How do I know which File handle made an IRP?

If I may have several user device files open to the same device, I will want to keep track of information for each device file separately. My DeviceCreate function can allocate space for each file. But when DeviceControl is called, how can I match that call with the DeviceCreate call?
I assume that the IRP passed in is created temporarily by the IO manager. Is this true?
If so, then what is there in the IRP that uniquely identifies the device file?

This is probably a simple question, but I haven’t been able to locate any information about this.

When you process IRP_MJ_CREATE/EvtDeviceFileCreate, you will see the PFILE_OBJECT/WDFFILEOBJECT for the first time. You can add a per file object context (FsContext/FsContext 2 for WDM, WdfDeviceInitSetFileObjectConfig for WDF) and initialize/capture whatever per client information you need. Whenever you receive an IRP on that file handle, the irp will have the same PFILE_OBJECT/WDFFILEOBJECT associated with it (left as an exercise to the reader how to get it) and you have access to that context. If you are in WDM, you will need to free the context in IRP_MJ_CLOSE.

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@rolle.name
Sent: Tuesday, January 16, 2018 6:34 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] How do I know which File handle made an IRP?

If I may have several user device files open to the same device, I will want to keep track of information for each device file separately. My DeviceCreate function can allocate space for each file. But when DeviceControl is called, how can I match that call with the DeviceCreate call?
I assume that the IRP passed in is created temporarily by the IO manager. Is this true?
If so, then what is there in the IRP that uniquely identifies the device file?

This is probably a simple question, but I haven’t been able to locate any information about this.


NTDEV is sponsored by OSR

Visit the list online at: https:

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
Details at https:

To unsubscribe, visit the List Server section of OSR Online at https:</https:></https:></https:>

Answer to “exercise for the reader.” Of course, that is what I was asking about in the first place. However, since you write PFILE_OBJECT, I found it in the IO_STACK_LOCATION obtained by IoGetCurrentIrpStackLocation (pIRP).

Thanks for the tip.