file_open_by_id

在ntfs下，使用打开文件，这是我如何获得文件名呀？

There doesnt have to be anything which queries the file id before the
IRP_MJ_CREATE. The application could have remembered the file id from a
previous uptime for example.

The file id for a named file can be retrieved with ZwQueryInformationFile
with FileInternalInformation class.

you can query AFTER the file is opened - you can do this during create

It is not always possible. CDFS also support open by FileID but doesn\'t
support query name for files opened by FileID.
NTFS on NT 4 doesn\'t support query file name for files opened by file id,
although W2K seems to support such requests.
Apparently the reason is that open by id bypasses directory structure so
path is unknown and need to constructed to satisfy query of the file name.


NTFS supports two different ids for a file: 64-bit that can be retrieved
by ZwQueryInformationFile and 128-bit ObjectId that can be retrived by
FSCTL_GET_OBJECT_ID or FSCTL_CREATE_OR_GET_OBJECT_ID or
ZwQueryInformationFile with FileObjectIdInformation class.

看filemon的例子，那里有