windows I/O manager - IRP's classification in read-like and write-like
- by clyfe
I am writing a windows filesystem minifilter driver that must fail IRP's in a preoperation callback.
How can I find out from the callback parameters if the operation is read-like ( only reads data ) or it's write-like ( modifies data on the disk - write, delete etc ) ?
I'm thinking on:
Data->Iopb->TargetFileObject->ReadAccess
Data->Iopb->TargetFileObject->WriteAccess
But I'm not sure, I think thees are available only in postoperation callback. The documentation is really cumbersome.
Code sample:
FLT_PREOP_CALLBACK_STATUS
Fail (
__inout PFLT_CALLBACK_DATA Data,
__in PCFLT_RELATED_OBJECTS FltObjects,
__deref_out_opt PVOID *CompletionContext
)
{
FLT_PREOP_CALLBACK_STATUS status = FLT_PREOP_SUCCESS_NO_CALLBACK;
if ( IS WRITE_LIKE(Data, FltObjects) ) { // ??? HOW DO I FIND OUT????
if( FLT_IS_FASTIO_OPERATION(Data) ){
status = FLT_PREOP_DISALLOW_FASTIO;
} else {
status = FLT_PREOP_COMPLETE;
}
Data->IoStatus.Status = STATUS_ACCESS_DENIED;
Data->IoStatus.Information = 0;
return status;
}
return status;
}
