how to obtain requestor's intended operation

Hi all,

When intercept a file open request, if I look at the file object fields got
through SoftIce, the following seems always FALSE.

ReadAccess, WriteAccess, DeleteAccess, SharedRead,

I open the file with GENERAL_READ through CreateFile win32 API.

Am I looking the wrong place to detect the intended user operation mode ?


Jack Cheng
(Curriculum Corp.)