windows – ProcMon和CreateFile处理选项之间的对应关系

Process Monitor将CreateFile操作的处置选项显示为“Open”,“OpenIf”,“Overwrite”,“OverwriteIf”(可能是其他内容).包含“If”的选项与不包含的选项有何不同？它们对应于哪个 CreateFile WinAPI函数’dwCreationdisposition’标志？

| CreateFile            | NtCreateFile          | Process Monitor |
| dwCreationdisposition | Createdisposition     | disposition     |
|-----------------------|-----------------------|-----------------|
| n/a                   | FILE_SUPERSEDE (0)    | Supersede (?)   |
| OPEN_EXISTING (3)     | FILE_OPEN (1)         | Open            |
| TruncATE_EXISTING (5) | FILE_OPEN (1)         | Open            |
| CREATE_NEW (1)        | FILE_CREATE (2)       | Create          |
| OPEN_ALWAYS (4)       | FILE_OPEN_IF (3)      | OpenIf          |
| n/a                   | FILE_OVERWRITE (4)    | Overwrite (?)   |
| CREATE_ALWAYS (2)     | FILE_OVERWRITE_IF (5) | OverwriteIf     |

原文地址：https://www.jb51.cc/windows/365314.html