Not exactly so. You must understand that when you specify FileObject
parameter other then NULL nothing very special happens. No reopen, no file
object fields copying, no nothing. Difference is only in that I/O Manager
will copy DeviceObject parameter from FileObject->DeviceObject. Something
like this:
if (ARGUMENT_PRESENT(FileObject))
{
DeviceObject = FileObject->DeviceObject;
}
So, this completely corresponds to the docs saying that if you specify a
non-NULL value for FileObject, the value of DeviceObject is ignored.
Otherwise, you must specify a non-NULL value for DeviceObject.
As to IRP_MJ_CLENUP, things are simple here. I/O Manager first creates a
file object with ObCreateObject routine. After that it calls ObInsertObject
routine, which returns a HANDLE to the object. As soon as
IoCreateStreamFileObject does not return handle, it is closed immediately.
ObCloseHandle routine works such a way that when handle count drops to zero
an IRP_MJ_CLEANUP IRP is sent to the highest level device object. But you
might already know this, right?
-htfv
“Lyndon J. Clarke” wrote in message
news:xxxxx@ntfsd…
>
> Thanks Tony. I think I understand this now! Would I be right if I guessed
> that this was a case where IoCreateStreamFileObject had been called with
> the FileObject parameter value NULL?
>
>