shared-folder

Which kind of kernel function is called, When i open a file or directory
of shared-folder.
Just only zwopenfile/zwcreatefile or others?
I wanna control access to a file of directory of my shared-folder.
Which function should i hook?

Any answer’ll be great appreciated!

Best regards.
csjung.