Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

NtOpenFile VS. NtCreateFile

890 views
Skip to first unread message

xmllmx

unread,
Jul 26, 2009, 9:24:02 PM7/26/09
to
NtOpenFile VS. NtCreateFile

By debugging, I found that both of CreateFile and OpenFile call
NtCreateFile rather than NtOpenFile. NtOpenFile be called by some
internal functions, such as ntdll!RtlAllocateHeap.

To my understanding, NtOpenFile provides a subset of functions of
NtCreateFile. In other words, NtOpenFile can be totally superseded by
NtCreateFile. What makes the redundancy necessary?

Maxim S. Shatskih

unread,
Jul 27, 2009, 3:19:35 AM7/27/09
to
> By debugging, I found that both of CreateFile and OpenFile call
> NtCreateFile rather than NtOpenFile. NtOpenFile be called by some
> internal functions, such as ntdll!RtlAllocateHeap.

??? allocator opens files?

> NtCreateFile. In other words, NtOpenFile can be totally superseded by
> NtCreateFile. What makes the redundancy necessary?

Convinience. I think NtOpenFile has much easier parameters.

--
Maxim S. Shatskih
Windows DDK MVP
ma...@storagecraft.com
http://www.storagecraft.com

xmllmx

unread,
Jul 27, 2009, 3:34:22 AM7/27/09
to
On Jul 27, 3:19 pm, "Maxim S. Shatskih"
<ma...@storagecraft.com.no.spam> wrote:
> ??? allocator opens files?

Yes. It does. The result is from WinDBG.

I am also confused about this.


G�nter Prossliner

unread,
Jul 27, 2009, 4:44:41 AM7/27/09
to
Hallo xmllmx!

>> ??? allocator opens files?
>
> Yes. It does. The result is from WinDBG.

How have you checked this? When breaking in NtOpenFile I don't see any
reference to RltAllocateHeap. When stepping through RltAllocateHeap I don't
see any call to it. I have not checked all branches I must admin, but I
can't imagine why RltAllocateHeap opens a file.

Can you show us the Stack Trace?


GP


Volodymyr Shcherbyna

unread,
Jul 27, 2009, 5:22:13 PM7/27/09
to
Probably you were confused by looking at disassembly window, once you
scroll, the output becomes unpredictable. I find WinDbg quite primite in
this sence, but that's normal, it was not designed with the purpose to
easially peer inside assembly.

--
Volodymyr M. Shcherbyna, blog: http://www.shcherbyna.com/
(This posting is provided "AS IS" with no warranties, and confers no
rights)

"xmllmx" <xml...@gmail.com> a �crit dans le message de
news:f29cf533-8b5e-4e0d...@b15g2000yqd.googlegroups.com...

0 new messages