Attaching ECPs to IRP_MJ_CREATE operations that a kernel-mode driver originated

You must follow these steps to set up ECPs and attach the ECPs to an IRP_MJ_CREATE operation on a file:

1. Call FltAllocateExtraCreateParameterList or FsRtlAllocateExtraCreateParameterList to allocate memory for an ECP_LIST structure. The operating system does not automatically free ECP_LIST structures. Instead, the minifilter driver must eventually call FltFreeExtraCreateParameterList or FsRtlFreeExtraCreateParameterList to deallocate memory that was allocated for the ECP_LIST.

2. Call FltAllocateExtraCreateParameter or FsRtlAllocateExtraCreateParameter to allocate paged memory pool for an ECP context structure and to generate a pointer to that structure.

3. Call FltInsertExtraCreateParameter or FsRtlInsertExtraCreateParameter to insert ECP context structures into the ECP_LIST structure.

4. Call IoInitializeDriverCreateContext to initialize an IO_DRIVER_CREATE_CONTEXT structure.

5. Define the IO_DRIVER_CREATE_CONTEXT structure. In this definition, point the ExtraCreateParameter member of IO_DRIVER_CREATE_CONTEXT to the ECP_LIST structure.

6. Call FltCreateFileEx2 or IoCreateFileEx to attach the ECPs to the IRP_MJ_CREATE operation on the file. In this call, pass a pointer to the IO_DRIVER_CREATE_CONTEXT structure to the DriverContext parameter.

7. Call FltFreeExtraCreateParameterList or FsRtlFreeExtraCreateParameterList to free the ECP_LIST structure. These functions will also automatically free any remaining ECP list elements.