Open/Read/Close Other File on IRP_MJ_CREATE

NTFSD
1

I need to open file other then specified in FILE_OBJECT, read it and close
during processing of IRP_MJ_CREATE in filter object.
Would You be co kind to show me the way how to create IRP with other
FileObject for lower device (I think, that using ZwCreateFile will cause
reentering - the “other” file path is also filtered. Tell, how to create
new FileObject without ZwCreate).

2

> Would You be co kind to show me the way how to create IRP with other

FileObject for lower device (I think, that using ZwCreateFile will cause
reentering - the “other” file path is also filtered. Tell, how to create
new FileObject without ZwCreate).

Call ZwCreateFile from your CREATE handler with some nonsense-looking
(surely invalid as a filename - like “*:?” one. Win32 must never send such
suffixes) suffix appended to the real filename.
In the CREATE filter path, check for this suffix, if it exists - truncate
the filename string from it and pass the IRP down immediately.
Otherwise, do the filtering you want.

This will work for all possible cases IMHO.

Max