title: How to capture PathFileExists in minifilter driver?
body: <p>I am writing a windows minifilter driver for Win7 and later.</p>
  
  <p>My goal is to <strong>capture</strong> the <strong>PathFileExists</strong> API,both in minifilter pre-callback and post-callback.</p>
  
  <p>The <strong>PathFileExists</strong> API will call <strong>QueryOpen</strong> in kernel space(I found this by procmon.exe),but my minifilter driver can NOT aware the <strong>QueryOpen</strong>'s 
   operation ,so sad :K .</p>
  
  <p>After much more googling work, I improve my driver code, adding the following code to the <strong>FLT_OPERATION_REGISTRATION</strong> structure.</p>
  
  <pre><code>{
      IRP_MJ_QUERY_OPEN,
      0,
      mnflt_PreOperation,
      mnflt_PostOperation
  },
  </code></pre>
  
  <p>But.....<strong>It's still NOT work.</strong> The callback function <strong>mnflt_PreOperation</strong> and <strong>mnflt_PostOperation</strong> had not been called when the <strong>PathFileExists</strong> API  running.</p>
  
  <p>Do I miss something or completely NOT in the right way?</p>
  
  <p>Thanks for any help that can be given!</p>