Process Monitor shows disposition option for CreateFile operation as "Open", "OpenIf", "Overwrite", "OverwriteIf" (may be something else). How does the options which contain "If" differ from those that do not? And to which CreateFile WinAPI function 'dwCreationDisposition' flags do they correspond?
Asked
Active
Viewed 5,722 times
11
-
A quick look at those dispositions show that two of the descriptions include the phrase "only if" and the other two say "always", so I could make a highly educated guess... – Damien_The_Unbeliever Mar 21 '14 at 07:31
-
Well, my little experiment showed that "CREATE_ALWAYS" (which description does not contain "only if") corresponds to "OverwriteIf". – user10101 Mar 21 '14 at 08:07
2 Answers
11
CreateFile() is the winapi function. Process Monitor however patches the native operating system, it only resembles the winapi in passing. It is pretty similar to VMS, the operating system that Dave Cutler designed when he still worked at DEC. Process Monitor hooks NtCreateFile, follow the link to see the CreateDisposition argument values documented. Copied:
FILE_SUPERSEDE. If the file already exists, replace it with the given file. If it does not, create the given file.FILE_CREATE. If the file already exists, fail the request and do not create or open the given file. If it does not, create the given file.FILE_OPEN. If the file already exists, open it instead of creating a new file. If it does not, fail the request and do not create a new file.FILE_OPEN_IF. If the file already exists, open it. If it does not, create the given file.FILE_OVERWRITE. If the file already exists, open it and overwrite it. If it does not, fail the request.FILE_OVERWRITE_IF. If the file already exists, open it and overwrite it. If it does not, create the given file.
Ian Boyd
- 246,734
- 253
- 869
- 1,219
Hans Passant
- 922,412
- 146
- 1,693
- 2,536
7
| CreateFile dwCreationDisposition | NtCreateFile CreateDisposition | Process Monitor Disposition |
|---|---|---|
| n/a | FILE_SUPERSEDE (0) | Supersede (?) |
| OPEN_EXISTING (3) | FILE_OPEN (1) | Open |
| TRUNCATE_EXISTING (5) | FILE_OPEN (1) | Open |
| CREATE_NEW (1) | FILE_CREATE (2) | Create |
| OPEN_ALWAYS (4) | FILE_OPEN_IF (3) | OpenIf |
| n/a | FILE_OVERWRITE (4) | Overwrite (?) |
| CREATE_ALWAYS (2) | FILE_OVERWRITE_IF (5) | OverwriteIf |
2012rcampion
- 169
- 11
Ian Boyd
- 246,734
- 253
- 869
- 1,219
-
How does one differentiate between OPEN_EXISTING and TRUNCATE_EXISTING if Process Monitor shows for both Open? – Alois Kraus May 10 '23 at 07:31