Question about IRP_MJ_CREATE?

Question

0.00/5 (No votes)

See more:

Please, i need help.
My graduation project is an antivirus & my part is related to File System Filter Driver.
We decided that to scan the file as soon as doubled click on it or single click on it.
My question is when i doubled click on the file or just make refresh in the directory contains the file ,i noticed that IRP_MJ_CREATE Dispatch function called more than one time [4 times ] and i cant understand why that happened.
what i think when i doubled click on the file one Calling to IRP_MJ_CREATE is directed to its Dispatch routines [thats what i think ].
please,any one answer me & explain how many times IRP_MJ_CREATE called and why????
Thanks.

Posted 30-Mar-11 2:15am

ahmed 88

Add a Solution

1 solution

Add a Solution

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Kurt Degiorgio · Answer 1 · 2011-04-06T01:51:00

this not gonna be an easy project file system drivers are very complicated to write and one needs a in depth knowledge of windows to even begin, i do not think it is a good idea to can based on clicks i mean you can do that in user mode, normally an anti virus would intercept read/write calls to the hard disk (for active scanning) or scan a directory (can be done in user mode) and analyse the contents of the file.

Question about IRP_MJ_CREATE?

1 solution

Solution 1

Add your solution here

Preview 0

Question about IRP_MJ_CREATE?

1 solution

Solution 1

Add your solution here

Preview 0

Existing Members

...or Join us