file access in Windows XP IRP_MJ_CREATE

Hi,

I’ve noticed that a rename or a move command sends an IRP_MJ_CREATE to
my filter driver with desiredaccess set to 0x00000080 (for the dest. file)
I don’t see this value defined in any of the XP DDK headers. Am I
overlooking something very obvious here? Can any one throw some light on
this?

Regards,

Royston Mascarenhas.
MicroWorld Technologies Inc.

Hi, Rayston

that value may be FILE_READ_ATTRIBUTES. it defined in ntddk.h as below.

#define FILE_READ_ATTRIBUTES ( 0x0080 )

0x0080 and 0x00000080 are same. :slight_smile:

when rename request comes, filesystem checks if there exists same
filename.
IRP_MJ_CREATE request is for that purpose.

hope this helps.

Terra.

???_OPEN_TARGET_DIRECTORY or such. Don’t forget the exact name.

Max

----- Original Message -----
From: “Royston Mascarenhas”
To: “File Systems Developers”
Sent: Tuesday, September 17, 2002 4:21 PM
Subject: [ntfsd] file access in Windows XP IRP_MJ_CREATE

> Hi,
>
> I’ve noticed that a rename or a move command sends an IRP_MJ_CREATE
to
> my filter driver with desiredaccess set to 0x00000080 (for the dest.
file)
> I don’t see this value defined in any of the XP DDK headers. Am I
> overlooking something very obvious here? Can any one throw some
light on
> this?
>
> Regards,
>
> Royston Mascarenhas.
> MicroWorld Technologies Inc.
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to %%email.unsub%%
>

#define FILE_READ_ATTRIBUTES ( 0x0080 ) // all

  • Nicholas Ryan

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Royston
Mascarenhas
Sent: Tuesday, September 17, 2002 5:22 AM
To: File Systems Developers
Subject: [ntfsd] file access in Windows XP IRP_MJ_CREATE

Hi,

I’ve noticed that a rename or a move command sends an
IRP_MJ_CREATE to my filter driver with desiredaccess set to
0x00000080 (for the dest. file) I don’t see this value
defined in any of the XP DDK headers. Am I overlooking
something very obvious here? Can any one throw some light on this?

Regards,

Royston Mascarenhas.
MicroWorld Technologies Inc.


You are currently subscribed to ntfsd as: xxxxx@nryan.com
To unsubscribe send a blank email to %%email.unsub%%

oops! sorry about that. Don’t know how I overlooked that one.
I still have a problem though.

When I do a rename or a move I expect to see an IRP_MJ_CREATE
that will “create” the destination file. However on Windows XP
all I see are IRP_MJ_CREATEs with desiredaccess set to 0x00000080
(FILE_READ_ATTRIBUTES), disposition as FILE_OPEN and options as
0x00200124.

Shouldn’t I be getting a write access mask for and disposition
to create the file?

I don’t seem to see this on Windows NT or 2K.

Thanks!

Royston Mascarenhas.

You may see a create for what LOOKS like the destination file name, but
if you look closely the SL_OPEN_TARGET_DIRECTORY flag is set in
pIrpSp->Flags, so the system is actually opening the DIRECTORY that the
file is being moved into. (Trace into the rename code in
NtSetInformationFile to see exactly what happens).

  • Nicholas Ryan

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Royston
Mascarenhas
Sent: Wednesday, September 18, 2002 6:38 AM
To: File Systems Developers
Subject: [ntfsd] Re: file access in Windows XP IRP_MJ_CREATE

oops! sorry about that. Don’t know how I overlooked that one.
I still have a problem though.

When I do a rename or a move I expect to see an IRP_MJ_CREATE
that will “create” the destination file. However on Windows
XP all I see are IRP_MJ_CREATEs with desiredaccess set to
0x00000080 (FILE_READ_ATTRIBUTES), disposition as FILE_OPEN
and options as 0x00200124.

Shouldn’t I be getting a write access mask for and
disposition to create the file?

I don’t seem to see this on Windows NT or 2K.

Thanks!

Royston Mascarenhas.


You are currently subscribed to ntfsd as: xxxxx@nryan.com
To unsubscribe send a blank email to %%email.unsub%%