As far as i know, using FltCreateFile will cause the precreate post create requests to only go to the minifilters below mine.
But if i later use ZwReadFile/ZwWriteFile on the returned handle, will the pre/post read/write requests go to the top of the minifilter stack or just the minifilters that are below me?
I recommend you to read this post: (and the whole blog) https://fsfilters.blogspot.com/2010/02/issuing-io-in-minifilters-part-2-flt-vs.html?m=1 From the post: “Call FltCreateFile and get its own FILE_OBJECT. Once this create completes successfully, the minifilter can use Flt APIs or Zw APIs. The reason Zw APIs work well is because IO manager will use IoGetRelatedDeviceObject which will send the IO directly to filter manager’s device and then filter manager will find the targeting information associated with the FILE_OBJECT and will send it to the proper instance.”