I added FltRemoveOpenReparseEntry in Post and I have tried with FileTest. “CreateFile” will success if my filter is running and not if I stopped my filter. Which is good. However, it still behaves the same if I use WordPad to open/close the file repeatedly. I compared some ProcMon traces (with filter of my file’s name) either Wordpad is able or unable to open the file. The difference is that many “QueryStandardInformationFile” and “ReadFile” are present when Wordpad is able to open the file while they are not there if failed to open.
/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
Below are cropped from “able-to-open” ProcMon:
CreateFile C:\Target\noteRP.txt SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened
CreateFile C:\Target\noteRP.txt SUCCESS Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
QueryBasicInformationFile C:\Target\noteRP.txt SUCCESS CreationTime: 3/14/2023 12:21:23 AM, LastAccessTime: 3/14/2023 2:15:47 PM, LastWriteTime: 3/13/2023 6:41:50 PM, ChangeTime: 3/14/2023 12:22:25 AM, FileAttributes: ARPNCI
CloseFile C:\Target\noteRP.txt SUCCESS
QueryDirectory C:\Target\noteRP.txt SUCCESS FileInformationClass: FileBothDirectoryInformation, Filter: noteRP.txt, 2: noteRP.txt
QueryBasicInformationFile C:\Target\noteRP.txt SUCCESS CreationTime: 3/14/2023 12:21:23 AM, LastAccessTime: 3/14/2023 2:15:47 PM, LastWriteTime: 3/13/2023 6:41:50 PM, ChangeTime: 3/14/2023 12:22:25 AM, FileAttributes: ARPNCI
QueryStandardInformationFile C:\Target\noteRP.txt SUCCESS AllocationSize: 8, EndOfFile: 7, NumberOfLinks: 1, DeletePending: False, Directory: False
CreateFile C:\Target\noteRP.txt SUCCESS Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
QueryBasicInformationFile C:\Target\noteRP.txt SUCCESS CreationTime: 3/14/2023 12:21:23 AM, LastAccessTime: 3/14/2023 2:15:47 PM, LastWriteTime: 3/13/2023 6:41:50 PM, ChangeTime: 3/14/2023 12:22:25 AM, FileAttributes: ARPNCI
CloseFile C:\Target\noteRP.txt SUCCESS
ReadFile C:\Target\noteRP.txt SUCCESS Offset: 0, Length: 5, Priority: Normal
ReadFile C:\Target\noteRP.txt SUCCESS Offset: 0, Length: 4
ReadFile C:\Target\noteRP.txt SUCCESS Offset: 0, Length: 2
ReadFile C:\Target\noteRP.txt SUCCESS Offset: 0, Length: 2
ReadFile C:\Target\noteRP.txt SUCCESS Offset: 0, Length: 2
ReadFile C:\Target\noteRP.txt SUCCESS Offset: 0, Length: 2
ReadFile C:\Target\noteRP.txt SUCCESS Offset: 0, Length: 2
ReadFile C:\Target\noteRP.txt SUCCESS Offset: 0, Length: 7
ReadFile C:\Target\noteRP.txt SUCCESS Offset: 0, Length: 4
CloseFile C:\Target\noteRP.txt SUCCESS
CreateFile C:\Target\noteRP.txt SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened
ReadFile C:\Target\noteRP.txt SUCCESS Offset: 0, Length: 2, Priority: Normal
CloseFile C:\Target\noteRP.txt SUCCESS
/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
Below are cropped from “failed-to-open” ProcMon:
CreateFile C:\Target\noteRP.txt SUCCESS Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
QueryNetworkOpenInformationFile C:\Target\noteRP.txt SUCCESS CreationTime: 3/14/2023 12:21:23 AM, LastAccessTime: 3/14/2023 2:25:05 PM, LastWriteTime: 3/13/2023 6:41:50 PM, ChangeTime: 3/14/2023 12:22:25 AM, AllocationSize: 8, EndOfFile: 7, FileAttributes: ARPNCI
FileSystemControl C:\Target\noteRP.txt SUCCESS Control: FSCTL_CREATE_OR_GET_OBJECT_ID
QueryObjectIdInformationVolume C:\Target\noteRP.txt SUCCESS ObjectId: 62247B2074077641A82DDAD298218674
QueryNameInformationFile C:\Target\noteRP.txt SUCCESS Name: \Target\Level_0\noteRP.txt
QueryNameInformationFile C:\Target\noteRP.txt SUCCESS Name: \Target\Level_0\noteRP.txt
QueryNormalizedNameInformationFile C:\Target\noteRP.txt SUCCESS
CloseFile C:\Target\noteRP.txt SUCCESS
CreateFile C:\Target\noteRP.txt SUCCESS Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
FileSystemControl C:\Target\noteRP.txt SUCCESS Control: FSCTL_CREATE_OR_GET_OBJECT_ID
CloseFile C:\Target\noteRP.txt SUCCESS
CreateFile C:\Target\noteRP.txt REPARSE Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: <unknown>
CreateFile C:\Target\noteRP.txt SUCCESS Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
QueryBasicInformationFile C:\Target\noteRP.txt SUCCESS CreationTime: 3/14/2023 12:21:23 AM, LastAccessTime: 3/14/2023 2:25:05 PM, LastWriteTime: 3/13/2023 6:41:50 PM, ChangeTime: 3/14/2023 12:22:25 AM, FileAttributes: ARPNCI
CloseFile C:\Target\noteRP.txt SUCCESS
CreateFile C:\Target\noteRP.txt SUCCESS Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
QueryBasicInformationFile C:\Target\noteRP.txt SUCCESS CreationTime: 3/14/2023 12:21:23 AM, LastAccessTime: 3/14/2023 2:25:05 PM, LastWriteTime: 3/13/2023 6:41:50 PM, ChangeTime: 3/14/2023 12:22:25 AM, FileAttributes: ARPNCI
CloseFile C:\Target\noteRP.txt SUCCESS
CreateFile C:\Target\noteRP.txt SUCCESS Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
FileSystemControl C:\Target\noteRP.txt SUCCESS Control: FSCTL_CREATE_OR_GET_OBJECT_ID
CloseFile C:\Target\noteRP.txt SUCCESS
QueryDirectory C:\Target\noteRP.txt SUCCESS FileInformationClass: FileIdBothDirectoryInformation, Filter: noteRP.txt, 2: noteRP.txt
CreateFile C:\Target\noteRP.txt SUCCESS Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
QueryBasicInformationFile C:\Target\noteRP.txt SUCCESS CreationTime: 3/14/2023 12:21:23 AM, LastAccessTime: 3/14/2023 2:25:05 PM, LastWriteTime: 3/13/2023 6:41:50 PM, ChangeTime: 3/14/2023 12:22:25 AM, FileAttributes: ARPNCI
CloseFile C:\Target\noteRP.txt SUCCESS
CreateFile C:\Target\noteRP.txt REPARSE Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: <unknown>
CreateFile C:\Target\noteRP.txt SUCCESS Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
QueryBasicInformationFile C:\Target\noteRP.txt SUCCESS CreationTime: 3/14/2023 12:21:23 AM, LastAccessTime: 3/14/2023 2:25:05 PM, LastWriteTime: 3/13/2023 6:41:50 PM, ChangeTime: 3/14/2023 12:22:25 AM, FileAttributes: ARPNCI
CloseFile C:\Target\noteRP.txt SUCCESS
/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
Note: There are also logs for “C:\Users.…\noteRP.txt.lnk” that I left out from both cases, not sure why there are “.lnk” version. I’ve seen them when I open any text file (without custom reparse points) by Notepad or Wordpad.