ZwCreateFile question

I know that files I'm interested in are open for write access of some sort.
I'd like to open those files but merely for read access prior to a write, so
I open it like so:
InitializeObjectAttributes(&ObjAttrs,InFile,OBJ_KERNEL_HANDLE|OBJ_CASE_INSENSITIVE,NULL,NULL);
//
Status = ZwCreateFile(&FileHandle,
GENERIC_READ|FILE_READ_ATTRIBUTES|FILE_READ_DATA,
&ObjAttrs,
&StatusBlock,
0, //allocation size
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ|FILE_SHARE_DELETE, //share access
FILE_OPEN, // disposition
FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT,//CreateOptions,
0, // EaBuffer OPTIONAL,
0 );

Yet, I'm getting :
STATUS_SHARING_VIOLATION ((NTSTATUS)0xC0000043L) errors.

Must I open the file with precisely the same ACCESS_MASK as was originally
used?
On the other hand, I do have the FileObject for this guy based on it being
open for Write. Can I get a handle for reading with ObOpenObjectByPointer?



--
Gak -
Finecats

hannes
Mon Apr 25 11:03:03 CDT 2005

I'm not an expert on this, but I guess "FILE_SHARE_DELETE" means that you
want to allow others to be able to delete the file. Do you have permissions
to let others do so? Try removing FILE_SHARE_DELETE and see if that helps.

/ Hannes.

"usfinecats" wrote:

> I know that files I'm interested in are open for write access of some sort.
> I'd like to open those files but merely for read access prior to a write, so
> I open it like so:
> InitializeObjectAttributes(&ObjAttrs,InFile,OBJ_KERNEL_HANDLE|OBJ_CASE_INSENSITIVE,NULL,NULL);
> //
> Status = ZwCreateFile(&FileHandle,
> GENERIC_READ|FILE_READ_ATTRIBUTES|FILE_READ_DATA,
> &ObjAttrs,
> &StatusBlock,
> 0, //allocation size
> FILE_ATTRIBUTE_NORMAL,
> FILE_SHARE_READ|FILE_SHARE_DELETE, //share access
> FILE_OPEN, // disposition
> FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT,//CreateOptions,
> 0, // EaBuffer OPTIONAL,
> 0 );
>
> Yet, I'm getting :
> STATUS_SHARING_VIOLATION ((NTSTATUS)0xC0000043L) errors.
>
> Must I open the file with precisely the same ACCESS_MASK as was originally
> used?
> On the other hand, I do have the FileObject for this guy based on it being
> open for Write. Can I get a handle for reading with ObOpenObjectByPointer?
>
>
>
> --
> Gak -
> Finecats

pavel_a
Tue Apr 26 19:29:01 CDT 2005

To open files opened by others with write access,
you may need the volume snapshot service.
If you haven't already read on it, have a look.
--PA

"usfinecats" wrote:
> I know that files I'm interested in are open for write access of some sort.
> I'd like to open those files but merely for read access prior to a write, so
> I open it like so:
> InitializeObjectAttributes(&ObjAttrs,InFile,OBJ_KERNEL_HANDLE|OBJ_CASE_INSENSITIVE,NULL,NULL);
> //
> Status = ZwCreateFile(&FileHandle,
> GENERIC_READ|FILE_READ_ATTRIBUTES|FILE_READ_DATA,
> &ObjAttrs,
> &StatusBlock,
> 0, //allocation size
> FILE_ATTRIBUTE_NORMAL,
> FILE_SHARE_READ|FILE_SHARE_DELETE, //share access
> FILE_OPEN, // disposition
> FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT,//CreateOptions,
> 0, // EaBuffer OPTIONAL,
> 0 );
>
> Yet, I'm getting :
> STATUS_SHARING_VIOLATION ((NTSTATUS)0xC0000043L) errors.
>
> Must I open the file with precisely the same ACCESS_MASK as was originally
> used?
> On the other hand, I do have the FileObject for this guy based on it being
> open for Write. Can I get a handle for reading with ObOpenObjectByPointer?
>
>
>
> --
> Gak -
> Finecats