I know that files I'm interested in are open for write access of some sort.
I'd like to open those files but merely for read access prior to a write, so
I open it like so:
InitializeObjectAttributes(&ObjAttrs,InFile,OBJ_KE RNEL_HANDLE|OBJ_CASE_INSENSITIVE,NULL,NULL);
//
Status = ZwCreateFile(&FileHandle,
GENERIC_READ|FILE_READ_ATTRIBUTES|FILE_READ_DATA,
&ObjAttrs,
&StatusBlock,
0, //allocation size
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ|FILE_SHARE_DELETE, //share access
FILE_OPEN, // disposition
FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALE RT,//CreateOptions,
0, // EaBuffer OPTIONAL,
0 );

Yet, I'm getting :
STATUS_SHARING_VIOLATION ((NTSTATUS)0xC0000043L) errors.

Must I open the file with precisely the same ACCESS_MASK as was originally
used?
On the other hand, I do have the FileObject for this guy based on it being
open for Write. Can I get a handle for reading with ObOpenObjectByPointer?



--
Gak -
Finecats

I'm not an expert on this, but I guess "FILE_SHARE_DELETE" means that you
want to allow others to be able to delete the file. Do you have permissions
to let others do so? Try removing FILE_SHARE_DELETE and see if that helps.

/ Hannes.

"usfinecats" wrote:

To open files opened by others with write access,
you may need the volume snapshot service.
If you haven't already read on it, have a look.
--PA

"usfinecats" wrote: