IRP_MJ_CREATE for file reading and file info

NTFSD
1

Hi,All

When a file opens in IRP_MJ_CREATE, can i know that it is opened for
reading the file content, or for getting the file information ( like file
size, date…)? Is it any different?

Thanks

Bin

2

RTFM ZwCreateFile IRP_MJ_CREATE DesiredAccess

“Bin Zeng” wrote in message news:xxxxx@ntfsd…
> Hi,All
>
> When a file opens in IRP_MJ_CREATE, can i know that it is opened for
> reading the file content, or for getting the file information ( like file
> size, date…)? Is it any different?
>
>
> Thanks
>
> Bin
>
>
>
>

3

Lyndon J. Clarke wrote:

RTFM ZwCreateFile IRP_MJ_CREATE DesiredAccess

Note that you can’t know for certain that that is what is going to
happen… in fact it’s very common to do things like get the file size
then read it. The access mask can only tell you what is *not* going to
happen (by the absence of a requested permission).

Tony

4

Indeed; and then there are those terrible people who open SYNCHRONIZE and
send hand rolled IRP_MJ_READ for example :slight_smile: I assume if OP does RTFM then
limitations are apparent …

“Tony Hoyle” wrote in message news:xxxxx@ntfsd…
> Lyndon J. Clarke wrote:
>> RTFM ZwCreateFile IRP_MJ_CREATE DesiredAccess
>>
> Note that you can’t know for certain that that is what is going to
> happen… in fact it’s very common to do things like get the file size then
> read it. The access mask can only tell you what is not going to happen
> (by the absence of a requested permission).
>
> Tony
>
>