whenever there are certain actions say folder opening, file creation, etc there are a bunch of IRP_MJ_CREATE requests raised by various exe's. I have found the process which generates it using the process id. Let us say some 20 IRO_MJ_CREATE requests have been raised for creating a new file, Now is there something common in those 20 IRP requests generated stating that it was meant for file creation.
It looks like you're new here. If you want to get involved, click one of these buttons!
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||20 Apr 2020||LIVE ONLINE|
|Writing WDF Drivers||11 May 2020||LIVE ONLINE|
|Internals & Software Drivers||28 Sept 2020||Dulles, VA|