Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
The IoCheckFileObjectOpenedAsCopySource routine checks whether a file was previously opened with copy intent as a source file.
Syntax
BOOLEAN IoCheckFileObjectOpenedAsCopySource(
[in] PFILE_OBJECT FileObject
);
Parameters
[in] FileObject
Pointer to the source file object to check for copy intent.
Return value
IoCheckFileObjectOpenedAsCopySource returns TRUE if the file object represents a source file that was previously opened with copy file intent; otherwise it returns FALSE. A return value of TRUE only signals the intent at create time; it does not mean that all operations on the file object are all part of copies.
Remarks
The following example shows how to check if a file object was opened with copy intent.
typedef
BOOLEAN (*PIO_CHECK_FILE_OBJECT_OPENED_AS_COPY_SOURCE)(
_In_ PFILE_OBJECT FileObject
);
typedef
BOOLEAN (*PIO_CHECK_FILE_OBJECT_OPENED_AS_COPY_DESTINATION)(
_In_ PFILE_OBJECT FileObject
);
PIO_CHECK_FILE_OBJECT_OPENED_AS_COPY_SOURCE IoCheckFileObjectOpenedAsCopySource;
PIO_CHECK_FILE_OBJECT_OPENED_AS_COPY_DESTINATION IoCheckFileObjectOpenedAsCopyDestination;
// First resolve the API
RtlInitUnicodeString(&RoutineName, L"IoCheckFileObjectOpenedAsCopySource");
IoCheckFileObjectOpenedAsCopySource = (PIO_CHECK_FILE_OBJECT_OPENED_AS_COPY_SOURCE)MmGetSystemRoutineAddress(&RoutineName);
RtlInitUnicodeString(&RoutineName, L"IoCheckFileObjectOpenedAsCopyDestination");
IoCheckFileObjectOpenedAsCopyDestination = (PIO_CHECK_FILE_OBJECT_OPENED_AS_COPY_DESTINATION)MmGetSystemRoutineAddress(&RoutineName);
// Now use the API
IoCheckFileObjectOpenedAsCopySource(FltObjects->FileObject);
IoCheckFileObjectOpenedAsCopyDestination(FltObjects->FileObject);
See Kernel-mode file copy and detecting copy file scenarios for more information.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client | Windows 11, version 22H2 |
| Header | ntifs.h (include Wdm.h, Ntddk.h, Ntifs.h) |
| IRQL | PASSIVE_LEVEL |