For a createfile operation, how can I know actual operation the user’s
applications want to perform?
It may be a new file creation, or just to open a non-exist file!
I also want to know how to differentiate a folder operation from a file
operation.
Will anybody be patient to answer these questions for me a guy steps into
filter driver area for the first time?
best regards
Before the create is performed, you can determine what the caller might do
by examining the CreateDisposition value: FILE_SUPERSEDE, FILE_CREATE,
FILE_OPEN, FILE_OPEN_IF, FILE_OVERWRITE, or FILE_OVERWRITE_IF
But you don’t know what really happened until the create operation
completes. You must first check the IoStatusBlock for success in the Status
value, and then check the Information value for what happened: FILE_CREATED,
FILE_OPENED, FILE_OVERWRITTEN, FILE_SUPERSEDED, FILE_EXISTS, or
FILE_DOES_NOT_EXIST.
Creating or opening a folder requires the CreateOptions include the
FILE_DIRECTORY_FILE flag.
Study ZwCreateFile for details.
Ken
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Xiong Weiwei
Sent: Saturday, April 08, 2006 1:29 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] How to know whether a createfile operation is to create a
new file or open a existing file?
For a createfile operation, how can I know actual operation the user’s
applications want to perform?
It may be a new file creation, or just to open a non-exist file!
I also want to know how to differentiate a folder operation from a file
operation.
Will anybody be patient to answer these questions for me a guy steps into
filter driver area for the first time?
best regards
— Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17 You are currently subscribed to
ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank email
to xxxxx@lists.osr.com
Good answer, small correction.
Creating a folder requires the CreateOptions include the
FILE_DIRECTORY_FILE flag. Opening a folder does not.
“Ken Cross” wrote in message news:xxxxx@ntfsd…
> Before the create is performed, you can determine what the caller might do
> by examining the CreateDisposition value: FILE_SUPERSEDE, FILE_CREATE,
> FILE_OPEN, FILE_OPEN_IF, FILE_OVERWRITE, or FILE_OVERWRITE_IF
>
> But you don’t know what really happened until the create operation
> completes. You must first check the IoStatusBlock for success in the
> Status
> value, and then check the Information value for what happened:
> FILE_CREATED,
> FILE_OPENED, FILE_OVERWRITTEN, FILE_SUPERSEDED, FILE_EXISTS, or
> FILE_DOES_NOT_EXIST.
>
> Creating or opening a folder requires the CreateOptions include the
> FILE_DIRECTORY_FILE flag.
>
> Study ZwCreateFile for details.
>
> Ken
>
> ________________________________
>
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Xiong Weiwei
> Sent: Saturday, April 08, 2006 1:29 AM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] How to know whether a createfile operation is to create a
> new file or open a existing file?
>
>
> For a createfile operation, how can I know actual operation the user’s
> applications want to perform?
>
> It may be a new file creation, or just to open a non-exist file!
>
> I also want to know how to differentiate a folder operation from a file
> operation.
>
> Will anybody be patient to answer these questions for me a guy steps into
> filter driver area for the first time?
>
> best regards
>
> — Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17 You are currently subscribed
> to
> ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank
> email
> to xxxxx@lists.osr.com
>
>
Good point. However, if you set the FILE_DIRECTORY_FILE flag, an attempt to
open a regular file will fail.
Ken
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Lyndon J. Clarke
Sent: Saturday, April 08, 2006 11:38 AM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] How to know whether a createfile operation is to create
a new file or open a existing file?
Good answer, small correction.
Creating a folder requires the CreateOptions include the
FILE_DIRECTORY_FILE flag. Opening a folder does not.
“Ken Cross” wrote in message news:xxxxx@ntfsd…
> Before the create is performed, you can determine what the caller might do
> by examining the CreateDisposition value: FILE_SUPERSEDE, FILE_CREATE,
> FILE_OPEN, FILE_OPEN_IF, FILE_OVERWRITE, or FILE_OVERWRITE_IF
>
> But you don’t know what really happened until the create operation
> completes. You must first check the IoStatusBlock for success in the
> Status
> value, and then check the Information value for what happened:
> FILE_CREATED,
> FILE_OPENED, FILE_OVERWRITTEN, FILE_SUPERSEDED, FILE_EXISTS, or
> FILE_DOES_NOT_EXIST.
