In my IFS filter driver, I’m creating a new directory in IRP_MJ_CREATE,
if the driver was manually loaded, the ZwCreateFile() for new directory
returns SUCCESS and
iostatus.information = FILE_CREATED. I saw the new directory there and
everything works.
when the driver was boot loaded, the ZwCreateFile() for new direcotry
returns SUCCESS and
the iostatus.information == FILE_OPENED (wrong??), but the new directory can
not be seen.
The process contexts are both Explorer.exe.
Here is the codes:
…
InitializeObjectAttributes( &object_attributes, &newdirname,
OBJ_CASE_INSENSITIVE, NULL, NULL );
status = ZwCreateFile( &hndlnewdir, FILE_LIST_DIRECTORY | SYNCHRONIZE,
&object_attributes,
&iostatus, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ |
FILE_SHARE_WRITE, FILE_CREATE,
FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT |
FILE_OPEN_FOR_BACKUP_INTENT, NULL, 0L );
if( status != STATUS_OBJECT_NAME_COLLISION && !NT_SUCCESS( status ) )
{
return FALSE;
}
if( hndlnewdir )status = ZwClose( hndlnewdir );
…
Anyone can help on this? Thanks in advance.