In a minifilter IRP_MJ_CREATE :
“The I/O Manager sends the IRP_MJ_CREATE request when a new file or
directory is being created, or when an existing file, device, directory, or
volume is being opened.”
- Now if this is a new file being created I FltSetInformationFile() before
I FltCancelFileOpen() to stop the file from being created.
2)i f it is opening a file that exists I would FltCancelFileOpen() and set
Data->IoStatus.Status = STATUS_ACCESS_DENIED; Data->IoStatus.Information =
0; to stop access to the file.
If I do #1 only then when a file is opened and denied it will delete the
file. ( Very bad mojo )
If I do #2 only it will not stop new files from being created properly.
Problem is telling the difference of open vs create.
FltObjects->FileObject->(X)Access will tell me how the file was opened but I
cannot find any reference for a way to tell if the file was created or
opened?
Any enlightenment would be golden.
Jason
>Problem is telling the difference of open vs create.
FltObjects->FileObject->(X)Access will tell me how the file was opened but
I
cannot find any reference for a way to tell if the file was created or
opened?
Try the Information field in the iosb. From the doc for FltCreateFileEx:
On return from FltCreateFileEx, the Information member contains one of the
following values.
FILE_CREATED
FILE_OPENED
FILE_OVERWRITTEN
FILE_SUPERSEDED
FILE_EXISTS
FILE_DOES_NOT_EXIST
/rod Widdowson
www.steadingsoftware.com
I am not sure what an isob from FltCreateFileEx will do me in this case? I
am a minifilter in a PostCreate(IRP_MJ_CREATE) function and it seems like
creating a file just to see what its create status is to see if it exists is
more overhead then needed in a PostCreate. Not sure if you misunderstood my
questions or I am not experienced enough to understand you answer 
I have also tried reading Data->IoStatus.Status and it appears to not hold
any relevant information for the task at hand. Always returns
FILE_SUPERSEEDED if I create a file, write or delete it.
Jason
On 11/15/05, Rod Widdowson wrote:
>
> >Problem is telling the difference of open vs create.
> >FltObjects->FileObject->(X)Access will tell me how the file was opened
> but
> >I
> >cannot find any reference for a way to tell if the file was created or
> >opened?
>
> Try the Information field in the iosb. From the doc for FltCreateFileEx:
>
> >On return from FltCreateFileEx, the Information member contains one of
> the
> >following values.
> >FILE_CREATED
> >FILE_OPENED
> >FILE_OVERWRITTEN
> >FILE_SUPERSEDED
> >FILE_EXISTS
> >FILE_DOES_NOT_EXIST
>
> /rod Widdowson
>
> www.steadingsoftware.com http:
>
>
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
></http:>
> I am not sure what an isob from FltCreateFileEx will do me in this case?
The iosb (should) contains the same information regardless of who did the
create. I just pulled the ino from flt documentation becasue its close to
hand.
I have also tried reading Data->IoStatus.Status
Which is where you should look (in post create of course)…
and it appears to not hold
any relevant information for the task at hand. Always returns
FILE_SUPERSEEDED
Which of course is zero. So it appears that something isn’t following the
rules. Most strange - it has always worked for me…
/rod
Jason
Just a long shot …
If you are looking at IoStatus.Status then here you expect to see the
completion status something like STATUS_SUCCESS for example
STATUS_SUCCESS is zero
If you want to the see the completion information have a look at
IoStatus.Information something like FILE_SUPERSEDED for example
FILE_SUPERSEDED is zero
Cheers
Lyndon
“Jason T” wrote in message news:xxxxx@ntfsd…
I am not sure what an isob from FltCreateFileEx will do me in this case? I
am a minifilter in a PostCreate(IRP_MJ_CREATE) function and it seems like
creating a file just to see what its create status is to see if it exists is
more overhead then needed in a PostCreate. Not sure if you misunderstood my
questions or I am not experienced enough to understand you answer
I have also tried reading Data->IoStatus.Status and it appears to not hold
any relevant information for the task at hand. Always returns
FILE_SUPERSEEDED if I create a file, write or delete it.
Jason
On 11/15/05, Rod Widdowson wrote:
>Problem is telling the difference of open vs create.
>FltObjects->FileObject->(X)Access will tell me how the file was opened but
>I
>cannot find any reference for a way to tell if the file was created or
>opened?
Try the Information field in the iosb. From the doc for FltCreateFileEx:
>On return from FltCreateFileEx, the Information member contains one of the
>following values.
>FILE_CREATED
>FILE_OPENED
>FILE_OVERWRITTEN
>FILE_SUPERSEDED
>FILE_EXISTS
>FILE_DOES_NOT_EXIST
/rod Widdowson
www.steadingsoftware.com
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@gmail.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
Yes it the information I was looking for in return was in
IoStatus.Information. I am still new to this and try my best to figure it
out before I burden the list with questions, but sometimes I miss the forest
for the trees.
If I only had a brain I might be dangerous.
Thank you again for the insight.
On 11/16/05, Lyndon J Clarke wrote:
>
> Jason
>
> Just a long shot …
>
> If you are looking at IoStatus.Status then here you expect to see the
> completion status something like STATUS_SUCCESS for example
> STATUS_SUCCESS is zero
>
> If you want to the see the completion information have a look at
> IoStatus.Information something like FILE_SUPERSEDED for example
> FILE_SUPERSEDED is zero
>
> Cheers
> Lyndon
> “Jason T” wrote in message news:xxxxx@ntfsd…
> I am not sure what an isob from FltCreateFileEx will do me in this case? I
> am a minifilter in a PostCreate(IRP_MJ_CREATE) function and it seems like
> creating a file just to see what its create status is to see if it exists
> is
> more overhead then needed in a PostCreate. Not sure if you misunderstood
> my
> questions or I am not experienced enough to understand you answer
>
> I have also tried reading Data->IoStatus.Status and it appears to not hold
> any relevant information for the task at hand. Always returns
> FILE_SUPERSEEDED if I create a file, write or delete it.
>
> Jason
>
>
> On 11/15/05, Rod Widdowson wrote:
> >Problem is telling the difference of open vs create.
> >FltObjects->FileObject->(X)Access will tell me how the file was opened
> but
> >I
> >cannot find any reference for a way to tell if the file was created or
> >opened?
>
> Try the Information field in the iosb. From the doc for FltCreateFileEx:
>
> >On return from FltCreateFileEx, the Information member contains one of
> the
> >following values.
> >FILE_CREATED
> >FILE_OPENED
> >FILE_OVERWRITTEN
> >FILE_SUPERSEDED
> >FILE_EXISTS
> >FILE_DOES_NOT_EXIST
>
> /rod Widdowson
>
> www.steadingsoftware.com http:
>
>
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
></http:>