Hello,
I use IoCreateFileSpecifyDeviceObjectHint in legacy file system filter to retrieve a handle to a specific file. Because I pass the next DeviceObject in the stack it doesn’t produce and IRP_MJ_CREATE again through my driver. The question is when I call ZwClose on that handle does it have the same behaviour or I am going to get my own IRP_MJ_CLOSE?
Thanks.
Apparently this is said on MSDN :
“File system filter drivers call IoCreateFileSpecifyDeviceObjectHint to send a create request only to a specified device object, the filters attached below it, and the file system. Filters attached above the specified device object in the driver stack do not receive the create request. The same is true for any cleanup or close requests on the file object that is created by IoCreateFileSpecifyDeviceObjectHint.”
So that answers my question I guess.