IoCheckFileObjectOpenedAsCopySource function (ntifs.h)
The IoCheckFileObjectOpenedAsCopySource routine checks whether a file was previously opened with copy intent as a source file.
Syntax
BOOLEAN IoCheckFileObjectOpenedAsCopySource(
[in] PFILE_OBJECT FileObject
);
Parameters
[in] FileObject
Pointer to the source file object to check for copy intent.
Return value
IoCheckFileObjectOpenedAsCopySource returns TRUE if the file object represents a source file that was previously opened with copy file intent; otherwise it returns FALSE. A return value of TRUE only signals the intent at create time; it does not mean that all operations on the file object are all part of copies.
Remarks
The following example shows how to check if a file object was opened with copy intent.
typedef
BOOLEAN (*PIO_CHECK_FILE_OBJECT_OPENED_AS_COPY_SOURCE)(
_In_ PFILE_OBJECT FileObject
);
typedef
BOOLEAN (*PIO_CHECK_FILE_OBJECT_OPENED_AS_COPY_DESTINATION)(
_In_ PFILE_OBJECT FileObject
);
PIO_CHECK_FILE_OBJECT_OPENED_AS_COPY_SOURCE IoCheckFileObjectOpenedAsCopySource;
PIO_CHECK_FILE_OBJECT_OPENED_AS_COPY_DESTINATION IoCheckFileObjectOpenedAsCopyDestination;
// First resolve the API
RtlInitUnicodeString(&RoutineName, L"IoCheckFileObjectOpenedAsCopySource");
IoCheckFileObjectOpenedAsCopySource = (PIO_CHECK_FILE_OBJECT_OPENED_AS_COPY_SOURCE)MmGetSystemRoutineAddress(&RoutineName);
RtlInitUnicodeString(&RoutineName, L"IoCheckFileObjectOpenedAsCopyDestination");
IoCheckFileObjectOpenedAsCopyDestination = (PIO_CHECK_FILE_OBJECT_OPENED_AS_COPY_DESTINATION)MmGetSystemRoutineAddress(&RoutineName);
// Now use the API
IoCheckFileObjectOpenedAsCopySource(FltObjects->FileObject);
IoCheckFileObjectOpenedAsCopyDestination(FltObjects->FileObject);
See Kernel-mode file copy and detecting copy file scenarios for more information.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client | Windows 11, version 22H2 |
| Header | ntifs.h (include Wdm.h, Ntddk.h, Ntifs.h) |
| IRQL | PASSIVE_LEVEL |