ifskit 的问题:我只想得到文件的创建信息.

ifskit 的问题:我只想得到文件的创建信息.(大侠一定要帮忙)

但是由于创建和打开文件都是得到IFSFN_OPEN,我无法区分到底是
打开还是新建.

大侠帮忙.

IOREQ->ir_options:

Value Meaning
ACTION_CREATENEW Create a new file. Fail if the file already exists.
ACTION_CREATEALWAYS Create a new file. If the file already exists open it and set its new length and attributes.
ACTION_OPENEXISTING Open an existing file. Fail if the file does not exist.
ACTION_OPENALWAYS Open an existing file. If the file does not exist, create a new file.
ACTION_REPLACEEXISTING Open an existing file and set its new length. Fail if the file does not exists.

IOREQ->ir_options:

Value Meaning
ACTION_CREATENEW Create a new file. Fail if the file already exists.
ACTION_CREATEALWAYS Create a new file. If the file already exists open it and set its new length and attributes.
ACTION_OPENEXISTING Open an existing file. Fail if the file does not exist.
ACTION_OPENALWAYS Open an existing file. If the file does not exist, create a new file.
ACTION_REPLACEEXISTING Open an existing file and set its new length. Fail if the file does not exists.
 

你是在哪时判断这些信息的？

9x?

in create phase, check pioreq->ir_options.
the best is also check return value.

then remember it. when in read,you can peek data you hold in create phase.

在DDK上面有啊！估计是没有好好看DDK的帮助了！
IRP_MJ_CREATE
When Sent
The I/O Manager sends this request when a file, device, directory, or volume is being opened or created. Normally this IRP is sent on behalf of a user-mode application that has called a Microsoft Win32? function such as CreateFile or a kernel-mode component that has called IoCreateFile, ZwCreateFile, or ZwOpenFile. If the create request is completed successfully, the application or kernel-mode component receives a handle to the file object.

Operation: File System Drivers
If the target device object is the file system\'s control device object, the file system driver\'s dispatch routine must complete the IRP and return an appropriate NTSTATUS value, after setting Irp->IoStatus.Status and Irp->IoStatus.Information to appropriate values.

Otherwise, the file system driver should process the create request.

Operation: File System Filter Drivers
If the target device object is the filter driver\'s control device object, the filter driver\'s dispatch routine must complete the IRP and return an appropriate NTSTATUS value, after setting Irp->IoStatus.Status and Irp->IoStatus.Information to appropriate values.

Otherwise, the filter driver should perform any needed processing and, depending on the nature of the filter, either complete the IRP or pass it down to the next lower driver on the stack.

Generally, filter drivers should not return STATUS_PENDING in response to IRP_MJ_CREATE. However, if a lower-level driver returns STATUS_PENDING, the filter driver should pass this status value up the driver chain.

Parameters
A file system or filter driver calls IoGetCurrentIrpStackLocation with the given IRP to get a pointer to its own stack location in the IRP, shown in the following list as IrpSp. (The IRP is shown as Irp.) The driver can use the information set in the following members of the IRP and the IRP stack location in processing a create request:

DeviceObject
Pointer to the target device object.
Irp->AssociatedIrp.SystemBuffer
Pointer to a FILE_FULL_EA_INFORMATION-structured buffer, if the file object represents a file with extended attributes. Otherwise NULL.
Irp->IoStatus
Pointer to an IO_STATUS_BLOCK structure that receives the final completion status and information about the requested operation. See the description of the IoStatusBlock parameter to ZwCreateFile for more information.
IrpSp->FileObject
Pointer to a file object that the I/O Manager creates to represent the file to be created or opened. The file system sets the FsContext and possibly FsContext2 fields(s) in this file object to values that are file system-specific.
IrpSp->Flags
One or more of the following:
SL_CASE_SENSITIVE
SL_FORCE_ACCESS_CHECK (IO_FORCE_ACCESS_CHECK)
SL_OPEN_PAGING_FILE (IO_OPEN_PAGING_FILE)
SL_OPEN_TARGET_DIRECTORY (IO_OPEN_TARGET_DIRECTORY)

See the description of the Options parameter to IoCreateFile for more information.

