Two method:
1. Add a special flag on you call to zwCreateFile/zwCloseFile so that your driver can distinct them.
2. Create file and close file directly use IRP to lower driver. You must construct IRP that you want to use. It is very difficult because many things is undocument. But it may be work.
|