阅读:1121回复:2
发现打开一个文件的时候会收到很多次的IRP_CREATE.
怎样判断哪一次IRP_CREATE中的FileObject才是与该文件对应的FileObject呢?谢谢!
|
|
沙发#
发布于:2007-05-31 02:49
每一次都是吧
|
|
板凳#
发布于:2007-05-31 03:19
All of them are valid FileObjects. You need to know that there is no one-to-one relationship between user-mode behavior and kernel-mode operations.
|
|