>
> Creating or opening a folder requires the CreateOptions include the
> FILE_DIRECTORY_FILE flag.
>
> Study ZwCreateFile for details.
>
> Ken
>
> ________________________________
>
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Xiong Weiwei
> Sent: Saturday, April 08, 2006 1:29 AM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] How to know whether a createfile operation is to create a
> new file or open a existing file?
>
>
> For a createfile operation, how can I know actual operation the user’s
> applications want to perform?
>
> It may be a new file creation, or just to open a non-exist file!
>
> I also want to know how to differentiate a folder operation from a file
> operation.
>
> Will anybody be patient to answer these questions for me a guy steps into
> filter driver area for the first time?
>
> best regards
>
> — Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17 You are currently subscribed
> to
> ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank
> email
> to xxxxx@lists.osr.com
>
>
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com
Good point. However applications using win32 api dont have the flag set in
CreateFile &c 
“Ken Cross” wrote in message news:xxxxx@ntfsd…
> Good point. However, if you set the FILE_DIRECTORY_FILE flag, an attempt
> to
> open a regular file will fail.
>
> Ken
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Lyndon J. Clarke
> Sent: Saturday, April 08, 2006 11:38 AM
> To: Windows File Systems Devs Interest List
> Subject: Re:[ntfsd] How to know whether a createfile operation is to
> create
> a new file or open a existing file?
>
> Good answer, small correction.
>
> Creating a folder requires the CreateOptions include the
> FILE_DIRECTORY_FILE flag. Opening a folder does not.
>
>
>
> “Ken Cross” wrote in message news:xxxxx@ntfsd…
>> Before the create is performed, you can determine what the caller might
>> do
>> by examining the CreateDisposition value: FILE_SUPERSEDE, FILE_CREATE,
>> FILE_OPEN, FILE_OPEN_IF, FILE_OVERWRITE, or FILE_OVERWRITE_IF
>>
>> But you don’t know what really happened until the create operation
>> completes. You must first check the IoStatusBlock for success in the
>> Status
>> value, and then check the Information value for what happened:
>> FILE_CREATED,
>> FILE_OPENED, FILE_OVERWRITTEN, FILE_SUPERSEDED, FILE_EXISTS, or
>> FILE_DOES_NOT_EXIST.
>>
>> Creating or opening a folder requires the CreateOptions include the
>> FILE_DIRECTORY_FILE flag.
>>
>> Study ZwCreateFile for details.
>>
>> Ken
>>
>> ________________________________
>>
>> From: xxxxx@lists.osr.com
>> [mailto:xxxxx@lists.osr.com] On Behalf Of Xiong Weiwei
>> Sent: Saturday, April 08, 2006 1:29 AM
>> To: Windows File Systems Devs Interest List
>> Subject: [ntfsd] How to know whether a createfile operation is to create
>> a
>> new file or open a existing file?
>>
>>
>> For a createfile operation, how can I know actual operation the user’s
>> applications want to perform?
>>
>> It may be a new file creation, or just to open a non-exist file!
>>
>> I also want to know how to differentiate a folder operation from a file
>> operation.
>>
>> Will anybody be patient to answer these questions for me a guy steps into
>> filter driver area for the first time?
>>
>> best regards
>>
>> — Questions? First check the IFS FAQ at
>> https://www.osronline.com/article.cfm?id=17 You are currently subscribed
>> to
>> ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank
>> email
>> to xxxxx@lists.osr.com
>>
>>
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@comcast.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
I’m sorry to disturbing your discussion for some other simple questions
(1) how to get the ‘CreateDisposition’ value and FILE_DIRECTORY_FILE flag
in create.options?
(2) How to perform a read or write operation within fliter driver?
