fileobject is missing...

I have a minifilter, and when i run outlook express, i catch some write operations.

I print the file name and fileobject in both pre/post-create and pre/post-write callback., but i find that the fileobject in write operation does not have a create operation.

why? dose the point of fileobject have been changed?

so sorry for my poor english…

thx.

xxxxx@gmail.com wrote:

I have a minifilter, and when i run outlook express, i catch some write operations.

I print the file name and fileobject in both pre/post-create and pre/post-write callback., but i find that the fileobject in write operation does not have a create operation.

why? dose the point of fileobject have been changed?

Search for stream file objects in the archives. Basically file systems
and other components can use IoCreateStreamFIleObject() and its variants
to create a file object. In these cases you will see IRP_MJ_CLEANUP
(except in the Lite() variant) and IRP_MJ_CLOSE on them but you will not
see an IRP_MJ_CREATE.

Also note that the file name in the file object is only valid during
pre-create, after this the name should not be relied upon within the
file object. As well, in stream file objects the file name is generally
never set.

Thanks,

Pete


Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

another consideration is that the file in question could have been opened prior to driver load.