minifilter IRP_MJ_CREATE

NTFSD
1

Hi all,
I am a newbie for windows driver development. I am creating a minifilter
for encrypting file system.
I want to do some processing whenever IRP_MJ_CREATE is called, But I
noticed that whenever I create a new file,
my callback operations corresponding to IRP_MJ_CREATE are called twice. Why
its getting called twice?
I am unable to figure out this strange behavior.

–
Kapil Bhadke

2

Take a look at FltCreateFile(). You can use that to prevent recursion of file operations.

This link is a great place to start to learn more about minifilters:

http://www.microsoft.com/whdc/driver/filterdrv/default.mspx

Specifically, look at Minifilter Generated IOs.