One of the techniques I read from the IFS FAQ is to create your
own IRP. However, IFS FAQ also said that
"Building create IRPs within a filter. This technique does work properly,
but is completely unsupported and quite difficult to implement correctly.
Because of this, it is a fragile solution that should not be used given the
availability of alternative mechanisms.
"
Anybody who ever did this kind of task could unpuzzle this to me ?
(3) For the second question above, can IoCreateFileSpecifyDeviceObjectHint
be used to get a file Handle, and then Zw*** api could be used to perform
read or write operation?
3x to all!
On 4/9/06, Lyndon J. Clarke wrote:
>
> Good point. However applications using win32 api dont have the flag set in
> CreateFile &c
>
> “Ken Cross” wrote in message news:xxxxx@ntfsd…
> > Good point. However, if you set the FILE_DIRECTORY_FILE flag, an
> attempt
> > to
> > open a regular file will fail.
> >
> > Ken
> >
> >
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com] On Behalf Of Lyndon J. Clarke
> > Sent: Saturday, April 08, 2006 11:38 AM
> > To: Windows File Systems Devs Interest List
> > Subject: Re:[ntfsd] How to know whether a createfile operation is to
> > create
> > a new file or open a existing file?
> >
> > Good answer, small correction.
> >
> > Creating a folder requires the CreateOptions include the
> > FILE_DIRECTORY_FILE flag. Opening a folder does not.
> >
> >
> >
> > “Ken Cross” wrote in message news:xxxxx@ntfsd…
> >> Before the create is performed, you can determine what the caller might
> >> do
> >> by examining the CreateDisposition value: FILE_SUPERSEDE, FILE_CREATE,
> >> FILE_OPEN, FILE_OPEN_IF, FILE_OVERWRITE, or FILE_OVERWRITE_IF
> >>
> >> But you don’t know what really happened until the create operation
> >> completes. You must first check the IoStatusBlock for success in the
> >> Status
> >> value, and then check the Information value for what happened:
> >> FILE_CREATED,
> >> FILE_OPENED, FILE_OVERWRITTEN, FILE_SUPERSEDED, FILE_EXISTS, or
> >> FILE_DOES_NOT_EXIST.
> >>
> >> Creating or opening a folder requires the CreateOptions include the
> >> FILE_DIRECTORY_FILE flag.
> >>
> >> Study ZwCreateFile for details.
> >>
> >> Ken
> >>
> >> ________________________________
> >>
> >> From: xxxxx@lists.osr.com
> >> [mailto:xxxxx@lists.osr.com] On Behalf Of Xiong Weiwei
> >> Sent: Saturday, April 08, 2006 1:29 AM
> >> To: Windows File Systems Devs Interest List
> >> Subject: [ntfsd] How to know whether a createfile operation is to
> create
> >> a
> >> new file or open a existing file?
> >>
> >>
> >> For a createfile operation, how can I know actual operation the user’s
> >> applications want to perform?
> >>
> >> It may be a new file creation, or just to open a non-exist file!
> >>
> >> I also want to know how to differentiate a folder operation from a file
> >> operation.
> >>
> >> Will anybody be patient to answer these questions for me a guy steps
> into
> >> filter driver area for the first time?
> >>
> >> best regards
> >>
> >> — Questions? First check the IFS FAQ at
> >> https://www.osronline.com/article.cfm?id=17 You are currently
> subscribed
> >> to
> >> ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank
> >> email
> >> to xxxxx@lists.osr.com
> >>
> >>
> >
> >
> >
> > —
> > Questions? First check the IFS FAQ at
> > https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: xxxxx@comcast.net
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
You need to start over and tell us what you’re trying to do.
If you can use a mini-filter (*strongly* recommended), many things will
become much simpler.
For instance, the FILE_DIRECTORY_FILE flag can be tested in
“Data->Iopb->Parameters.Create.Options”; the CreateDisposition value is
available in pre-Create at “Data->Iopb->Parameters.Create.Options >> 24”;
the DesiredAccess for the Create operation is at
“Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess”.