IrpSp->MajorFunction
Specifies IRP_MJ_CREATE.
IrpSp->Parameters.Create.EaLength
Size in bytes of the buffer at Irp->AssociatedIrp.SystemBuffer. If the value of Irp->AssociatedIrp.SystemBuffer is NULL, this member must be zero.
IrpSp->Parameters.Create.Options
Bitmask of the options to be applied when creating or opening the file. See the description of the CreateOptions parameter to ZwCreateFile for more information.
IrpSp->Parameters.Create.SecurityContext->AccessState
Pointer to the ACCESS_STATE structure to be modified.
IrpSp->Parameters.Create.SecurityContext->DesiredAccess
ACCESS_MASK structure specifying access rights requested for the file. See the description of the DesiredAccess parameter to ZwCreateFile for more information.
IrpSp->Parameters.Create.ShareAccess
Bitmask of share access rights requested for the file. If this member is zero, exclusive access is being requested. See the description of the ShareAccess parameter to ZwCreateFile for more information.

在DDK上面有啊！估计是没有好好看DDK的帮助了！
IRP_MJ_CREATE
When Sent
The I/O Manager sends this request when a file, device, directory, or volume is being opened or created. Normally this IRP is sent on behalf of a user-mode application that has called a Microsoft Win32? function such as CreateFile or a kernel-mode component that has called IoCreateFile, ZwCreateFile, or ZwOpenFile. If the create request is completed successfully, the application or kernel-mode component receives a handle to the file object.

Operation: File System Drivers
If the target device object is the file system\'s control device object, the file system driver\'s dispatch routine must complete the IRP and return an appropriate NTSTATUS value, after setting Irp->IoStatus.Status and Irp->IoStatus.Information to appropriate values.

Otherwise, the file system driver should process the create request.

Operation: File System Filter Drivers
If the target device object is the filter driver\'s control device object, the filter driver\'s dispatch routine must complete the IRP and return an appropriate NTSTATUS value, after setting Irp->IoStatus.Status and Irp->IoStatus.Information to appropriate values.

Otherwise, the filter driver should perform any needed processing and, depending on the nature of the filter, either complete the IRP or pass it down to the next lower driver on the stack.

Generally, filter drivers should not return STATUS_PENDING in response to IRP_MJ_CREATE. However, if a lower-level driver returns STATUS_PENDING, the filter driver should pass this status value up the driver chain.

Parameters
A file system or filter driver calls IoGetCurrentIrpStackLocation with the given IRP to get a pointer to its own stack location in the IRP, shown in the following list as IrpSp. (The IRP is shown as Irp.) The driver can use the information set in the following members of the IRP and the IRP stack location in processing a create request:

DeviceObject
Pointer to the target device object.
Irp->AssociatedIrp.SystemBuffer
Pointer to a FILE_FULL_EA_INFORMATION-structured buffer, if the file object represents a file with extended attributes. Otherwise NULL.
Irp->IoStatus
Pointer to an IO_STATUS_BLOCK structure that receives the final completion status and information about the requested operation. See the description of the IoStatusBlock parameter to ZwCreateFile for more information.
IrpSp->FileObject
Pointer to a file object that the I/O Manager creates to represent the file to be created or opened. The file system sets the FsContext and possibly FsContext2 fields(s) in this file object to values that are file system-specific.
IrpSp->Flags
One or more of the following:
SL_CASE_SENSITIVE
SL_FORCE_ACCESS_CHECK (IO_FORCE_ACCESS_CHECK)
SL_OPEN_PAGING_FILE (IO_OPEN_PAGING_FILE)
SL_OPEN_TARGET_DIRECTORY (IO_OPEN_TARGET_DIRECTORY)

See the description of the Options parameter to IoCreateFile for more information.

IrpSp->MajorFunction
Specifies IRP_MJ_CREATE.
IrpSp->Parameters.Create.EaLength
Size in bytes of the buffer at Irp->AssociatedIrp.SystemBuffer. If the value of Irp->AssociatedIrp.SystemBuffer is NULL, this member must be zero.
IrpSp->Parameters.Create.Options
Bitmask of the options to be applied when creating or opening the file. See the description of the CreateOptions parameter to ZwCreateFile for more information.
IrpSp->Parameters.Create.SecurityContext->AccessState
Pointer to the ACCESS_STATE structure to be modified.
IrpSp->Parameters.Create.SecurityContext->DesiredAccess
ACCESS_MASK structure specifying access rights requested for the file. See the description of the DesiredAccess parameter to ZwCreateFile for more information.
IrpSp->Parameters.Create.ShareAccess
Bitmask of share access rights requested for the file. If this member is zero, exclusive access is being requested. See the description of the ShareAccess parameter to ZwCreateFile for more information.
 

你的DDK是什么版本的?我的怎么没有这么详细的帮助？我的是2KDDK的。

哦，原来在IFSDDK中