阅读:2102回复:2
file_open_by_id
在ntfs下,使用打开文件,这是我如何获得文件名呀?
|
|
|
驱动老牛
|
沙发#
发布于:2005-03-18 15:37
There doesnt have to be anything which queries the file id before the
IRP_MJ_CREATE. The application could have remembered the file id from a previous uptime for example. The file id for a named file can be retrieved with ZwQueryInformationFile with FileInternalInformation class. you can query AFTER the file is opened - you can do this during create It is not always possible. CDFS also support open by FileID but doesn\'t support query name for files opened by FileID. NTFS on NT 4 doesn\'t support query file name for files opened by file id, although W2K seems to support such requests. Apparently the reason is that open by id bypasses directory structure so path is unknown and need to constructed to satisfy query of the file name. NTFS supports two different ids for a file: 64-bit that can be retrieved by ZwQueryInformationFile and 128-bit ObjectId that can be retrived by FSCTL_GET_OBJECT_ID or FSCTL_CREATE_OR_GET_OBJECT_ID or ZwQueryInformationFile with FileObjectIdInformation class. |
|
板凳#
发布于:2005-03-18 17:56
看filemon的例子,那里有
|
|