Detecting IO_REPARSE

NTFSD
1

Hi all,

I am redirecting the opening of certain files, in PreCreate, to a single known file[MYFILE], like this:

if(redirect(Data->Iopb->TargetFileObject))
{
status = ReplaceFileObjectName(Data->Iopb->TargetFileObject,
MYFILE);

if(NT_SUCCESS(status))
{
Data->IoStatus.Status = STATUS_REPARSE;
Data->IoStatus.Information = IO_REPARSE;
}
}

But on another operation, like PreWrite, I want to detect that the file has been redirected. Also, I want to know the original file path.
Is this possible?

Thank you. :slight_smile:

2

You could use ECPs (Vista and newer). Just set an ECP (and possibly create
the ECP list) in your PreCreate handler, add any information you need in the
ECP and then reparse it. The new create IRP generated by the IO manager
should have your ECP. Then you can know this was one of your creates and you
can add something in a streamhandle context.

Does this sound reasonable ?

Thanks,
Alex.

3

Yes it sounds reasonable.
Thank you very much Alex :slight_smile: