I’ve got a minifilter and a legacy filter running in my project. When IRP_MJ_CREATE (pre op) happens I see both these filters on the stack when I set a breakpoint.
I’ve got symbols ,etc loaded for both these drivers and I can see everything just fine.
I’ve observed that when the legacy filter was called at IRP_MJ_CREATE the legacy filter has a DEVICE_OBJECT with a DeviceObject->DeviceType = 8 (FILE_DEVICE_DISK_FILE_SYSTEM) .
At the same time , the minifilter project’s IRP_MJ_CREATE callback has FltObjects->FileObject->DeviceObject->DeviceType = 7 (FILE_DEVICE_DISK) .
I don’t know why this is happening, or what it means. I do know that I had hoped the 2 DeviceType’ s would be the same.
Is there a reason for this?
Larry