I noticed that the minispy sample code (6001.071220) defines IRP_MJ_NOTIFY_STREAM_FO_CREATION as one of the major function codes for fltmgr. I do not see anything in the documentation for it. Does anybody know if this is actually implemented?
Hi!
I noticed that the minispy sample
code (6001.071220) defines IRP_MJ_NOTIFY_STREAM_FO_CREATION
as one of the major function codes for fltmgr.? I do
not see anything in the documentation for it.? Does
anybody know if this is actually implemented?
If you go through the sample in WDK 6001.18001, you will notice that in RegistrationData.c file, IRP_MJ_NOTIFY_STREAM_FO_CREATION has been commented out. Also, the fltkernel.h also does not include IRP_MJ_NOTIFY_STREAM_FO_CREATION.
So, maybe it has been removed. However, since you saw it in some previous version of the WDK, i guess MS would have initially planned to notify the creation of stream file object. Since the documentation of IoCreateStreamFileObject says “it is difficult for filter drivers to reliably detect stream file object creation”, maybe MS would have initially planned to make it EASY for filter drivers to reliably detect stream FO creation. 
Again, it would be better to get a response from MS on this.
Regards,
Ayush Gupta
http://windows-internals.blogspot.com/
Add more friends to your messenger and enjoy! Go to http://messenger.yahoo.com/invite/