The read/write within a mini-filter driver is implemented with FltReadFile
and FltWriteFile (after being opened with FltCreateFile, which is used in
place of IoCreateFileSpecifyDeviceObjectHint).
With respect, your questions need more information and it appears that you
still have a significant learning curve to overcome.
Ken
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Xiong Weiwei
Sent: Saturday, April 08, 2006 12:47 PM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] How to know whether a createfile operation is to create
a new file or open a existing file?
I’m sorry to disturbing your discussion for some other simple questions
(1) how to get the ‘CreateDisposition’ value and FILE_DIRECTORY_FILE flag
in create.options?
(2) How to perform a read or write operation within fliter driver?
One of the techniques I read from the IFS FAQ is to create your
own IRP. However, IFS FAQ also said that
"Building create IRPs within a filter. This technique does work properly,
but is completely unsupported and quite difficult to implement correctly.
Because of this, it is a fragile solution that should not be used given the
availability of alternative mechanisms.
"
Anybody who ever did this kind of task could unpuzzle this to me ?
(3) For the second question above, can IoCreateFileSpecifyDeviceObjectHint
be used to get a file Handle, and then Zw*** api could be used to perform
read or write operation?
3x to all!
On 4/9/06, Lyndon J. Clarke wrote:
Good point. However applications using win32 api dont have the flag
set in
CreateFile &c
“Ken Cross” wrote in message
news:xxxxx@ntfsd…
> Good point. However, if you set the FILE_DIRECTORY_FILE flag, an
attempt
> to
> open a regular file will fail.
>
> Ken
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto: xxxxx@lists.osr.com] On Behalf Of Lyndon J.
Clarke
> Sent: Saturday, April 08, 2006 11:38 AM
> To: Windows File Systems Devs Interest List
> Subject: Re:[ntfsd] How to know whether a createfile operation is
to
> create
> a new file or open a existing file?
>
> Good answer, small correction.
>
> Creating a folder requires the CreateOptions include the
> FILE_DIRECTORY_FILE flag. Opening a folder does not.
>
>
>
> “Ken Cross” wrote in message
news:xxxxx@ntfsd …
>> Before the create is performed, you can determine what the caller
might
>> do
>> by examining the CreateDisposition value: FILE_SUPERSEDE,
FILE_CREATE,
>> FILE_OPEN, FILE_OPEN_IF, FILE_OVERWRITE, or FILE_OVERWRITE_IF
>>
>> But you don’t know what really happened until the create
operation
>> completes. You must first check the IoStatusBlock for success in
the
>> Status
>> value, and then check the Information value for what happened:
>> FILE_CREATED,
>> FILE_OPENED, FILE_OVERWRITTEN, FILE_SUPERSEDED, FILE_EXISTS, or
>> FILE_DOES_NOT_EXIST.
>>
>> Creating or opening a folder requires the CreateOptions include
the
>> FILE_DIRECTORY_FILE flag.
>>
>> Study ZwCreateFile for details.
>>
>> Ken
>>
>> ________________________________
>>
>> From: xxxxx@lists.osr.com
>> [mailto:xxxxx@lists.osr.com] On Behalf Of Xiong
Weiwei
>> Sent: Saturday, April 08, 2006 1:29 AM
>> To: Windows File Systems Devs Interest List
>> Subject: [ntfsd] How to know whether a createfile operation is to
create
>> a
>> new file or open a existing file?
>>
>>
>> For a createfile operation, how can I know actual operation the
user’s
>> applications want to perform?
>>
>> It may be a new file creation, or just to open a non-exist file!
>>
>> I also want to know how to differentiate a folder operation from
a file
>> operation.
>>
>> Will anybody be patient to answer these questions for me a guy
steps into
>> filter driver area for the first time?
