I trace all EncryptionFile(my work).
I do the test:
1.FileB is opened,and share-access is FILE_SHARE_DELETE.
2.Read FileB some data(cache enable);
3.close FileB
3.MoveEX(FileA,FileB,MOVEFILE_REPLACE_EXISTING);
I observed this situation:
1.FileB is opened with FileObjectB;
2.Cleanup FileB(no Close,because the cache).
3.FileA is opened
4.the ParentDir for FileB is opened(because SL_OPEN_TARGET_DIRECTORY)
5.SetInformation(FileA->FileB)
6.Cleanup and Close the ParentDir for the FileB.
7.cleanup and Close the FileA(now it is FileB).
OK.where is the IRP_CLOSE for the FileB???
the step 1 and 2 in the above situation,the FileB is opened and cleanuped,where’s the IRP_CLOSE for it?
In my trace code,when all FO is closed for the FCB,I delete the trace structure for the FCB.But in the above situation,I can’t do it.
I should detete the trace structure for the FCB in the SetInformation.But in IRP_MJ_SET_INFORMATION,I can’t get the FileObject of the Target File,I just can get the Target FileName.
Should I delete the trace structure according to the Target FileName?It 's ugly,I think.