I am writing a program for ClamWin real-time scanner with WDK.
Now I can get the file path when the file mapped into memory.

But I don't know how to call ClamWin engine to scan the file.

Use CreateProcess() to call clamscan.exe is too slow.

And I can't compile the ClamWin source code.

Can I have a direct way to call ClamWin engine?

https://oss.netfarm.it/clamav/ https://oss.netfarm.it/clamav/
there are packages with libclamav.lib and clamav.h, you can use them to have access to clamav api
you can look at clamscan sources to see how to use api
perhaps you need to have an userspace program that talks with kernel driver

there is a prototype of a clamav server using pipes that talks with a kernel driver at:
https://clamwin.svn.sourceforge.net/viewvc/clamwin/trunk/clamwind/ https://clamwin.svn.sourceforge.net/viewvc/clamwin/trunk/clamwind/

Thanks
I look at the source code and know how to call engine
real-time scan can work now