Does ZwOpenFile really cause a recursion!??

NTFSD
1

If I intercept an IRP doing MJ_CREATE, for example, and call a
“ZwOpenFile” to probe the same file that this IRP is “creating”, does
this “ZwOpenFile” call generate another IRP targeting the same file? If
it does, then doing so will create a recursion. But does it really?

Thanks ahead!
feng

2

Read the FAQ:
https://www.osronline.com/article.cfm?id=17#Q34

Search the archives of this list for:
IoCreateFileSpecifyDeviceObjectHint

Almost all questions have been asked and answered
before. You’ll get faster answers to your questions
by doing a little searching.

— feng wrote:

> If I intercept an IRP doing MJ_CREATE, for example,
> and call a
> “ZwOpenFile” to probe the same file that this IRP is
> “creating”, does
> this “ZwOpenFile” call generate another IRP
> targeting the same file? If
> it does, then doing so will create a recursion. But
> does it really?
>
> Thanks ahead!
> feng
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>

3

Randy Cook wrote:

Read the FAQ:
https://www.osronline.com/article.cfm?id=17#Q34

Search the archives of this list for:
IoCreateFileSpecifyDeviceObjectHint

Almost all questions have been asked and answered
before. You’ll get faster answers to your questions
by doing a little searching.

— feng wrote:
>
>
>
>>If I intercept an IRP doing MJ_CREATE, for example,
>>and call a
>>“ZwOpenFile” to probe the same file that this IRP is
>>“creating”, does
>>this “ZwOpenFile” call generate another IRP
>>targeting the same file? If
>>it does, then doing so will create a recursion. But
>>does it really?
>>
>>Thanks ahead!
>>feng
>>
>>—
>>Questions? First check the IFS FAQ at
>>https://www.osronline.com/article.cfm?id=17
>>
>>You are currently subscribed to ntfsd as:
>>xxxxx@yahoo.com
>>To unsubscribe send a blank email to
>>xxxxx@lists.osr.com
>>
>>
>>
>
>
>—
>Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: xxxxx@bit9inc.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>
>
Good article! Thank you, Randy!