关于“IRP_MJ_CREATE ” 的Dispatch中判断FileObject是文件还是目录问题
2011-09-15 22:42
423 查看
当Ring3 CreateFile发起对某个文件对象的请求时,如:C:/Program Files/Microsoft Visual Studio/VC98/LIB/LIBC.lib"。请求进入Ring0,Fs会把该请求生成多个IRP_MJ_CREATE,逐层的打开目录对象,直至到目标文件LIBC.lib,所以在
IRP_MJ_CREATE的Dispatch中的IrpSp->Parameters.Create.Options & FILE_DIRECTORY_FILE可以判断到达目标文件对象前的那些请求,肯定就是目录。
注意:但在IRP_MJ_CREATE的Dispatch中无法使用IrpSp->Parameters.Create.Options & FILE_DIRECTORY_FILE来判断目标文件对象(LIBC.lib)是文件还是目录,得将IRP传递到底层后,在完成例程中判断目标文件对象是文件还是目录。而上述是因为目标文件前的一定是目录,所以可以判断。
待续~
参考:
Osr
Q58
How do I determine if the FILE_OBJECT represents a file or a directory from my filter driver? Can I rely upon the FILE_DIRECTORY_FILE bit?
http://www.osronline.com/article.cfm?article=17#Q58
The determination of whether or not a given FILE_OBJECT represents a directory is the sole domain of the file system driver. Thus, for a file system filter driver to determine if a file is a directory, it must ask the file system. This can be done by querying
the attributes of the file (e.g., after it has been successfully opened by the underlying file system) or by examining the attributes within the directory, which can be done before the underlying file has been opened.
Options specified during create are not adequate for determining if a file is, in fact, a directory. For example, an application may optionally specify that the file being opened must be a directory by setting the FILE_DIRECTORY_FILE option as part of create
(this is a bit in the I/O Stack location, Parameters.Create.Options, the low 24 bits of which are used for file options). If the file creation is successful, the file system filter driver can conclude that the FILE_OBJECT does represent a directory. If the
file creation is successful and the caller did not specify FILE_DIRECTORY_FILE, however, the caller cannot presume that the file is a directory. The FILE_NON_DIRECTORY_FILE bit can similarly be used to determine that the given FILE_OBJECT does not represent
a file.
There is one complication for those writing a file system filter driver - they must keep in mind that some file options now combine these two bits. For example FILE_COPY_STRUCTURED_STORAGE (which is not used but is still present in ntifs.h for Windows XP) is
defined as FILE_DIRECTORY_FILE and FILE_NON_DIRECTORY_FILE.
Thus, the safest way to determine if a FILE_OBJECT represents a directory remains to ask the underlying file system.
IRP_MJ_CREATE的Dispatch中的IrpSp->Parameters.Create.Options & FILE_DIRECTORY_FILE可以判断到达目标文件对象前的那些请求,肯定就是目录。
注意:但在IRP_MJ_CREATE的Dispatch中无法使用IrpSp->Parameters.Create.Options & FILE_DIRECTORY_FILE来判断目标文件对象(LIBC.lib)是文件还是目录,得将IRP传递到底层后,在完成例程中判断目标文件对象是文件还是目录。而上述是因为目标文件前的一定是目录,所以可以判断。
待续~
参考:
Osr
Q58
How do I determine if the FILE_OBJECT represents a file or a directory from my filter driver? Can I rely upon the FILE_DIRECTORY_FILE bit?
http://www.osronline.com/article.cfm?article=17#Q58
The determination of whether or not a given FILE_OBJECT represents a directory is the sole domain of the file system driver. Thus, for a file system filter driver to determine if a file is a directory, it must ask the file system. This can be done by querying
the attributes of the file (e.g., after it has been successfully opened by the underlying file system) or by examining the attributes within the directory, which can be done before the underlying file has been opened.
Options specified during create are not adequate for determining if a file is, in fact, a directory. For example, an application may optionally specify that the file being opened must be a directory by setting the FILE_DIRECTORY_FILE option as part of create
(this is a bit in the I/O Stack location, Parameters.Create.Options, the low 24 bits of which are used for file options). If the file creation is successful, the file system filter driver can conclude that the FILE_OBJECT does represent a directory. If the
file creation is successful and the caller did not specify FILE_DIRECTORY_FILE, however, the caller cannot presume that the file is a directory. The FILE_NON_DIRECTORY_FILE bit can similarly be used to determine that the given FILE_OBJECT does not represent
a file.
There is one complication for those writing a file system filter driver - they must keep in mind that some file options now combine these two bits. For example FILE_COPY_STRUCTURED_STORAGE (which is not used but is still present in ntifs.h for Windows XP) is
defined as FILE_DIRECTORY_FILE and FILE_NON_DIRECTORY_FILE.
Thus, the safest way to determine if a FILE_OBJECT represents a directory remains to ask the underlying file system.
相关文章推荐
- ios6.1&ios7&ios9判断沙盒文件或者目录是否存在,以及判断是文件还是目录的一个隐藏问题
- iOS6.1 & iOS 7 & iOS8 判断沙盒文件或者目录是否存在,以及判断是文件还是目录的一个隐藏问题
- 文件过滤驱动中 IRP_MJ_XX_INFORMATION 查询文件对象是文件还是目录的方法
- 关于C++中如何判断文件,目录存在的若干方法
- Linux 判断是否是一个目录还是一个文件的方法
- 文件重定向(hook IRP_MJ_CREATE)
- 根据给定文件路径,判断该路径为目录还是文件
- 关于os的一系列问题:寻找目录中的视频文件,并存储路径
- Unix学习笔记-------目录遍历实例----Linux下判断是否是一个目录还是一个文件的方法
- node.js中关于使用formidable模块实现文件上传至指定目录的问题
- 关于就win32应用程序在64位机器上读取system目录下文件失败的问题的解决方案
- Linux/Unix 判断一个路径是目录还是文件
- Linux系统关于ACM时间的使用和文件目录的权限的问题
- 关于C++中如何判断文件、目录存在的若干方法
- php关于url、文件、目录、ip的相关问题汇总
- Linux 判断是否是一个目录还是一个文件的方法
- 关于“ISIS_PJPlan_Doc.dll必需和计划书文件在同一目录下才能检查保护”的问题
- 不幸的问题还是出现了:Chromium代码上整理patch(working目录/master分支),部分文件做了git checkout恢复,结果GYP再编译就出错了
- 嵌入式 Linux下判断是否是一个目录还是一个文件的方法
- 关于C++中如何判断文件,目录存在的若干方法