>>
>> best regards
>>
>> — Questions? First check the IFS FAQ at
>> https://www.osronline.com/article.cfm?id=17 You are currently
subscribed
>> to
>> ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a
blank
>> email
>> to xxxxx@lists.osr.com
>>
>>
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@comcast.net
> To unsubscribe send a blank email to
xxxxx@lists.osr.com mailto:xxxxx
>
>
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@gmail.com
To unsubscribe send a blank email to
xxxxx@lists.osr.com
— Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17 You are currently subscribed to
ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank email
to xxxxx@lists.osr.com</mailto:xxxxx>
Thank U so much!
I’ve got to know that ‘FILE_DIRECTORY_FILE’ flag and Create dispostion
can be got from the Iostackstation->parameters->create.options as
mini-filter does. However, FILE_DIRECTORY_FILE flag might not be
adequate to determine whether an operation is on a file or a directory,
for example, the caller just did not set this flag because it may not be
sure if this operation is on a directory. I think this promblem also exists
in mini-filter.
I’d like to know how to manage such situation.
Thanks in advance!
On 4/9/06, Ken Cross wrote:
>
> You need to start over and tell us what you’re trying to do.
>
> If you can use a mini-filter (strongly recommended), many things will
> become much simpler.
>
> For instance, the FILE_DIRECTORY_FILE flag can be tested in
> “Data->Iopb->Parameters.Create.Options”; the CreateDisposition value is
> available in pre-Create at “Data->Iopb->Parameters.Create.Options >> 24”;
> the DesiredAccess for the Create operation is at
> “Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess”.
>
> The read/write within a mini-filter driver is implemented with FltReadFile
> and FltWriteFile (after being opened with FltCreateFile, which is used in
> place of IoCreateFileSpecifyDeviceObjectHint).
>
> With respect, your questions need more information and it appears that you
> still have a significant learning curve to overcome.
>
> Ken
>
>
>
>
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Xiong Weiwei
> Sent: Saturday, April 08, 2006 12:47 PM
> To: Windows File Systems Devs Interest List
> Subject: Re: [ntfsd] How to know whether a createfile operation is to
> create
> a new file or open a existing file?
>
>
> I’m sorry to disturbing your discussion for some other simple questions
>
> (1) how to get the ‘CreateDisposition’ value and FILE_DIRECTORY_FILE flag
> in create.options?
>
> (2) How to perform a read or write operation within fliter driver?
> One of the techniques I read from the IFS FAQ is to create your
> own IRP. However, IFS FAQ also said that
>
> "Building create IRPs within a filter. This technique does work properly,
> but is completely unsupported and quite difficult to implement correctly.
> Because of this, it is a fragile solution that should not be used given
> the
> availability of alternative mechanisms.
> "
> Anybody who ever did this kind of task could unpuzzle this to me ?
>
> (3) For the second question above, can IoCreateFileSpecifyDeviceObjectHint
> be used to get a file Handle, and then Zw*** api could be used to perform
> read or write operation?
>
> 3x to all!
>
>
> On 4/9/06, Lyndon J. Clarke wrote:
>
> Good point. However applications using win32 api dont have the flag
> set in
> CreateFile &c
>
> “Ken Cross” wrote in message
> news:xxxxx@ntfsd…
> > Good point. However, if you set the FILE_DIRECTORY_FILE flag, an
> attempt
> > to
> > open a regular file will fail.
> >
> > Ken
> >
> >
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto: xxxxx@lists.osr.com] On Behalf Of Lyndon
> J.
> Clarke
> > Sent: Saturday, April 08, 2006 11:38 AM
> > To: Windows File Systems Devs Interest List
> > Subject: Re:[ntfsd] How to know whether a createfile operation is
> to
> > create
> > a new file or open a existing file?
> >
> > Good answer, small correction.
> >
> > Creating a folder requires the CreateOptions include the
> > FILE_DIRECTORY_FILE flag. Opening a folder does not.
