If you are implementing minifilter, may be you can use FltQueryInformationFile with FILE_INFORMATION_BASIC
to get file attributes. Then check for FILE_ATTRIBUTE_DEVICE attribute.
How to determine if a FILE_OBJECT represents a normal file or device?
-
13-01-2022 - |
سؤال
The MSDN page on FILE_OBJECT says:
"Note The type of object (for example, a file, directory, or volume) that a given file object represents cannot be determined by only examining the contents of the file object structure. For information about how to determine the type of object that a file object represents, see ZwQueryInformationFile."
I have two questions:
1, How to determine the object type through ZwQueryInformationFile?
2, Is DEVICE_TYPE, such as FILE_DEVICE_CD_ROM_FILE_SYSTEM, FILE_DEVICE_DISK_FILE_SYSTEM, FILE_DEVICE_FILE_SYSTEM, reliable to determine?
Thanks.
المحلول
لا تنتمي إلى StackOverflow