none
How to get irp and irpSp in the PFLT_POST_OPERATION_CALLBACK of IRP_MJ_CREATE RRS feed

  • Question

  • All, After reading IRP_MJ_CREATE doc, I found there are many usage of irp object. 

    like:

    Irp->AssociatedIrp.SystemBuffer

    Irp->Flags

    ...

    But how can I get the irp and irpSp object in the PFLT_POST_OPERATION_CALLBACK ? 

    Say you have a the callback like this.

    FLT_POSTOP_CALLBACK_STATUS
    CreateBackUpFile_WhenPostCreatedCallback (
        _Inout_ PFLT_CALLBACK_DATA Data,
        _In_ PCFLT_RELATED_OBJECTS FltObjects,
        _In_ PVOID CompletionContext,
        _In_ FLT_POST_OPERATION_FLAGS Flags
        )

    Thanks.


    • Edited by wq187731 Tuesday, September 10, 2013 9:43 AM
    Tuesday, September 10, 2013 9:43 AM

Answers

  • You can get this data easily in the preoperation callback, since the FLT_IO_CALLBACK_DATA contains all the needed information.  What you need to do is store the data in the completion context and then use it.  Note: this is not the raw IRP, but there is no reason to access it, and a lot of reasons not to access the IRP (you can messup the mini-filter support code if you do).


    Don Burn Windows Filesystem and Driver Consulting Website: http://www.windrvr.com Blog: http://msmvps.com/blogs/WinDrvr

    Tuesday, September 10, 2013 11:29 AM