About Extra Create Parameters (ECPs)
Extra create parameters (ECPs) are structures that can contain additional information for file creates. A create operation can have any number of ECPs, which are attached to the operation using an ECP_LIST. ECP_LIST is an opaque structure declared in ntifs.h.
There are two types of ECPs:
System-defined ECPs. Operating system components use system-defined ECPs to associate additional information with the IRP_MJ_CREATE operation on a file.
User-defined (or driver-defined) ECPs. Drivers can also use ECPs to process or associate additional information with the IRP_MJ_CREATE operation on a file in the following situations:
When a kernel-mode driver calls the FltCreateFileEx2 or IoCreateFileEx routine to create or open the file.
When a file system filter driver processes the IRP_MJ_CREATE operation for the file
The following sections describe how to define, attach, and use ECPs, and list system-defined ECPs.