Bin Zeng wrote:
And what’s different for “rename” and “delete” a file in IRP_MJ_CREATE ?
I need to detect the file delete in IRP_MJ_CREATE, not in
IRP_MJ_SETINFORMATION .Is it possible to do that?
No. There won’t be any difference. Something that’s going to delete
will request delete access, but so will any userspace app that uses
GENERIC_WRITE… it’s not a reliable indicator.
You are going to have to wait for the setinformation call and act then.
Tony