GetFileType returns the underlying file type. The opts parameter corresponds to the NtCreateFile CreateOptions argument that specifies the options to be applied when creating or opening the file.
(filename string, opts uint32)
| 122 | // GetFileType returns the underlying file type. The opts parameter corresponds to the NtCreateFile CreateOptions argument |
| 123 | // that specifies the options to be applied when creating or opening the file. |
| 124 | func GetFileType(filename string, opts uint32) FileType { |
| 125 | if filename == "" { |
| 126 | return Other |
| 127 | } |
| 128 | // if the CreateOptions argument of the NtCreateFile syscall has been invoked |
| 129 | // with the FILE_DIRECTORY_FILE flag, it is likely that the target file object |
| 130 | // is a directory. We ensure that by calling the API function for checking whether |
| 131 | // the path name is truly a directory |
| 132 | if (opts&directoryFile) != 0 && sys.PathIsDirectory(filename) { |
| 133 | return Directory |
| 134 | } |
| 135 | // FILE_DIRECTORY_FILE flag only gives us a hint on the CreateFile op outcome. If this flag is |
| 136 | // not present in the argument but the file is a directory, we can apply some simple heuristics |
| 137 | // like checking the extension/suffix, even though they are not bullet-proof |
| 138 | if filename[:len(filename)-1] == "\\" || filepath.Ext(filename) == "" { |
| 139 | return Directory |
| 140 | } |
| 141 | // non directory file can be a regular file, logical, virtual or physical device or a volume. |
| 142 | // If the filename doesn't start with a drive letter it's probably not a regular |
| 143 | // file since we already have mapped the DOS name to drive letter |
| 144 | if !strings.HasPrefix(filename, "\\Device") { |
| 145 | return Regular |
| 146 | } |
| 147 | // if the filename contains the HardiskVolume string then we assume it is a file. This |
| 148 | // could happen if we fail to resolve the DOS name |
| 149 | if strings.HasPrefix(filename, "\\Device\\HarddiskVolume") { |
| 150 | return Regular |
| 151 | } |
| 152 | // logical, virtual, physical device or a volume |
| 153 | // obtain the device type that is linked to this file object |
| 154 | return getFileTypeFromVolumeInfo(filename) |
| 155 | } |
| 156 | |
| 157 | func getFileTypeFromVolumeInfo(filename string) FileType { |
| 158 | f, err := os.Open(filename) |