Hartmut Birr wrote:
Hi,
if I open a file in kernel mode on XP with:
RtlInitUnicodeString(&FileName, L"\??\c:\freeldr.ini"); InitializeObjectAttributes(&ObjectAttributes, &FileName, OBJ_CASE_INSENSITIVE, NULL, NULL);
Status = ZwOpenFile(&FileHandle, GENERIC_READ, &ObjectAttributes, &IoStatusBlock, 0, 0 /* FILE_SYNCHRONOUS_IO_NONALERT*/);
Status = ObReferenceObjectByHandle(FileHandle, GENERIC_READ, IoFileObjectType, KernelMode, (PVOID)&FileObject, NULL);
I see FileObje->Flags is FO_HANDLE_CREATED|FO_CACHE_SUPPORTED. Than I create a stream file object from FileObject->DeviceObect:
StreamFileObject = IoCreateStreamFileObject(NULL,FileObject->DeviceObject);
I see StreamFileObject->Flags is FO_HANDLE_CREATED|FO_STREAM_FILE.
- Hartmut
Hi,
Yes that's correct. Our code set FO_DIRECT_DEVICE_OPEN, which is wrong, as you've proved. I changed it to set FO_STREAM_FILE and FO_HANDLE_CREATED. This made a bunch of code fail, because IoCreateFile calls it (it sholdn't). So I reverted the changes until I can fix IoCreateFile/IopCreateFile/IopParseFile to behave properly.
Best regards, Alex Ionescu