First of all, thanks for all the previous help!
My minifilter is similar to simrep, but with one important difference. I am now battling with an issue in my PreCreate callback. For my code to work, I need to check the incoming filename for a match against a known filename. If it matches, I replace the name and redirect it (REPARSE). However, the complication is that I need to first check if the incoming filename exists (if it doesn’t already exist, I just pass through).
To check if the file already exists, I am using FltCreateFile, but I am starting to wonder if it is illegal to use this call from within the IRP_MJ_CREATE PreCreate callback to create the same file that originated the callback? I get a bug check, with not a lot of info, e.g:
BAD_POOL_HEADER (19)
STACK_TEXT:
a4c919cc 8054b583 00000019 00000020 e96080c8 nt!KeBugCheckEx+0x1b
a4c91a1c 8058338a e96080d0 00000000 89cda018 nt!ExFreePoolWithTag+0x2a3
a4c91b04 805bf450 89cda030 00000000 88c55f30 nt!IopParseDevice+0xba2
a4c91b7c 805bb9dc 00000000 a4c91bbc 00000040 nt!ObpLookupObjectName+0x53c
a4c91bd0 80576fc7 00000000 00000000 80513a01 nt!ObOpenObjectByName+0xea
a4c91d54 8054162c 00122d88 00122d60 00122db4 nt!NtQueryAttributesFile+0xf1
a4c91d54 7c90e4f4 00122d88 00122d60 00122db4 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00122db4 00000000 00000000 00000000 00000000 0x7c90e4f4
If I use a different filename, no bug check.
Any advice as to what I could be doing wrong, or some way to accomplish this?
Thanks!