How do you tell what kind of object you are opening?

NTFSD
1

I’m trying to figure out if the file being open by IoCreateFile and others is a /volume/directory/file,

Parameters.Create.Options flags can be set for FILE_DIRECTORY_FILE so that’s clear, but
FILE_NON_DIRECTORY_FILE does not distinguish a VOLUME from a FILE ?

Furthermore the Options flags have bits set that are not documented. By setting a breakpoint in IRP_MJ_CREATE I find I am looking at as the Options flag for opening of a volume (0x100 0020 ) . Yet I’m opening
\Device\Harddisk Volume2

These flags dont make sense?

Whats going on?

2

The Options flags FILE_NON_DIRECTORY_FILE do not have to be present in most
cases of irp_mj_create (hence IoCreateFile &c). For a simple open these bits
do not have to be present. So you cannot use these bits to determine if the
object beig opened is a file or a directory. So far as I know all you can do
is allow the open to take place and then query the handle/file_object.

“Larry Dick” wrote in message news:xxxxx@ntfsd…
I’m trying to figure out if the file being open by IoCreateFile and others
is a /volume/directory/file,

Parameters.Create.Options flags can be set for FILE_DIRECTORY_FILE so
that’s clear, but
FILE_NON_DIRECTORY_FILE does not distinguish a VOLUME from a FILE ?

Furthermore the Options flags have bits set that are not documented. By
setting a breakpoint in IRP_MJ_CREATE I find I am looking at as the Options
flag for opening of a volume (0x100 0020 ) . Yet I’m opening
\Device\Harddisk Volume2

These flags dont make sense?

Whats going on?

3

Just to be clear I meant FILE_DIRECTORY_FILE and FILE_NON_DIRECTORY_FILE as
opposed to just one of this pair.

“Lyndon J Clarke” wrote in message
news:xxxxx@ntfsd…
> The Options flags FILE_NON_DIRECTORY_FILE do not have to be present in
most
> cases of irp_mj_create (hence IoCreateFile &c). For a simple open these
bits
> do not have to be present. So you cannot use these bits to determine if
the
> object beig opened is a file or a directory. So far as I know all you can
do
> is allow the open to take place and then query the handle/file_object.
>
> “Larry Dick” wrote in message
news:xxxxx@ntfsd…
> I’m trying to figure out if the file being open by IoCreateFile and others
> is a /volume/directory/file,
>
> Parameters.Create.Options flags can be set for FILE_DIRECTORY_FILE so
> that’s clear, but
> FILE_NON_DIRECTORY_FILE does not distinguish a VOLUME from a FILE ?
>
> Furthermore the Options flags have bits set that are not documented. By
> setting a breakpoint in IRP_MJ_CREATE I find I am looking at as the
Options
> flag for opening of a volume (0x100 0020 ) . Yet I’m opening
> \Device\Harddisk Volume2
>
> These flags dont make sense?
>
> Whats going on?
>
>
>