如何判断打开的文件方式？（只读？读写？）

可以从IRP里看出吗？

你是指文件的打开方式而不是设备吧。
对于文件，你可查看IRP_MJ_CREATE
IrpSp=IoGetCurrentIrpStackLocation(Irp);
IrpSp->Parameters.Create.SecurityContext->DesiredAccess
这是个 ACCESS_MASK 结构，表明了对此文件的权限。
此结构详细内容如下：

DELETE The file can be deleted.
FILE_READ_DATA Data can be read from the file.
FILE_READ_ATTRIBUTES FileAttributes flags, described later, can be read.
FILE_READ_EA Extended attributes associated with the file can be read. This flag is irrelevant to device and intermediate drivers.
READ_CONTROL The access control list (ACL) and ownership information associated with the file can be read.
FILE_WRITE_DATA  Data can be written to the file.
FILE_WRITE_ATTRIBUTES FileAttributes flags can be written.
FILE_WRITE_EA Extended attributes (EAs) associated with the file can be written. This flag is irrelevant to device and intermediate drivers.
FILE_APPEND_DATA Data can be appended to the file.
WRITE_DAC  The discretionary access control list (DACL) associated with the file can be written.
WRITE_OWNER  Ownership information associated with the file can be written.
SYNCHRONIZE The returned FileHandle can be waited on to synchronize with the completion of an I/O operation.
FILE_EXECUTE Data can be read into memory from the file using system paging I/O. This flag is irrelevant to device and intermediate drivers.