Hi,
I am trying to find a way how to report back NTSTATUS codes to the CloseHandle() call from the Windows passthrough file system driver example.
My understanding is that this can not be done in IRP_MJ_CLEANUP, as that is called after CloseHandle() system call already has been executed.
And it can’t be done in IRP_MJ_CLOSE, as that happens after IRP_MJ_CLEANUP.
So that leads to the question, where is the NTSTATUS code picked up from the kernel for the CloseHandle() system call?
Is there a MINOR signal in for instance IRP_MJ_WRITE that indicates that the last written byte has been called from Userspace?
For instance IRP_MN_COMPLETE (that the cache should be cleared)?
Please help me understand how to handle this…
Regards Tomas