Attaching ECPs to IRP_MJ_CREATE Operations that a Kernel-Mode Driver Originated

You must follow these steps to set up ECPs and attach the ECPs to an IRP_MJ_CREATE operation on a file:

  1. Call the FltAllocateExtraCreateParameterList or FsRtlAllocateExtraCreateParameterList routine to allocate memory for an ECP_LIST structure. The operating system does not automatically free ECP_LIST structures. Instead, after the ECP_LIST structure is allocated, the minifilter driver must eventually call the FltFreeExtraCreateParameterList or FsRtlFreeExtraCreateParameterList routine to free ECP_LIST.

  2. Call the FltAllocateExtraCreateParameter or FsRtlAllocateExtraCreateParameter routine to allocate paged memory pool for an ECP context structure and to generate a pointer to that structure.

  3. Call the FltInsertExtraCreateParameter or FsRtlInsertExtraCreateParameter routine to insert ECP context structures into the ECP_LIST structure.

  4. Call the IoInitializeDriverCreateContext routine to initialize an IO_DRIVER_CREATE_CONTEXT structure.

  5. Define the IO_DRIVER_CREATE_CONTEXT structure. In this definition, point the ExtraCreateParameter member of IO_DRIVER_CREATE_CONTEXT to the ECP_LIST structure.

  6. Call the FltCreateFileEx2 or IoCreateFileEx routine to attach the ECPs to the IRP_MJ_CREATE operation on the file. In this call, pass a pointer to the IO_DRIVER_CREATE_CONTEXT structure to the DriverContext parameter.

  7. Call the FltFreeExtraCreateParameterList or FsRtlFreeExtraCreateParameterList routine to free the ECP_LIST structure.