Opening a file prior to IRP_MJ_WRITE...

NTFSD
1

In my driver I am intercepting IRP_MJ_WRITEs. I would like to be able to
make a backup copy of the file before allowing the IRP_MJ_WRITE to go
through. But, when I use ZwCreateFile(…) I get share access violations.
Is there a good way to open the file in order to copy it before the write?
Or, more simply, is there ANY way, and if so, how?

thanks! - jb

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

> In my driver I am intercepting IRP_MJ_WRITEs. I would like to be able to

make a backup copy of the file before allowing the IRP_MJ_WRITE to go
through. But, when I use ZwCreateFile(…) I get share access violations.

Why do you use ZwCreateFile? Just operate on the same file object which
received the write.

Max

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com