文件过滤驱动中 IRP_MJ_XX_INFORMATION 查询文件对象是文件还是目录的方法

首先，WDK 中关于 IRP_MJ_XX_INFORMATION 请求有这样一段话

“The file system driver should extract and decode the file object to determine whether it represents a user file or directory open”

可是文件对象中没有找到那个地方标记了对象是文件还是目录。于是只能使用函数查询

FltQueryInformationFile()  这个函数只能运行在 IRQL==PASSIVE_LEVEL

不过幸好，微软给出了每个文件IO对应的IRQL 如下，IRP_MJ_XX_INFORMATION 刚刚好在 PASSIVE_LEVEL

Dispatch Routine IRQL and Thread Context

The following table summarizes the IRQL and thread context requirements for file system filter driver dispatch routines.

Dispatch routine	Caller's IRQL:	Caller's thread context:
Cleanup	PASSIVE_LEVEL	Nonarbitrary
Close	APC_LEVEL	Arbitrary
Create	PASSIVE_LEVEL	Nonarbitrary
DeviceControl (except paging I/O)	PASSIVE_LEVEL	Nonarbitrary
DeviceControl (paging I/O path)	APC_LEVEL	Arbitrary
DirectoryControl	APC_LEVEL	Arbitrary
FlushBuffers	PASSIVE_LEVEL	Nonarbitrary
FsControl (except paging I/O)	PASSIVE_LEVEL	Nonarbitrary
FsControl (paging I/O path)	APC_LEVEL	Arbitrary
LockControl	PASSIVE_LEVEL	Nonarbitrary
PnP	PASSIVE_LEVEL	Arbitrary
QueryEa	PASSIVE_LEVEL	Nonarbitrary
QueryInformation	PASSIVE_LEVEL	Nonarbitrary
QueryQuota	PASSIVE_LEVEL	Nonarbitrary
QuerySecurity	PASSIVE_LEVEL	Nonarbitrary
QueryVolumeInfo	PASSIVE_LEVEL	Nonarbitrary
Read (except paging I/O)	PASSIVE_LEVEL	Nonarbitrary
Read (paging I/O path)	APC_LEVEL	Arbitrary
SetEa	PASSIVE_LEVEL	Nonarbitrary
SetInformation	PASSIVE_LEVEL	Nonarbitrary
SetQuota	PASSIVE_LEVEL	Nonarbitrary
SetSecurity	PASSIVE_LEVEL	Nonarbitrary
SetVolumeInfo	PASSIVE_LEVEL	Nonarbitrary
Shutdown	PASSIVE_LEVEL	Arbitrary
Write (except paging I/O)	PASSIVE_LEVEL	Nonarbitrary
Write (paging I/O path)	APC_LEVEL	Arbitrary