Question

Many Zw* functions that work with files (such as ZwCreateFile) need to be called at PASSIVE_LEVEL with APCs enabled: http://msdn.microsoft.com/en-us/library/ff566424%28VS.85%29.aspx. This is because, internally, I/O operations are asynchronously and the completion of an operation is delivered through an APC (correct me if I’m wrong).

However, the documentation for similar functions from a mini-filter (such as FltCreateFile, FltReadFile, etc) does not specify that APCs should be enabled. Is it safe to call FltCreateFile/FltReadFile with APCs disabled?

Thanks!

Answer 1

You can call ZwCreateFile and FltCreateFile only at PASSIVE_LEVEL and with special kernel APCs enabled (normal kernel APCs can be disabled).