在看了之前贴，都试了，还是不能判断文件夹还是文件，请教大家

  我看了原来的贴子用以下方法都不成，有没有大侠知道呢，因为我不需要加密文件夹，只要加密文件就好了。

IrpSp->Parameters.Create.Options & FILE_DIRECTORY_FILE


rpSp->Flags & SL_OPEN_TARGET_DIRECTORY

IrpSp->Flags & IO_OPEN_TARGET_DIRECTORY

可以用 filoeobj中的 fscontext来判断

谢谢，是不是用fscontext的前2个字节来判断，我试试：）

请问Fscontext是不是一直都用这个结构?
FSRTL_COMMON_FCB_HEADER
The FSRTL_COMMON_FCB_HEADER structure contains context information that a file system maintains about a file, directory, volume, or alternate data stream.

typedef struct _FSRTL_COMMON_FCB_HEADER {
  CSHORT  NodeTypeCode;
  CSHORT  NodeByteSize;
  UCHAR  Flags;
  UCHAR  IsFastIoPossible;
  UCHAR  Flags2;
  UCHAR  Reserved;
  PERESOURCE  Resource;
  PERESOURCE  PagingIoResource;
  LARGE_INTEGER  AllocationSize;
  LARGE_INTEGER  FileSize;
  LARGE_INTEGER  ValidDataLength;
} FSRTL_COMMON_FCB_HEADER;


Members
NodeTypeCode
Reserved for system use.
NodeByteSize
Reserved for system use.
Flags
Bitmask of flags indicating support for various features. Combination of one or more of the following values:
FSRTL_FLAG_FILE_MODIFIED
Reserved for system use.
FSRTL_FLAG_FILE_LENGTH_CHANGED
Reserved for system use.
FSRTL_FLAG_LIMIT_MODIFIED_PAGES
Reserved for system use.
FSRTL_FLAG_ACQUIRE_MAIN_RSRC_EX
Reserved for system use.
FSRTL_FLAG_ACQUIRE_MAIN_RSRC_SH
Reserved for system use.
FSRTL_FLAG_USER_MAPPED_FILE
The Cache Manager sets this flag to indicate that a view is mapped to a file.
FSRTL_FLAG_ADVANCED_HEADER
This flag indicates that the file system is using FSRTL_ADVANCED_FCB_HEADER instead of FSRTL_COMMON_FCB_HEADER in its file control block (FCB) structures.
FSRTL_FLAG_EOF_ADVANCE_ACTIVE
Reserved for system use.
IsFastIoPossible
One of the following values: Value Meaning
FastIoIsPossible Fast I/O is possible.  
FastIoIsQuestionable An exclusive byte range lock exists for the file. The caller should call the file system's FastIoCheckIfPossible routine.  
FastIoIsNotPossible The FCB for the file is bad, or an opportunistic lock (also called an oplock) exists for the file.  


For more information about these values, see the reference entries for FsRtlAreThereCurrentFileLocks, FsRtlCopyRead, and FsRtlCopyWrite.

Flags2
Bitmask of flags that the file system sets to indicate support for various features. One or more of the following values:
FSRTL_FLAG2_DO_MODIFIED_WRITE
This flag is used together with the FsContext2 member of the file object for the file stream as follows:
If the FsContext2 member of the file object is non-NULL, the file stream represents an open instance of a file or directory, and the value of this flag is ignored.
If the FsContext2 member of the file object is NULL, and this flag is not set, the file object is a stream file object, and the stream is a modified-no-write (MNW) stream.
If the FsContext2 member of the file object is NULL, and this flag is set, the file object is a stream file object, and the stream is writable.
FSRTL_FLAG2_PURGE_WHEN_MAPPED
If this flag is set, the Cache Manager will flush and purge the cache map when a user first maps a file.
FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS
This flag indicates that the file system is using FSRTL_ADVANCED_FCB_HEADER instead of FSRTL_COMMON_FCB_HEADER in its FCB structures.
Reserved
Reserved for system use. Drivers must set this member to zero.
Resource
Pointer to an initialized resource variable, for which the file system supplies the storage, that will be used to synchronize I/O access to the FCB. The resource variable must be allocated from nonpaged pool.
Filter drivers should treat this member as opaque.

PagingIoResource
Pointer to an additional resource variable, for which the file system supplies the storage, that will be used to synchronize paging I/O access to the FCB. The resource variable must be allocated from nonpaged pool.
Filter drivers should treat this member as opaque.

AllocationSize
Allocation size for the file stream.
For more information about the AllocationSize, FileSize, and ValidDataLength members, see the reference entry for CcInitializeCacheMap.

FileSize
File size for the file stream.
ValidDataLength
Valid data length for the file stream.

Headers
Declared in ntifs.h. Include ntifs.h.

Comments
File systems that use the Cache Manager must set the FsContext member of every file object to point to a stream context object whose first member is a FSRTL_COMMON_FCB_HEADER or FSRTL_ADVANCED_FCB_HEADER structure. (The remainder of the structure is file-system-specific.) Usually, this structure is a file control block (FCB). However, on some file systems that support multiple data streams, such as NTFS, it is a stream control block (SCB).

Note  To support filter contexts and the Filter Manager, file systems must use the FSRTL_ADVANCED_FCB_HEADER structure in their stream context objects. All Microsoft file system use this structure, and all third-party file system writers are strongly encouraged to do so. FCBs for all classes of opens, including volume opens, should include this structure.

If the file is used a paging file, the FSRTL_COMMON_FCB_HEADER structure must be allocated from nonpaged pool. Otherwise, it can be allocated from paged or nonpaged pool.