Attaching ECPs to IRP_MJ_CREATE operations that a kernel-mode driver originated
You must follow these steps to set up ECPs and attach the ECPs to an IRP_MJ_CREATE operation on a file:
Call FltAllocateExtraCreateParameterList or FsRtlAllocateExtraCreateParameterList to allocate memory for an ECP_LIST structure. The operating system does not automatically free ECP_LIST structures. Instead, the minifilter driver must eventually call FltFreeExtraCreateParameterList or FsRtlFreeExtraCreateParameterList to deallocate memory that was allocated for the ECP_LIST.
Call FltAllocateExtraCreateParameter or FsRtlAllocateExtraCreateParameter to allocate paged memory pool for an ECP context structure and to generate a pointer to that structure.
Call FltInsertExtraCreateParameter or FsRtlInsertExtraCreateParameter to insert ECP context structures into the ECP_LIST structure.
Call IoInitializeDriverCreateContext to initialize an IO_DRIVER_CREATE_CONTEXT structure.
Define the IO_DRIVER_CREATE_CONTEXT structure. In this definition, point the ExtraCreateParameter member of IO_DRIVER_CREATE_CONTEXT to the ECP_LIST structure.
Call FltCreateFileEx2 or IoCreateFileEx to attach the ECPs to the IRP_MJ_CREATE operation on the file. In this call, pass a pointer to the IO_DRIVER_CREATE_CONTEXT structure to the DriverContext parameter.
Call FltFreeExtraCreateParameterList or FsRtlFreeExtraCreateParameterList to free the ECP_LIST structure. These functions will also automatically free any remaining ECP list elements.