> >
> >
> >
> > “Ken Cross” wrote in message
> news:xxxxx@ntfsd …
> >> Before the create is performed, you can determine what the
> caller
> might
> >> do
> >> by examining the CreateDisposition value: FILE_SUPERSEDE,
> FILE_CREATE,
> >> FILE_OPEN, FILE_OPEN_IF, FILE_OVERWRITE, or FILE_OVERWRITE_IF
> >>
> >> But you don’t know what really happened until the create
> operation
> >> completes. You must first check the IoStatusBlock for success
> in
> the
> >> Status
> >> value, and then check the Information value for what happened:
> >> FILE_CREATED,
> >> FILE_OPENED, FILE_OVERWRITTEN, FILE_SUPERSEDED, FILE_EXISTS, or
> >> FILE_DOES_NOT_EXIST.
> >>
> >> Creating or opening a folder requires the CreateOptions include
> the
> >> FILE_DIRECTORY_FILE flag.
> >>
> >> Study ZwCreateFile for details.
> >>
> >> Ken
> >>
> >>
> >>
> >> From: xxxxx@lists.osr.com
> >> [mailto:xxxxx@lists.osr.com] On Behalf Of Xiong
> Weiwei
> >> Sent: Saturday, April 08, 2006 1:29 AM
> >> To: Windows File Systems Devs Interest List
> >> Subject: [ntfsd] How to know whether a createfile operation is
> to
> create
> >> a
> >> new file or open a existing file?
> >>
> >>
> >> For a createfile operation, how can I know actual operation the
> user’s
> >> applications want to perform?
> >>
> >> It may be a new file creation, or just to open a non-exist file!
> >>
> >> I also want to know how to differentiate a folder operation from
> a file
> >> operation.
> >>
> >> Will anybody be patient to answer these questions for me a guy
> steps into
> >> filter driver area for the first time?
> >>
> >> best regards
> >>
> >> — Questions? First check the IFS FAQ at
> >> https://www.osronline.com/article.cfm?id=17 You are currently
> subscribed
> >> to
> >> ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a
> blank
> >> email
> >> to xxxxx@lists.osr.com
> >>
> >>
> >
> >
> >
> > —
> > Questions? First check the IFS FAQ at
> > https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: xxxxx@comcast.net
> > To unsubscribe send a blank email to
> xxxxx@lists.osr.com mailto:> xxxxx@lists.osr.com>
>
> >
> >
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
>
>
> — Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17 You are currently subscribed
> to
> ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank
> email
> to xxxxx@lists.osr.com
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
></mailto:>
I am sure that your time thinking about the material in the IFS KIT and some
simple experiments would have answered this question. Use FltIsDirectory in
a minifilter or query the filesystem in a legacy filter. This is post
operation. For pre operation you will for practical purposes not know when
CreateDisposition FILE_OPEN.
“Xiong Weiwei” wrote in message news:xxxxx@ntfsd…
Thank U so much!
I’ve got to know that ‘FILE_DIRECTORY_FILE’ flag and Create dispostion
can be got from the Iostackstation->parameters->create.options as
mini-filter does. However, FILE_DIRECTORY_FILE flag might not be
adequate to determine whether an operation is on a file or a directory,
for example, the caller just did not set this flag because it may not be
sure if this operation is on a directory. I think this promblem also exists
in mini-filter.
I’d like to know how to manage such situation.
Thanks in advance!
On 4/9/06, Ken Cross wrote:
You need to start over and tell us what you’re trying to do.
If you can use a mini-filter (strongly recommended), many things will
become much simpler.
For instance, the FILE_DIRECTORY_FILE flag can be tested in
“Data->Iopb->Parameters.Create.Options”; the CreateDisposition value is
available in pre-Create at “Data->Iopb-> Parameters.Create.Options >> 24”;
the DesiredAccess for the Create operation is at
“Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess”.
The read/write within a mini-filter driver is implemented with FltReadFile
and FltWriteFile (after being opened with FltCreateFile, which is used in
place of IoCreateFileSpecifyDeviceObjectHint).
With respect, your questions need more information and it appears that you
still have a significant learning curve to overcome.
Ken
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Xiong Weiwei
Sent: Saturday, April 08, 2006 12:47 PM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] How to know whether a createfile operation is to create
a new file or open a existing file?
