Hello, sergey77666, you wrote: S> optionally "global", any goes unique , at IRP_MJ_READ, IRP_MJ_WRITE and IRP_MJ_CLEANUP (file closing). S> It is just necessary to distinguish an open file from others, and to do it by name unreliably. Analog in minifilters are FILE_OBJECT. Two different FILE_OBJECT will be result of two different operations Nt/ZwCreateFile. Also I recommend to glance here: Managing Contexts in a Minifilter Driver https://docs.microsoft.com/en-us/window
ter-driver If it is short: contexts allow to connect the arbitrary information block to any object, i.e. with FILE_OBJECT, with a flow, with a file, volume (volume), the minifilter (instance) etc. For example, using stream context, it is possible to learn, when two different FILE_OBJECT specify in the same file (to be exact speaking, on the same file flow). S> the Sediment these filters, were better. Well we begin that years ten as (with x64 Windows Vista) simply bluntly are not functional because of Patch Guard.