沒畫完的畫

IRP_MJ_CREATE
[本文摘自MSDN,翻譯不好敬請指正,謝謝]

Every kernel-mode driver must handle IRP_MJ_CREATE requests in a DispatchCreate or DispatchCreateClose routine.
每個內核驅動必須在 DispatchCreate  或 DispatchCreateClose  處理 IRP_MJ_CREATE 請求

When Sent
什么時候系統會發送 IRP_MJ_CREATE

The operating system sends an IRP_MJ_CREATE request to open a handle to a file object or device object. For example, when a driver calls ZwCreateFile, the operating system sends an IRP_MJ_CREATE request to perform the actual open operation.
操作系統發送一個 IRP_MJ_CREATE 請求打開文件對象或設備對象. 比如, 設備調用 ZwCreateFile, 操作系統發送一個 IRP_MJ_CREATE 請求進行實際的打開操作

Input Parameters
The Parameters.Create.SecurityContext member points to an IO_SECURITY_CONTEXT structure that describes the security context for the request.

輸入參數
Parameters.Create.SecurityContext 成員指針指向 描述請求安全上下文的 IO_SECURITY_CONTEXT  結構

The Parameters.Create.Options member is a ULONG value that describes the options that are used when opening the handle. The high 8 bits correspond to the value of the CreateDisposition parameter of ZwCreateFile, and the low 24 bits correspond to the value of the CreateOptions parameter of ZwCreateFile.
Parameters.Create.Options 成員是一個 ULONG 值 用來描述 打開的句柄時使用的選項.
高8位相當于 ZwCreateFile 的 CreateDisposition 參數, 低 24位相關于 ZwCreateFile 的 CreateOptions 參數

The Parameters.Create.ShareAccess member is a USHORT value that describes the type of share access. This value corresponds to the value of the ShareAccess parameter of ZwCreateFile.

Parameters.Create.ShareAccess 成員是一個 USHORT 值用來描述共享訪問的類型, 相當于 ZwCreateFile 的 ShareAccess 參數

The Parameters.Create.FileAttributes and Parameters.Create.EaLength members are reserved for use by file systems and file system filter drivers. For more information, see the IRP_MJ_CREATE topic in the Installable File System (IFS) documentation.
Parameters.Create.FileAttributes 和 Parameters.Create.EaLength  成員為文件系統 和文件系統的過濾驅動所保留,詳細請參見 IFS 中IRP_MJ_CREATE  相關部份

Output Parameters
None

輸出參數: 無

Operation
Most device and intermediate drivers set STATUS_SUCESS in the I/O status block of the IRP and complete the create request, but drivers can optionally use their DispatchCreate routine to reserve resources for any subsequent I/O requests for that handle. For example, the system serial driver maps its paged-out code and allocates any resources that are necessary to handle subsequent I/O requests for the user-mode thread that is attempting to open the device for input and output.
大部份設備和中間層驅動在 IRP 的IO狀態阻塞和完成IRP請求時會設置為 STATUS_SUCESS, 但驅動可以用 DispatchCreate 函數保留 隨后I/O請求的句柄 的資源. 例如, 系統串口驅動映射它的頁面溢出的代碼和分配一些資源, 那有必要處理 用戶模式線程綁定一個設備用來輸入輸出的隨后IO請求