Chapter 13: More about File Management

Because of the importance of the CreateFile function, I decided to dedicate a separate chapter to it. Here, I demonstrate the variety of capabilities of this versatile function. I also cover some other application program interface (API) functions related to file management. Besides files, I cover some other input/output devices.

A Detailed Description of the CreateFile Function

Windows operates with the concept of devices. This approach allows it to unify the processes of obtaining and transmitting information, which means that the same API functions are used for data reception and transmission. Table 13.1 lists these devices.

Table 13.1: Main devices for information exchange in the Windows operating system

Device name	Explanation
Pipes	There are two types of pipes: named and anonymous. Named pipes are used for connecting the source and destination through the local area network. Anonymous pipes play the same role within the limits of the same computer.
Directories	Directories exist as the structural units of file systems. Direct information exchange with a directory can change its attributes (e.g., the file compression attribute for the directory contents).
Communications resources	Mainly , these are devices such as COM and LPT ports, which exchange information with printers, modems, etc.
Console	Text screen and information input/output into the text screen.
Logical	This type includes hard disk partitions and floppy drives . Formatting is the main operation that can cause data exchange.
Mailslots	This allows the transmission of information from several sources to the same destination within the limits of a single computer, a local area network, or domain.
Sockets	Sockets are devices that exchange information between two computers supporting the sockets mechanism.
Files	These devices permanently store large volumes of information.
Physical	These provide access to hard disk structures (e.g., a partition table or structures residing on a partition).

Now, having briefly considered the contents of Table 13.1, it's time to discover the most interesting fact: most of the devices listed in this table can be opened using the CreateFile function. Clearly, this function deserves a detailed description and your maximum attention.

In this section, you will consider this function in the file management context. Because the first argument of the CreateFile function is the fully qualified filename (the path to the file and its name), it is necessary to briefly consider the rules that must be followed when forming this string parameter.

• For creating a filename, the characters of the current code page with codes larger than 31 must be used.

• The components of the filename are delimited by the / and \ symbols. The name of the file residing on a shared network resource must start with the \\server\share prefix. Here, server is the name of network computer, and share is the name of the shared network resource (the universal naming convention name).

• The . character designates the current directory, and .. stands for the parent directory. Additionally, the last . character in the string separates the filename from the filename extension used by the operating system for recognizing the file type.

• Symbols such as <, >, : ,/, , and \ are invalid for filenames and directory names .

• Names of devices (e.g., aux , con , and prn ) cannot be used as filenames.

• A fully qualified filename must be represented by a zero- terminated string. The maximum length of such a string is defined by the MAX_LEN system constant, which is equal to 260 characters. To use longer strings, it is necessary to employ Unicode encoding and the appropriate version of the CreateFile function. In this case, the string must start with the \\?\ prefix, and the string length can reach 32,000 characters.

• Functions that use filenames as parameters are insensitive to the case of English characters.

• Reserved keywords such as CLOCK$ , NUL , COM1 , and LPT1 cannot be used as names of files or directories.

Note 

All devices listed in Table 13.1 are representatives of the kernel objects class. To be more precise, they become kernel objects after they are created using CreateFile or any similar function (thus, the CreateFile name reflects the essence of the problem). Structures describing objects are stored in the kernel area, which means that they are protected against access by user programs. All such objects are accessed using the descriptor returned when the object is created. Note that the descriptor describes the object only within the limits of the given process.

Now, it is time to consider the parameters accepted by the CreateFile function.

• First parameter Address of the string containing the filename.

• Second parameter Defines how the data will be exchanged with this device.

  The following values are possible:

  • It is assumed that there will be no data read or write operations. Only file parameters will be changed (time characteristics, attributes, etc.).

  • GENERIC_READ = 80000000h Data read from the file is expected.

  • GENERIC_WRITE = 40000000h Data write into the file is expected.

  • GENERIC_READ GENERIC_WRITE This combination allows data read and data write operations.

  • Additionally, this parameter can contain several flags that specify access rights to this file (or to another device). All of these flags are listed in the documentation but are rarely used. For example, the DELETE = l0000h value specifies that the file (object) can be deleted.

