About Extra Create Parameters (ECPs)

Extra create parameters (ECPs) are structures that can contain additional information for file creates. A create operation can have any number of ECPs, which are attached to the operation using an ECP_LIST. ECP_LIST is an opaque structure declared in ntifs.h.

There are two types of ECPs:

• System-defined ECPs. Operating system components use system-defined ECPs to associate additional information with the IRP_MJ_CREATE operation on a file.

• User-defined (or driver-defined) ECPs. Drivers can also use ECPs to process or associate additional information with the IRP_MJ_CREATE operation on a file in the following situations:

  • When a kernel-mode driver calls the FltCreateFileEx2 or IoCreateFileEx routine to create or open the file.

  • When a file system filter driver processes the IRP_MJ_CREATE operation for the file

The following sections describe how to define, attach, and use ECPs, and list system-defined ECPs.

• Attaching ECPs to IRP_MJ_CREATE operations that a kernel-mode driver originated

• Using ECPs to process IRP_MJ_CREATE operations in a file system minifilter

• User-defined ECPs

• System-defined ECPs