Attaching ECPs to IRP_MJ_CREATE Operations that a Kernel-Mode Driver Originated
You must follow these steps to set up ECPs and attach the ECPs to an IRP_MJ_CREATE operation on a file:
Call the FltAllocateExtraCreateParameterList or FsRtlAllocateExtraCreateParameterList routine to allocate memory for an ECP_LIST structure. The operating system does not automatically free ECP_LIST structures. Instead, after the ECP_LIST structure is allocated, the minifilter driver must eventually call the FltFreeExtraCreateParameterList or FsRtlFreeExtraCreateParameterList routine to free ECP_LIST.
Call the FltCreateFileEx2 or IoCreateFileEx routine to attach the ECPs to the IRP_MJ_CREATE operation on the file. In this call, pass a pointer to the IO_DRIVER_CREATE_CONTEXT structure to the DriverContext parameter.