Does FILE_OBJECT->Flags change after pre-create?

NTFSD
1

Hello.

I want to understand what each flag in the FILE_OBJECT->Flags does.

My question: is this field set only once by the I/O Manager before the
IRP is issued to the I/O stack (mini-filter & file system) and persists
during the entire lifetime of a file object? Or can it be updated
dynamically? E.g. the FO_FOO_BAR field was NOT set in pre-create but it
was set in IRP_MJ_X, could this happen? If it is updated, does it only
happen on specific flags and on specific IRPs?

Thank you.

Thanos Makatos
Software engineer
Barcelona Supercomputing Center

WARNING / LEGAL TEXT: This message is intended only for the use of the
individual or entity to which it is addressed and may contain
information which is privileged, confidential, proprietary, or exempt
from disclosure under applicable law. If you are not the intended
recipient or the person responsible for delivering the message to the
intended recipient, you are strictly prohibited from disclosing,
distributing, copying, or in any way using this message. If you have
received this communication in error, please notify the sender and
destroy and delete any copies you may have received.

http://www.bsc.es/disclaimer.htm

2

The flags can change. Sometimes the IO manager changes them (like setting
FO_HANDLE_CREATED after a successful IRP_MJ_CREATE) and sometimes by the
file system (like for FO_FILE_MODIFIED and so on). In some cases even
filters can change them (for example FltMgr will set FO_VOLUME_OPEN when it
detects the operation is a volume open).

I’m not aware of any list of when these flags get changed. I’d start such an
investigation by looking at the fastfat and CDFS source code (shipping with
the WDK) for some examples of when file systems can change these flags.

What are you trying to do ?

Thanks,
Alex.