Correspondence between ProcMon and CreateFile disposition options

Question

Process Monitor shows disposition option for CreateFile operation as "Open", "OpenIf", "Overwrite", "OverwriteIf" (may be something else). How does the options which contain "If" differ from those that do not? And to which CreateFile WinAPI function 'dwCreationDisposition' flags do they correspond?

Oblige

A quick look at those dispositions show that two of the descriptions include the phrase "only if" and the other two say "always", so I could make a highly educated guess... – Florid

Well, my little experiment showed that "CREATE_ALWAYS" (which description does not contain "only if") corresponds to "OverwriteIf". – Oblige

Answer 1

CreateFile dwCreationDisposition	NtCreateFile CreateDisposition	Process Monitor Disposition
n/a	FILE_SUPERSEDE (0)	Supersede (?)
OPEN_EXISTING (3)	FILE_OPEN (1)	Open
TRUNCATE_EXISTING (5)	FILE_OPEN (1)	Open
CREATE_NEW (1)	FILE_CREATE (2)	Create
OPEN_ALWAYS (4)	FILE_OPEN_IF (3)	OpenIf
n/a	FILE_OVERWRITE (4)	Overwrite (?)
CREATE_ALWAYS (2)	FILE_OVERWRITE_IF (5)	OverwriteIf

Playgoer

How does one differentiate between OPEN_EXISTING and TRUNCATE_EXISTING if Process Monitor shows for both Open? – Arse

Answer 2

CreateFile() is the winapi function. Process Monitor however patches the native operating system, it only resembles the winapi in passing. It is pretty similar to VMS, the operating system that Dave Cutler designed when he still worked at DEC. Process Monitor hooks NtCreateFile, follow the link to see the CreateDisposition argument values documented. Copied:

• FILE_SUPERSEDE. If the file already exists, replace it with the given file. If it does not, create the given file.
• FILE_CREATE. If the file already exists, fail the request and do not create or open the given file. If it does not, create the given file.
• FILE_OPEN. If the file already exists, open it instead of creating a new file. If it does not, fail the request and do not create a new file.
• FILE_OPEN_IF. If the file already exists, open it. If it does not, create the given file.
• FILE_OVERWRITE. If the file already exists, open it and overwrite it. If it does not, fail the request.
• FILE_OVERWRITE_IF. If the file already exists, open it and overwrite it. If it does not, create the given file.

Ainslee