问题
Process Monitor shows disposition option for CreateFile operation as "Open", "OpenIf", "Overwrite", "OverwriteIf" (may be something else). How does the options which contain "If" differ from those that do not? And to which CreateFile WinAPI function 'dwCreationDisposition' flags do they correspond?
回答1:
| CreateFile | NtCreateFile | Process Monitor |
| dwCreationDisposition | CreateDisposition | Disposition |
|-----------------------|-----------------------|-----------------|
| n/a | FILE_SUPERSEDE (0) | Supersede (?) |
| OPEN_EXISTING (3) | FILE_OPEN (1) | Open |
| TRUNCATE_EXISTING (5) | FILE_OPEN (1) | Open |
| CREATE_NEW (1) | FILE_CREATE (2) | Create |
| OPEN_ALWAYS (4) | FILE_OPEN_IF (3) | OpenIf |
| n/a | FILE_OVERWRITE (4) | Overwrite (?) |
| CREATE_ALWAYS (2) | FILE_OVERWRITE_IF (5) | OverwriteIf |
回答2:
CreateFile() is the winapi function. Process Monitor however patches the native operating system, it only resembles the winapi in passing. It is pretty similar to VMS, the operating system that Dave Cutler designed when he still worked at DEC. Process Monitor hooks NtCreateFile(), follow the link to see the CreateDisposition argument values documented. Copied:
- FILE_SUPERSEDE. If the file already exists, replace it with the given file. If it does not, create the given file.
- FILE_CREATE. If the file already exists, fail the request and do not create or open the given file. If it does not, create the given file.
- FILE_OPEN. If the file already exists, open it instead of creating a new file. If it does not, fail the request and do not create a new file.
- FILE_OPEN_IF. If the file already exists, open it. If it does not, create the given file.
- FILE_OVERWRITE. If the file already exists, open it and overwrite it. If it does not, fail the request.
- FILE_OVERWRITE_IF. If the file already exists, open it and overwrite it. If it does not, create the given file.
来源：https://stackoverflow.com/questions/22552697/correspondence-between-procmon-and-createfile-disposition-options