IRP_MJ_CREATE information

NTFSD
1

Hi All,

Is this possible we provide some information to our IRP_MJ_CREATE routine?
Since normally we have NULL in our FsContext and FsContext2.

The case is,
after the IRP_MJ_DIRECTORY_CONTROL is called, it lists all the files/dirs in parent.

Then IRP_MJ_CREATE is called for each of those items.
Can I set some information in IRP_MJ_CREATE for them somehow?

Regards:-
Adnan

2

Check out using the ECP parameter if you are calling FltCreateFileEx2,
or IoCreateFileEx(), in the dir enum processing. In the DriverContext
parameter you can specify an ECP which can then be retrieved in your
create handler.

The above assumes, of course, that it is your filter which is initiating
the opens within the directory enumeration. If you are asking about the
opens which an application, such as Explorer, sends after doing a
directory enumeration then other than heuristics there is no way.

Pete

On 8/14/2012 4:18 PM, xxxxx@gmail.com wrote:

Hi All,

Is this possible we provide some information to our IRP_MJ_CREATE routine?
Since normally we have NULL in our FsContext and FsContext2.

The case is,
after the IRP_MJ_DIRECTORY_CONTROL is called, it lists all the files/dirs in parent.

Then IRP_MJ_CREATE is called for each of those items.
Can I set some information in IRP_MJ_CREATE for them somehow?

Regards:-
Adnan

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

3

No this is not a filter driver, and it is a file system driver.

I am not calling any of the FltCreateFileEx2() or IoCreateFileEx() in my dir enum process.