Re[2]: query file attributes to determine if a directory handle was returned?

NTFSD
1

Hello Mani,

i don’t think so, i belive you don’t have a file handle at that
time, do you ?

are you writing a minifilter ?

–
Best regards,
Alex mailto:xxxxx@bitdefender.com

Tuesday, September 6, 2005, 10:01:29 AM, you wrote:

Ladislav,

Will it be ok to call ZwQueryInformationFile in pre create?

Thanks.

“Ladislav Zezula” wrote in message news:xxxxx@ntfsd…
>> > legacy filter, i think you can call ZwQueryInformationFile and request
>> > FileStandardInformation.
>>
>> Don’t call any Zw functions in post create, better build an IRP
>> (or reuse the existing one) and call the lower driver.
>>
>> L.

> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17

> You are currently subscribed to ntfsd as: xxxxx@bitdefender.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

–
This message was scanned for spam and viruses by BitDefender.
For more information please visit http://www.bitdefender.com/

2

No, from two reasons

  1. If the file has not been created/opened, you don’t even know if it
    exists.
    In fact, some file systems are not prepared to receive an unopened file
    object ino IRP_MJ_QUERY_INFORMATION
    (with FileObject->FsContext seto to NULL) and will just crash.

  2. Calling any Zw function working with file unside the IRP handler
    is risky, you always can deadlock the system, if e.g. a driver above
    you uses some locking.

L.

3

Will this be fine:

PreCreate()
{
if(IrpStack->Parameters.Create.Options & FILE_DIRECTORY_FILE)
{
//is a directory
}
else
{
//if we are here, then we are sure that we are in a non-create (open)
path
//so we can be sure that the dir exists

IsDir = RollMyOwnQueryInformation();
}
}

“Ladislav Zezula” wrote in message news:xxxxx@ntfsd…
> No, from two reasons
>
> 1) If the file has not been created/opened, you don’t even know if it
> exists.
> In fact, some file systems are not prepared to receive an unopened
file
> object ino IRP_MJ_QUERY_INFORMATION
> (with FileObject->FsContext seto to NULL) and will just crash.
>
> 2) Calling any Zw function working with file unside the IRP handler
> is risky, you always can deadlock the system, if e.g. a driver above
> you uses some locking.
>
> L.