First, I am new here calling for help! Pardon me if I made this query in the wrong place/board and please help to direct me to the right one.
I am doing some kernel debugging/tracing, from my mini filter driver (on file system). And I am using RtlCaptureStackBackTrace() to obtain the stack trace when processing some IRPs, say like IRP_MJ_CREATE. However, from what I get I can only see NTCreateFile or IOCreateFile on bottom of KiSystemServiceCopyEnd(). However, by ProcMon tool, the stack showing for those captured IRPs seems to be more complete, like it will show it is some kernel function like NTSetInformationFile() that is calling through NTCreateFile() and generated this IRP.
What I am missing here? Or, is the RtlCaptureStackBackTrace() output incomplete? Like maybe the code was executed from another thread invoked by some APC? How can I obtain the complete call trace like Procmon do?
Please share your insight or enlighten me somehow. Sorry I am not an expert in Windows kernel so I may miss some obvious facts.