Hi there,
Shouldn’t IRP_MJ_CREATE get called not only when a new file is created but
also when an existing file is opened? In a filter driver that I am
developing IRP_MJ_CREATE only gets called whenever there is a new file
created, and I dont know why is it happening like that.
On the other hand, is there any reliable way to get the filename in
IRP_MJ_READ and IRP_MJ_WRITE ? There is no way I have access to the
IrpSp->FileObject, it is always NULL.
Bests,
Sergi
Sergi
For sure IRP_MJ_CREATE is sent to open an existing file. See filespy for how you might be able to get the name in IRP_MJ_READ/WRITE - you have to query the file system and dependent on the “context” of the read/write (irql, paging, apcs disabled, top level irp field) you might not even be able to make that query. In short you should remember the name you found in IRP_MJ_CREATE. Here is another good idea; write a mini-filter since filter manager will take care of these things for you in large part.
Cheers
Lyndon
“Sergi Borras” wrote in message news:xxxxx@ntfsd…
Hi there,
Shouldn’t IRP_MJ_CREATE get called not only when a new file is created but also when an existing file is opened? In a filter driver that I am developing IRP_MJ_CREATE only gets called whenever there is a new file created, and I dont know why is it happening like that.
On the other hand, is there any reliable way to get the filename in IRP_MJ_READ and IRP_MJ_WRITE ? There is no way I have access to the IrpSp->FileObject, it is always NULL.
Bests,
Sergi