［WDK］IRP_MJ_CREATE CreateDisposition / CreateOption 을 통한 파일/디렉토리 생성 구분

CreateDisposition [in]

Specifies what to do, depending on whether the file already exists, as one of the following values.

 

Value	Meaning
FILE_SUPERSEDE	If the file already exists, replace it with the given file. If it does not, create the given file.
FILE_CREATE	If the file already exists, fail the request and do not create or open the given file. If it does not, create the given file.
FILE_OPEN	If the file already exists, open it instead of creating a new file. If it does not, fail the request and do not create a new file.
FILE_OPEN_IF	If the file already exists, open it. If it does not, create the given file.
FILE_OVERWRITE	If the file already exists, open it and overwrite it. If it does not, fail the request.
FILE_OVERWRITE_IF	If the file already exists, open it and overwrite it. If it does not, create the given file.

 

CreateOptions [in]

The options to be applied when creating or opening the file, as a compatible combination of the following flags.

 

Value	Meaning
FILE_DIRECTORY_FILE	The file being created or opened is a directory file. With this flag, the CreateDisposition parameter must be set to FILE_CREATE, FILE_OPEN, or FILE_OPEN_IF. With this flag, other compatible CreateOptions flags include only the following: FILE_SYNCHRONOUS_IO_ALERT, FILE_SYNCHRONOUS_IO _NONALERT, FILE_WRITE_THROUGH, FILE_OPEN_FOR_BACKUP_INTENT, and FILE_OPEN_BY_FILE_ID.
FILE_NON_DIRECTORY_FILE	The file being opened must not be a directory file or this call fails. The file object being opened can represent a data file, a logical, virtual, or physical device, or a volume.
FILE_WRITE_THROUGH	Applications that write data to the file must actually transfer the data into the file before any requested write operation is considered complete. This flag is automatically set if the CreateOptions flag FILE_NO_INTERMEDIATE _BUFFERING is set.
FILE_SEQUENTIAL_ONLY	All accesses to the file are sequential.
FILE_RANDOM_ACCESS	Accesses to the file can be random, so no sequential read-ahead operations should be performed on the file by FSDs or the system.
FILE_NO_INTERMEDIATE_BUFFERING	The file cannot be cached or buffered in a driver's internal buffers. This flag is incompatible with the DesiredAccess FILE_APPEND_DATA flag.
FILE_SYNCHRONOUS_IO_ALERT	All operations on the file are performed synchronously. Any wait on behalf of the caller is subject to premature termination from alerts. This flag also causes the I/O system to maintain the file position context. If this flag is set, the DesiredAccess SYNCHRONIZE flag also must be set.
FILE_SYNCHRONOUS_IO_NONALERT	All operations on the file are performed synchronously. Waits in the system to synchronize I/O queuing and completion are not subject to alerts. This flag also causes the I/O system to maintain the file position context. If this flag is set, the DesiredAccess SYNCHRONIZE flag also must be set.
FILE_CREATE_TREE_CONNECTION	Create a tree connection for this file in order to open it over the network. This flag is not used by device and intermediate drivers.
FILE_NO_EA_KNOWLEDGE	If the extended attributes on an existing file being opened indicate that the caller must understand EAs to properly interpret the file, fail this request because the caller does not understand how to deal with EAs. This flag is irrelevant for device and intermediate drivers.
FILE_OPEN_REPARSE_POINT	Open a file with a reparse point and bypass normal reparse point processing for the file. For more information, see the Remarks section.
FILE_DELETE_ON_CLOSE	Delete the file when the last handle to it is passed to NtClose. If this flag is set, the DELETE flag must be set in the DesiredAccess parameter.
FILE_OPEN_BY_FILE_ID	The file name that is specified by the ObjectAttributes parameter includes the 8-byte file reference number for the file. This number is assigned by and specific to the particular file system. If the file is a reparse point, the file name will also include the name of a device. Note that the FAT file system does not support this flag. This flag is not used by device and intermediate drivers.
FILE_OPEN_FOR_BACKUP_INTENT	The file is being opened for backup intent. Therefore, the system should check for certain access rights and grant the caller the appropriate access to the file before checking the DesiredAccess parameter against the file's security descriptor. This flag not used by device and intermediate drivers.
FILE_RESERVE_OPFILTER	This flag allows an application to request a filter opportunistic lock (oplock) to prevent other applications from getting share violations. If there are already open handles, the create request will fail with STATUS_OPLOCK_NOT_GRANTED. For more information, see the Remarks section.
FILE_OPEN_REQUIRING_OPLOCK	The file is being opened and an opportunistic lock (oplock) on the file is being requested as a single atomic operation. The file system checks for oplocks before it performs the create operation and will fail the create with a return code of STATUS_CANNOT_BREAK_OPLOCK if the result would be to break an existing oplock. For more information, see the Remarks section. Windows Server 2008, Windows Vista, Windows Server 2003, and Windows XP:  This flag is not supported. This flag is supported on the following file systems: NTFS, FAT, and exFAT.
FILE_COMPLETE_IF_OPLOCKED	Complete this operation immediately with an alternate success code of STATUS_OPLOCK_BREAK_IN_PROGRESS if the target file is oplocked, rather than blocking the caller's thread. If the file is oplocked, another caller already has access to the file. This flag is not used by device and intermediate drivers.

 

 

 

(*참조 : NtCreateFile function - http://msdn.microsoft.com/en-us/library/bb432380(VS.85).aspx )

 

[example]

BOOLEAN xxxxxxxxxxx( PFLT_CALLBACK_DATA pData, ... )
{
 ULONG ulState     = 0;

 ULONG ulDesiredAccess   = 0;
 ULONG ulCreateDisposition  = 0;
 
 ULONG ulCreateOption   = 0;

 ulDesiredAccess  = pData->Iopb->Parameters.Create.SecurityContext->DesiredAccess;
 ulCreateOption  = pData->Iopb->Parameters.Create.Options;
 ulCreateDisposition = (ulCreateOption >> 24) & 0xFF;

 .
 .
 .

 if( ulCreateDisposition == FILE_CREATE )
 {

 }

 if ( ulCreateDisposition == FILE_OPEN )
 {

 }

 switch ( ulCreateDisposition )
 {
 case FILE_CREATE:
  {
  }
 case FILE_OVERWRITE_IF:
 case FILE_SUPERSEDE:
 case FILE_OPEN_IF:
 case FILE_OVERWRITE:
  {
  }
  break;
 }

 .
 .
 .

}