Working with sfilter, I found that before real create/open request for a file, a create/open with FILE_OPEN_REPARSE_POINT is requested, what does this mean? And I also found that when a executable file loads dlls, it initiate one create/open with FILE_OPEN_REPARSE_POINT for one dll in the same path although the dll is not existed in that path, the point is I want to distinguish this kind of create/open with FILE_OPEN_REPARSE_POINT from that before a new file is created.
I don’t know anything about sfilter, but I can tell you what a reparse
point is. Basically, it’s a way of attaching some additional metadata
to a file for a filter driver (or minifilter driver) to use. The
FILE_OPEN_REPARSE_POINT flag can be set when you want to try to bypass
the filter. If the filter isn’t working or isn’t loaded, you can still
try to open the file with that flag set. Subsequently, you can then
delete the file. This is convenient if your filter is causing a BSOD,
and you want to get rid of the file that causes it to be invoked.
More about reparse points:
http://msdn2.microsoft.com/en-us/library/aa365503.aspx
~Eric
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
liyuncheng@163.com
Sent: Sunday, August 12, 2007 9:19 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] FILE_OPEN_REPARSE_POINT
Working with sfilter, I found that before real create/open request for a
file, a create/open with FILE_OPEN_REPARSE_POINT is requested, what does
this mean? And I also found that when a executable file loads dlls, it
initiate one create/open with FILE_OPEN_REPARSE_POINT for one dll in the
same path although the dll is not existed in that path, the point is I
want to distinguish this kind of create/open with
FILE_OPEN_REPARSE_POINT from that before a new file is created.
NTFSD is sponsored by OSR
For our schedule debugging and file system seminars (including our new
fs mini-filter seminar) visit:
http://www.osr.com/seminars
You are currently subscribed to ntfsd as: xxxxx@edsiohio.com To
unsubscribe send a blank email to xxxxx@lists.osr.com