Question about ECP

NTFSD
1

Hi all,

I’ve use ECP to trace reparse based on this sample by Alex:
http://fsfilters.blogspot.ae/2012/02/reparsing-to-different-volume-in-win7.html
However, I’m not reparsing to different volume, so I’me not calling fltcreateFile and use STATUS_REPARSE.

I need to know if a IRP_MJ_READ was related to a reparsed create or not.

Is that ECP still present when IRP_MJ_READ is processed or I should obtain the info in pre-create and pass it using a stream context?

2

ECP == Extra “Create” Parameter. They are only present during IRP_MJ_CREATE
processing.

A stream context sounds like a reasonable approach.

-scott
OSR
@OSRDrivers

wrote in message news:xxxxx@ntfsd…

Hi all,

I’ve use ECP to trace reparse based on this sample by Alex:
http://fsfilters.blogspot.ae/2012/02/reparsing-to-different-volume-in-win7.html
However, I’m not reparsing to different volume, so I’me not calling
fltcreateFile and use STATUS_REPARSE.

I need to know if a IRP_MJ_READ was related to a reparsed create or not.

Is that ECP still present when IRP_MJ_READ is processed or I should obtain
the info in pre-create and pass it using a stream context?

3

thanks scott