Hartmut Birr wrote:
Hi,
if I open a file in kernel mode on XP with:
RtlInitUnicodeString(&FileName, L"\\??\\c:\\freeldr.ini");
InitializeObjectAttributes(&ObjectAttributes,
&FileName,
OBJ_CASE_INSENSITIVE,
NULL,
NULL);
Status = ZwOpenFile(&FileHandle,
GENERIC_READ,
&ObjectAttributes,
&IoStatusBlock,
0,
0 /* FILE_SYNCHRONOUS_IO_NONALERT*/);
Status = ObReferenceObjectByHandle(FileHandle,
GENERIC_READ,
IoFileObjectType,
KernelMode,
(PVOID)&FileObject,
NULL);
I see FileObje->Flags is FO_HANDLE_CREATED|FO_CACHE_SUPPORTED. Than I
create a stream file object from FileObject->DeviceObect:
StreamFileObject = IoCreateStreamFileObject(NULL,
FileObject->DeviceObject);
I see StreamFileObject->Flags is FO_HANDLE_CREATED|FO_STREAM_FILE.
- Hartmut
Hi,
Yes that's correct. Our code set FO_DIRECT_DEVICE_OPEN, which is wrong,
as you've proved.
I changed it to set FO_STREAM_FILE and FO_HANDLE_CREATED. This made a
bunch of code fail, because IoCreateFile calls it (it sholdn't).
So I reverted the changes until I can fix
IoCreateFile/IopCreateFile/IopParseFile to behave properly.
Best regards,
Alex Ionescu