File protect type and relevant IRP

NTFSD
1

Can anyone tell me the relation of File protect type and relevant IRP,for
example if i want to protect to delete ,which IRPs i will block ? and
rename? write? read? open? run? copy?
thanks in advance

slummer

2

> delete

IRP_MJ_SET_INFORMATION/FileDispositionInformation

rename?

IRP_MJ_SET_INFORMATION/FileRenameInformation
If you mean move as well: No IRP - or a bunch of them more procisely.

write?

IRP_MJ_WRITE.

read?

IRP_MJ_READ

open?

IRP_MJ_CREATE

run?

IRP_MJ_CREATE/EXECUTE rights requested Not certain! Execute rights
are requested for DLLs and some other files, too.

copy?

No such single IRP - it’s a combination of multiple IRPs.

–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32
developers.
Alfa File Monitor - File monitoring library for Win32 developers.

3

Thanks Dejan :
But i find i cann’t block any irp by comparing filename if the files i guard is a *.doc ,Under the condition ,How can i do? thanks

----- Original Message -----
From: “Dejan Maksimovic”
To: “Windows File Systems Devs Interest List”
Sent: Monday, October 13, 2003 3:40 PM
Subject: [ntfsd] Re: File protect type and relevant IRP

> > delete
>
> IRP_MJ_SET_INFORMATION/FileDispositionInformation
>
> > rename?
>
> IRP_MJ_SET_INFORMATION/FileRenameInformation
> If you mean move as well: No IRP - or a bunch of them more procisely.
>
> > write?
>
> IRP_MJ_WRITE.
>
> > read?
>
> IRP_MJ_READ
>
> > open?
>
> IRP_MJ_CREATE
>
> > run?
>
> IRP_MJ_CREATE/EXECUTE rights requested Not certain! Execute rights
> are requested for DLLs and some other files, too.
>
> > copy?
>
> No such single IRP - it’s a combination of multiple IRPs.
>
> –
> Kind regards, Dejan M. MVP for DDK
> http://www.alfasp.com E-mail: xxxxx@alfasp.com
> Alfa Transparent File Encryptor - Transparent file encryption services.
> Alfa File Protector - File protection and hiding library for Win32
> developers.
> Alfa File Monitor - File monitoring library for Win32 developers.
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@hotmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

4

Try harder:-) You probably don’t block the right file names - take into account that Word uses temporary files etc.

dwg wrote:

Thanks Dejan :
But i find i cann’t block any irp by comparing filename if the files i guard is a *.doc ,Under the condition ,How can i do? thanks

–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa File Monitor - File monitoring library for Win32 developers.

5

Dejan:
Thank u, and can u tell me what means such as
"IRP_MJ_SET_INFORMATION/FileDispositionInformation
", especcially what means FileDispositionInformation ?
thanks again

6

It means that

IoGetCurrentStackLocation(Irp)->Parameters.SetFile.FileInformationClass ==
FileDispositionInformation

Alexei.

“slummer” wrote in message news:xxxxx@ntfsd…
>
> Dejan:
> Thank u, and can u tell me what means such as
> "IRP_MJ_SET_INFORMATION/FileDispositionInformation
> ", especcially what means FileDispositionInformation ?
> thanks again
>
>
>
>
>

7

well… that means IRP IRP_MJ_SET_INFORMATION as Irp->MajorFunction
and IrpSp->Parameters.SetFile.FileInformationClass =
FileDispositionInformation (IrpSp is IoGetCurrentStackLocation(Irp)).
Just a side note: You’ll have a hard time not crashing your system
if you’re not already familiar with these…
Consider studying the SFilter sample from Microsoft IFS Kit.

slummer wrote:

Dejan:
Thank u, and can u tell me what means such as
"IRP_MJ_SET_INFORMATION/FileDispositionInformation
", especcially what means FileDispositionInformation ?
thanks again

–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32
developers.
Alfa File Monitor - File monitoring library for Win32 developers.