No need to go that far. If you run the create through, you can roll your own MJ_READ IRP to read the front of the file. Don’t forget to seek back to the front afterwards.
Andy
---- you wrote:
I need read file contens on IRP_MJ_CREATE. Is this pseudocode correct?
retrieve file name from IRP
if(FILE_COMPLETE_IF_OPLOCKED is not set){
ZwCreateFile
ZwReadFile
ZwClose
} else {
// file is on local disk
queue work item and wait for it
}work item:
ZwCreateFile
ZwReadFile
ZwClose
Is this correct?
Is a qood idea using work item? Or is better launch my owm
thread?Petr Balas (petr at petrbalas dot cz)
You are currently subscribed to ntfsd as: xxxxx@earthling.net
To unsubscribe send a blank email to $subst(‘Email.Unsub’)
Get your free email from AltaVista at http://altavista.iname.com