FILE_OPEN_BY_FILE_ID and STATUS_REPARSE

NTFSD
1

In my minifilter I’m reparsing a file originally opening with FILE_OPEN_BY_FILE_ID flag set to another volume. The problem is that when create hits that “another volume”, FILE_OPEN_BY_FILE_ID flag remains set in the new create options (although FILE_IBJECT->FileName no longer contains ID, but some name-based path to the file). So, is there any way to let the I/O manager know that file that’s being reparsed is no longer ID-based? If not, is there any reliable way to tell (just by looking at FILE_OBJECT) that it’s name-based, not ID-based? Something like "if FileName.Length != 8 || FileName.Buffer[0] == L’\') -> it’s not ID-based file?

TIA,

Vladimir

2

Hi Vladimir,

As far as I know the CreateOptions are captured in the OPEN_PACKET structure
during the call to IopCreateFile and then are always copied from the
OPEN_PACKET in the IRP_MJ_CREATE Irp.

Also, if I remember correctly, in the case of FILE_OPEN_BY_FILE_ID the
FILE_OBJECT->FileName can be set to point either to ''+8 bytes or just the
8 bytes so in theory it’s possible to have an open-by-fileID name that is
indistinguishable from an open-by-name for a file that only has a 4
character name.

Thanks,
Alex.