File Objects

Download EaseFilter Monitor, Control and Encryption Filter Driver SDK Setup File
Download EaseFilter Monitor, Control and Encryption Filter Driver SDK Zip File

File objects function as the logical interface between kernel and user-mode processes and the file data that resides on the physical disk. A file object contains both the data written to the file and the following set of kernel-maintained attributes.

The FILE_OBJECT structure is used by the system to represent a file object. To user-mode protected subsystems, a file object represents an open instance of a file, device, directory, or volume. To device and intermediate drivers, a file object usually represents a device object. To drivers in the file system stack, a file object usually represents a directory or file.

typedef struct _FILE_OBJECT 
  {	CSHORT                            Type;   
	CSHORT                            Size;    
	PDEVICE_OBJECT                    DeviceObject;    
	PVPB                              Vpb;    
	PVOID                             FsContext;    
	PVOID                             FsContext2;    
	PSECTION_OBJECT_POINTERS          SectionObjectPointer;    
	PVOID                             PrivateCacheMap;    
	NTSTATUS                          FinalStatus;    
	struct _FILE_OBJECT  			 *RelatedFileObject;    
	BOOLEAN                           LockOperation;    
	BOOLEAN                           DeletePending;    
	BOOLEAN                           ReadAccess;    
	BOOLEAN                           WriteAccess;    
	BOOLEAN                           DeleteAccess;    
	BOOLEAN                           SharedRead;    
	BOOLEAN                           SharedWrite;    
	BOOLEAN                           SharedDelete;    
	ULONG                             Flags;    
	UNICODE_STRING                    FileName;    
	LARGE_INTEGER                     CurrentByteOffset;    
	__volatile ULONG                  Waiters;    
	__volatile ULONG                  Busy;    
	PVOID                             LastLock;    
	KEVENT                            Lock;    
	KEVENT                            Event;    
	__volatile PIO_COMPLETION_CONTEXT CompletionContext;    
	KSPIN_LOCK                        IrpListLock;    
	LIST_ENTRY                        IrpList;    
	__volatile PVOID                  FileObjectExtension;  
	} FILE_OBJECT, *PFILE_OBJECT, LOG_FILE_OBJECT;