File system minifilter

NTFSD
1

Hy,
I have a little problem. I read on the MSDN that the IRP_MJ_CREATE is called when creating a file/directory or opening an existing file/directory/volume, but I can’t find how could I know what opertaion causes the IRP_MJ_CREATE (creating a file or opening a volume etc.). Is there a flag or something that represents this?
Thanx in advance!

2

There are optional flags that limit what can be opened, but the way to
determine what something is requires asking the file system. You can do
this by opening the object and looking at it after the open or by
looking at the containing directory and extracting its attributes. Most
developers open the object and look at it after the open.

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@freemail.hu
Sent: Tuesday, December 12, 2006 1:59 AM
To: ntfsd redirect
Subject: [ntfsd] File system minifilter

Hy,
I have a little problem. I read on the MSDN that the IRP_MJ_CREATE is
called when creating a file/directory or opening an existing
file/directory/volume, but I can’t find how could I know what opertaion
causes the IRP_MJ_CREATE (creating a file or opening a volume etc.). Is
there a flag or something that represents this?
Thanx in advance!

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Can you tell me which are these flags?

4

Hi gabor!
In the pre- create you dont even know whether the path specified is VALID. Judging whether the operation is for a file or a directory is even more %USELESS%.
The better way would be to do this:
Call FltQueryVolumeInformationFile with FileStandardInformation.
Check the value of the Directory field.
Conclude whether the object represents a file or an object.

By the way is there any special reason y u find out this in a pre create???

HAPPY CODING

Ayush

5

CORRECTION IN THE LAST POST:

>Conclude whether the object represents a file or a DIRECTORY.

COMMENTS:
Do the above process only after the post create comes.

SECOND SOLUTION:

If it is a &MUST& for u to identify it in the pre callback itself , then use this method:

  1. in the pre callback routine, issue a FltCreateFile with the same Path.
  2. Once the operation completes, call FltQueryVolumeInformationFile with FileStandardInformation.
  3. Check the value of the Directory field.
  4. Conclude whether the object reperesents a file or a directory.
  5. call FltClose to close the handle.
  6. Let the PreCreate proceed.