Getting file handle in kernel space without reopening file

NTFSD
1

Hi All,

i would like to get file handle in kernel space, for example in IRP_MJ_WRITE, without re-opening file with one of next functions: ZwCreateFile, *CreateFile, … Is it possible?
Because if file is opened again some additional IRPs are triggered.

Br, Mitja

2

>>i would like to get file handle in kernel space, for example in IRP_MJ_WRITE, without re-opening file with one of next functions: ZwCreateFile, >>*CreateFile, … Is it possible?

>Because if file is opened again some additional IRPs are triggered.

You could use ObOpenObjectByPointer.
Since you have already mentioned “additional IRPs are triggered”, be cautious with how you use the file handle to issue file system calls like ZwReadFile, ZwWriteFile, etc. They will enter from the top of the stack if you don’t take care.

Regards,
Ayush Gupta

3

IoCreateFileSpecifyDeviceObjectHint???

–
Best regards,
Vladimir Zinin
mailto:xxxxx@gmail.com

xxxxx@hermes-softlab.com wrote:

Hi All,

i would like to get file handle in kernel space, for example in IRP_MJ_WRITE, without re-opening file with one of next functions: ZwCreateFile, *CreateFile, … Is it possible?
Because if file is opened again some additional IRPs are triggered.

Br, Mitja