I’m sorry to disturbing your discussion for some other simple questions
(1) how to get the ‘CreateDisposition’ value and FILE_DIRECTORY_FILE flag
in create.options?
(2) How to perform a read or write operation within fliter driver?
One of the techniques I read from the IFS FAQ is to create your
own IRP. However, IFS FAQ also said that
“Building create IRPs within a filter. This technique does work properly,
but is completely unsupported and quite difficult to implement correctly.
Because of this, it is a fragile solution that should not be used given the
availability of alternative mechanisms.
”
Anybody who ever did this kind of task could unpuzzle this to me ?
(3) For the second question above, can IoCreateFileSpecifyDeviceObjectHint
be used to get a file Handle, and then Zw*** api could be used to perform
read or write operation?
3x to all!
On 4/9/06, Lyndon J. Clarke wrote:
Good point. However applications using win32 api dont have the flag
set in
CreateFile &c
“Ken Cross” wrote in message
news:xxxxx@ntfsd…
> Good point. However, if you set the FILE_DIRECTORY_FILE flag, an
attempt
> to
> open a regular file will fail.
>
> Ken
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto: xxxxx@lists.osr.com] On Behalf Of Lyndon J.
Clarke
> Sent: Saturday, April 08, 2006 11:38 AM
> To: Windows File Systems Devs Interest List
> Subject: Re:[ntfsd] How to know whether a createfile operation is
to
> create
> a new file or open a existing file?
>
> Good answer, small correction.
>
> Creating a folder requires the CreateOptions include the
> FILE_DIRECTORY_FILE flag. Opening a folder does not.
>
>
>
> “Ken Cross” < xxxxx@comcast.net> wrote in message
news:xxxxx@ntfsd …
>> Before the create is performed, you can determine what the caller
might
>> do
>> by examining the CreateDisposition value: FILE_SUPERSEDE,
FILE_CREATE,
>> FILE_OPEN, FILE_OPEN_IF, FILE_OVERWRITE, or FILE_OVERWRITE_IF
>>
>> But you don’t know what really happened until the create
operation
>> completes. You must first check the IoStatusBlock for success in
the
>> Status
>> value, and then check the Information value for what happened:
>> FILE_CREATED,
>> FILE_OPENED, FILE_OVERWRITTEN, FILE_SUPERSEDED, FILE_EXISTS, or
>> FILE_DOES_NOT_EXIST.
>>
>> Creating or opening a folder requires the CreateOptions include
the
>> FILE_DIRECTORY_FILE flag.
>>
>> Study ZwCreateFile for details.
>>
>> Ken
>>
>>
>>
>> From: xxxxx@lists.osr.com
>> [mailto:xxxxx@lists.osr.com] On Behalf Of Xiong
Weiwei
>> Sent: Saturday, April 08, 2006 1:29 AM
>> To: Windows File Systems Devs Interest List
>> Subject: [ntfsd] How to know whether a createfile operation is to
create
>> a
>> new file or open a existing file?
>>
>>
>> For a createfile operation, how can I know actual operation the
user’s
>> applications want to perform?
>>
>> It may be a new file creation, or just to open a non-exist file!
>>
>> I also want to know how to differentiate a folder operation from
a file
>> operation.
>>
>> Will anybody be patient to answer these questions for me a guy
steps into
>> filter driver area for the first time?
>>
>> best regards
>>
>> — Questions? First check the IFS FAQ at
>> https://www.osronline.com/article.cfm?id=17 You are currently
subscribed
>> to
>> ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a
blank
>> email
>> to xxxxx@lists.osr.com
>>
>>
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@comcast.net
> To unsubscribe send a blank email to
xxxxx@lists.osr.com mailto:xxxxx
>
>
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@gmail.com
To unsubscribe send a blank email to
xxxxx@lists.osr.com
— Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17 You are currently subscribed to
ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank email
to xxxxx@lists.osr.com
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@gmail.com
To unsubscribe send a blank email to xxxxx@lists.osr.com</mailto:xxxxx>