After I compare these two
> IRP_MJ_CREATE, I find only
> difference is in Parameters.Create.DesiredAccess flag. In one file, it
> is 0X00120196. In other
> file, it is 0X0012019F. How can I know the meaning of the DesiredAcess
> flag? I searched the
> DDK document and couldn’t find where the DesiredAcess came from. I guess
> the filter
> driver miss up something when it processes one of the file opening.
>
> Thanks in advance.
>
>

–
#include <disclaimer.h></disclaimer.h>