There are two questions.
1 .
IRP_MJ_CREATE is very frequently called, when certain file is being opened
or closed, etc.
In this IRP_MJ_CREATE routine, can i distinguish file-creation(newly
creating operation) from other operations(file-open or file-close)?
2 .
I wanna create certain file in IRP_MJ_CREATE routine.
So, i create a file by using ZwCreateFile function and write by using
ZwWriteFile function.
By the way, a file(has strange name, same extension) is being created.
For example, If i create a text file(test.txt) in the popup menu,
¤±¤±¤±¤±¤±.txt file is being created, too.
What is the reason of this problem?
Thanks for any suggestions!
Sincerely!
Chang Sung, Jung.