Method IrpCreateFile

KernelLibrary/FileManager.cpp:210–401

}

NTSTATUS FileManager::IrpCreateFile(
	_Out_ PFILE_OBJECT* pFileObject,
	_Out_ PDEVICE_OBJECT* pDeviceObject,
	_In_ ACCESS_MASK DesiredAccess,
	_In_ PCWSTR DosName,
	_Out_ PIO_STATUS_BLOCK IoStatusBlock,
	_In_opt_ PLARGE_INTEGER AllocationSize,
	_In_ ULONG FileAttributes,
	_In_ ULONG ShareAccess,
	_In_ ULONG CreateDisposition,
	_In_ ULONG CreateOptions,
	_In_reads_bytes_opt_(EaLength) PVOID EaBuffer,
	_In_ ULONG EaLength
) {
	PAUX_ACCESS_DATA AuxData = nullptr;
	HANDLE hRoot = nullptr;
	PFILE_OBJECT RootObject = nullptr, FileObject = nullptr;
	PDEVICE_OBJECT DeviceObject = nullptr, RealDeviceObject = nullptr;
	PIRP Irp;
	PIO_STACK_LOCATION stack;
	NTSTATUS status = STATUS_UNSUCCESSFUL;
	ACCESS_STATE AccessState;
	KEVENT notifyEvent;
	IO_SECURITY_CONTEXT IoSecurityContext;
	UNICODE_STRING rootName, fileName;
	RtlInitUnicodeString(&fileName, &DosName[2]);

	do
	{
		// �򿪸�Ŀ¼
		IO_STATUS_BLOCK ioStatus;
		status = GetRootName(DosName, &rootName);
		if (!NT_SUCCESS(status)) {
			break;
		}
		ObjectAttributes attr(&rootName, ObjectAttributesFlags::Caseinsensive | ObjectAttributesFlags::KernelHandle);
		status = IoCreateFile(&hRoot, FILE_READ_ATTRIBUTES | SYNCHRONIZE, &attr, &ioStatus, nullptr,
			FILE_ATTRIBUTE_NORMAL,
			FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
			FILE_OPEN,
			FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT,
			nullptr, 0, CreateFileTypeNone, nullptr, IO_NO_PARAMETER_CHECKING);
		*IoStatusBlock = ioStatus;
		if (!NT_SUCCESS(status)) {
			break;
		}

		// �õ���Ŀ¼�ļ�����
		status = ObReferenceObjectByHandle(hRoot,
			FILE_READ_ATTRIBUTES,
			*IoFileObjectType,
			KernelMode,
			(PVOID*)&RootObject,
			nullptr);
		if (!NT_SUCCESS(status)) {
			break;
		}