Path: news.mitre.org!blanket.mitre.org!philabs!newsjunkie.ans.net!newsfeeds.ans.net!streamer1.cleveland.iagnet.net!iagnet.net!newsfeed.internetmci.com!204.238.120.130!jump.net!jumpnet.com!not-for-mail
From: "Mike Moorman" <moomi@io.com>
Newsgroups: comp.os.ms-windows.programmer.nt.kernel-mode
Subject: Determining create mode for file IO in a filter driver
Date: 3 Dec 1997 19:51:26 GMT
Organization: Jump Point Communications, Inc.
Lines: 19
Message-ID: <01bd0024$bb619880$185108cf@borodino.stratfor.com>
NNTP-Posting-Host: borodino.stratfor.com
X-Newsreader: Microsoft Internet News 4.70.1155

Hi. I'm writing a filter driver and trapping file IO. I need to determine
what flags were used when a file is opened.

At the top of the hook I have a pointer to the IRP is passed in, which I
used to get the current IP stack...

    PIO_STACK_LOCATION  currentIrpStack =
IoGetCurrentIrpStackLocation(Irp);

I then look at
currentIrpStack->Parameters.Create.SecurityContext->FullCreateOptionsa (on
a Create call)
because I expected that this would contain one of the flags I'm interested
in... the flags passed into the CreateFile call in the first place, one of
CREATE_NEW, OPEN_EXISTING, etc....

How can I determine what mode a file is opened in?