Windows kernel file object

For example, event handles can have set or wait access or both , file handles can have read or write access or both , and so on.

For more information, see Securable Objects. In the following illustration, an application creates an event object. The CreateEvent function creates the event object and returns an object handle. After the event object has been created, the application can use the event handle to set or wait on the event. The handle remains valid until the application closes the handle or terminates.

Most kernel objects support multiple handles to a single object. For example, the application in the preceding illustration could obtain additional event object handles by using the OpenEvent function, as shown in the following illustration.

This method enables an application to have handles with different access rights. For example, Handle 1 might have set and wait access to the event, and Handle 2 might have only wait access.

If another process knows the event name and has security access to the object, it can create its own event object handle by using OpenEvent. The creating application could also duplicate one of its handles into the same process or into another process by using the DuplicateHandle function.

In this article. Specifies whether a second process can open a file for read, write, or delete access while the initial process is still accessing it. Pointer to the volume parameter block, or VPB. Identifies a root structure that describes a mapped file. Improve this answer. NigelK NigelK 7, 2 2 gold badges 29 29 silver badges 28 28 bronze badges.

This certainly seems to be accurate. I just haven't found this documented anywhere. See also here: reverseengineering. Sign up or log in Sign up using Google. Sign up using Facebook. Sign up using Email and Password. Post as a guest Name. Email Required, but never shown. The event lock is used to control synchronous access to the file object. Applicable only to file objects that are opened for synchronous access.

An opaque member used by the system to hold an event object for the file object. An opaque pointer to completion port information port pointer and key associated with the file object, if any.

An opaque pointer to the file object's file object extension FOBX structure. The FOBX structure contains various opaque contexts used internally as well as the per-file object contexts available through FsRtl Xxx routines.

Drivers can use the FsContext and FsContext2 members to maintain driver-determined state about an open file object. Skip to main content. This browser is no longer supported. Download Microsoft Edge More info. Contents Exit focus mode. Please rate your experience Yes No. Any additional feedback? File system drivers share this member across multiple opens to the same data stream.