Hi guys ,
I'm writnig a filter driver . I want to work with files in kernel mode ,
but the problem is when I call ZwCreateFile / ZwClose to work on a file ,
these Zw APIs create an MJ_CREATE/CLOSE IRP and comes back to my dispatch routine . So what should i do ?
Enjoy ur time...