I need to read open files. I don’t need to worry about file data
consistency (it’s a long story). I have switched to using a mini-filter so
I can do this using FltCreateFile with the IO_IGNORE_SHARE_ACCESS_CHECK
flag.
I think it is working with respect to ignoring the share flags, but I am
still getting a STATUS_FILE_LOCK_CONFLICT status returned from my
FltReadFile call. How do I read from a locked file?
Here is my code. This works fine on non-locked files:
status = FltCreateFile( gFilter, Instance, &ReadHandle, GENERIC_READ, &attr,
&ioStatus, 0, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ | FILE_SHARE_WRITE |
FILE_SHARE_DELETE, FILE_OPEN, FILE_NON_DIRECTORY_FILE |
FILE_SYNCHRONOUS_IO_NONALERT | FILE_SEQUENTIAL_ONLY, NULL, 0,
IO_IGNORE_SHARE_ACCESS_CHECK );
status = ObReferenceObjectByHandle( ReadHandle, 0, NULL, KernelMode,
&ReadFileObj, NULL);
status = FltReadFile( Instance, ReadFileObj, NULL, dataBufLen, data, 0,
&bytesRead, NULL, NULL );