IRP_MY_CREATE parsing dwDesiredAccess of CreateFile

NTDEV
1

Hi!

I’m developing a filter driver and would like to know where in the IRP
packet I can find how the CreateFile from user mode is called.

I would like to differ from CreateFile(GENERIC_READ) and
CreateFile(GENERIC_WRITE)

2

If you haven’t found it already…

For a legacy filter driver:

ACCESS_MASK DesiredAccess =
IrpSp->Paramters.Create.SecurityContext->DesiredAccess;

For a mini-filter driver:

ACCESS_MASK DesiredAccess =
Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess;

You can then test DesiredAccess for FILE_READ_DATA, FILE_WRITE_DATA, DELETE,
etc.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Martin Bergant
Sent: Monday, October 23, 2006 7:44 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] IRP_MY_CREATE parsing dwDesiredAccess of CreateFile

Hi!

I’m developing a filter driver and would like to know where in the IRP
packet I can find how the CreateFile from user mode is called.

I would like to differ from CreateFile(GENERIC_READ) and
CreateFile(GENERIC_WRITE)

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

->Parameters.Create.SecurityContext, the DesiredAccess field is somewhere
there.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Martin Bergant”
To: “Windows System Software Devs Interest List”
Sent: Monday, October 23, 2006 3:43 PM
Subject: [ntdev] IRP_MY_CREATE parsing dwDesiredAccess of CreateFile

Hi!

I’m developing a filter driver and would like to know where in the IRP
packet I can find how the CreateFile from user mode is called.

I would like to differ from CreateFile(GENERIC_READ) and
CreateFile(GENERIC_WRITE)

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer