How about using the passed FO to read the file?
Regards, Dejan.
Bartjan Wattel wrote:
Hi guys,
I need to open a file when my driver sees an IRP_MJ_SETINFORMATION
(because of a file delete/rename action). Basically, based on the file
contents I want to allow or deny the rename/delete operation. Therefor I
need to read the file contents first before I pass down the irp.The problem is, that when I open the file (using IoCreateFile, using my
shadow device object), IoCreateFile returns status C0000043 (meaning
sharing violation). I find this strange, because in IRP_MJ_CREATE the file
is openend with sharing mode 0x7, which means that another thread can open
the file for reading/writing/deleting.What causes this sharing violation ? Is there any way to open/read the
file in the IRP_MJ_SETINFORMATION path ?
–
Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32
developers.