ZwCreateFile from a IRP_MJ_CREATE hook

NTFSD
1

Hi,

I want to create a IRP_MJ_CREATE filter driver and in the hook rotine I
would like to perform a pre-create action (create,read,close). I need to
call ZwCreateFile from my routine (or to build a new IRP_MJ_CREATE) and to
mark the fact that the IRP is received due to my ZwCreateFile (a flag or a
buffer).When I check that flag I will be able to skip the pre-create
processing.

I tried to use create option flags in ZwCreateFile that kernel did not
recognize, but it seems that it did not worked.

Regards,
Adi

2

Adi,

See the FAQ http://www.osr.com/resources_ifsfaq.shtml.

Specifically:
Q34 Opening files during IRP_MJ_CREATE processing

Randy

— AC wrote:
> Hi,
>
> I want to create a IRP_MJ_CREATE filter driver and
> in the hook rotine I
> would like to perform a pre-create action
> (create,read,close). I need to
> call ZwCreateFile from my routine (or to build a new
> IRP_MJ_CREATE) and to
> mark the fact that the IRP is received due to my
> ZwCreateFile (a flag or a
> buffer).When I check that flag I will be able to
> skip the pre-create
> processing.
>
> I tried to use create option flags in ZwCreateFile
> that kernel did not
> recognize, but it seems that it did not worked.
>
>
> Regards,
> Adi
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
xxxxx@lists.osr.com

__________________________________________________
Do you Yahoo!?
Yahoo! Platinum - Watch CBS’ NCAA March Madness, live on your desktop!
http://platinum.yahoo.com