OSRLogoOSRLogoOSRLogo x Seminar Ad

Everything Windows Driver Development

GoToHomePage xLoginx

    Thu, 14 Mar 2019     118020 members


  Online Dump Analyzer
OSR Dev Blog
The NT Insider
The Basics
File Systems
ListServer / Forum
  Express Links
  · The NT Insider Digital Edition - May-June 2016 Now Available!
  · Windows 8.1 Update: VS Express Now Supported
  · HCK Client install on Windows N versions
  · There's a WDFSTRING?
  · When CAN You Call WdfIoQueueP...ously

Relative opens and IoCreateFileSpecifyDeviceObjectHint

This might be old news to some, but it certainly caught me by surprise....

I wrote some seemingly innocuous filter code to create a stream within a file on an NTFS volume. Using a HANDLE to the file as the RootDirectory within the OBJECT_ATTRIBUTES, I tried to do a relative create on the file using IoCreateFileSpecifyDeviceObjectHint. Much to my surprise, the IRP_MJ_CREATE appeared at the top of the device stack. Googling a bit turned up a post on NTFSD from last year in which this was acknowledged as a bug.

The gist of the thread is that you're OK doing relative opens with IoCreateFileSpecifyDevice ObjectHint if the RootDirectory is a HANDLE to:

  • A FILE_OBJECT that was also returned from a call to IoCreateFileSpecifyDeviceObjectHint
  • A FILE_OBJECT that represents a volume open

User Comments
Rate this article and give us feedback. Do you find anything missing? Share your opinion with the community!
Post Your Comment

"IRP_MN_QUERY_DIRECTORY and IoCreateFileSpecifyDeviceObjectHint"
I used IoCreateFileSpecifyDeviceObjectHint in IRP_MJ_DIRECTORY_CONTROL dispatch routine,the IRP_MJ_CREATE appeared at my filter dirver

01-Nov-11, kay lc

"broken link"


28-Aug-08, Gabriel Bercea

Post Your Comments.
Print this article.
Email this article.
bottom nav links