PERFINFO_FILE_CREATE - NtDoc

#ifndef _NTWMI_H

//
// File system operations.
//
// Since these are also logged using event descriptors, it is important to
// watch padding in the structure due to alignment or specify the appropriate
// pack pragma.
//

typedef struct _PERFINFO_FILE_CREATE
{
    ULONG_PTR Irp;
    ULONG_PTR FileObject;
    ULONG IssuingThreadId;
    ULONG Options;
    ULONG Attributes;
    ULONG ShareAccess;
    WCHAR OpenPath[1];
} PERFINFO_FILE_CREATE, *PPERFINFO_FILE_CREATE;

#endif
View code on GitHub