• Third parameter This parameter specifies the type of access to the file. To be more precise, this parameter specifies the desired access, because in practice the file or object access can be limited because the required object might already be opened by another process. The possible values of this parameter are as follows :

  • Other processes cannot have exclusive access to this file. If the file is already opened by another process, this value of the parameter won't allow you to open the file elsewhere.

  • FILE_SHARE_READ = 1 This setting enables subsequent open operations on the object to request read access. Otherwise , other processes cannot open the object if they request read access.

  • FILE_SHARE_WRITE = 2 This setting enables subsequent open operations on the object to request write access. Otherwise, other processes cannot open the object if they request write access.

  • FILE_SHARE_WRITE FILE_SHARE_READ This value allows subsequent open operations on the object to request read and write access. The operation will fail only if another process has already opened this object in exclusive mode.

  • FILE_SHARE_DELETE = 4 This allows other processes to access the object and delete it.

• Fourth parameter This parameter points to a special structure called SECURITY_ATTRIBUTES . This structure allows you to specify security information and determine whether the descriptor returned by the CreateFile function must be inherited. Most frequently, this parameter is set to NULL . This means that the descriptor is not inherited. Consider the SECURITY_ATTRIBUTES structure:

   SECURITY_ATTRIBUTES STRUC     L                DD ?     DESC             DD ?     INHER            DD ?     SECURITY_ATTRIBUTES ENDS 

  As you can see, the structure includes only three fields. The first field determines the length of the entire structure; in this case, it must be 12 bytes. The second field is the inheritable descriptor. The third field takes the values 0 or 1. If the field value is 1, then all child processes will inherit the descriptor.

• Fifth parameter This parameter defines the behavior of the CreateFile function if the file lacks the specified name.

  • CREATE_NEW = 1 This parameter instructs the system to create a new file if the file with the specified name is missing; otherwise, the function doesn't execute.

  • CREATE_ALWAYS = 2 This parameter instructs the system to create the file in any case. If the file with the specified name exists, it will be overwritten.

  • OPEN_EXISTING = 3 This setting instructs the system to open the file with the specified name if it exists.

  • OPEN_ALWAYS = 4 This parameter instructs the system to open the file if it exists, or to create a new file if the file with the specified name is missing.

  • TRUNCATE_EXISTING = 5 This parameter instructs the system to open the existing file and reset its size to zero. If the file is missing, the function doesn't execute.

• Sixth parameter This parameter is mainly used for defining the attributes of the file being created (the attribute list was provided in Chapter 11). Additionally, here you can specify flags that allow the system to optimize caching algorithms. There are also other flags, the values of which are as follows:

  • FILE_FLAG_NO_BUFFERING = 20000000h The file must be accessed without data buffering.

  • FILE_FLAG_SEQUENTIAL_SCAN = 8000000h If this flag is set, the system assumes that the file is accessed sequentially. Accordingly, the maximum reading rate can be achieved with sequential reading.

  • FILE_FLAG_RANDOM_ACCESS = l0000000h This flag is used for indicating that the system must not read large volumes of redundant data. It should be used if frequent searching in the file is expected.

  • FILE_FLAG_WRITE_THROUGH = 80000000h This flag disables write-through caching when writing into a file. In this case, all changes are written immediately to the disk.

  • FILE_FLAG_DELETE_ON_CLOSE = 4000000h If this flag is set, then the operating system will delete this file after all its descriptors are closed.

  • FILE_FLAG_BACKUP_SEMANTICS = 2000000h This flag is used in backup software.

  • FILE_FLAG_POSIX_SEMANTICS = l000000h This instructs the system to take into account the case of characters when creating or opening a file.

  • FILE_FLAG_OPEN_REPARSE_POINT = 200000h This flag instructs the system to ignore the presence of the reparse point (see Chapter 11).

  • FILE_FLAG_OPEN_NO_RECALL = l00000h If this flag is set, the system doesn't restore the file from remote storage (see Chapter 11).

  • FILE_FLAG_OVERLAPED = 4000000Oh This flag sets asynchronous data exchange with the device. This topic will be covered later in this chapter.

• Seventh parameter This parameter can contain the descriptor of a file already opened. When the file that already exists is opened, the attributes defined by this parameter are used. Usually this parameter is set to NULL .

  If the function fails, it returns the INVALID_HANDLE_VALUE = ˆ 1 .