Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting... Please check out the Community Guidelines in the
Announcements and Administration Category, below.

Data->Iopb->TargetInstance vs FltObject->Instance

In mini filter callback routines, there two variable passed in which are
Both are type of PFLT_INSTANCE.

Same problem is also apply to the FILE_OBJECT type. They are two variables are passed in as argument which are;
Data->Iopb->TargetFileObject and

In "change" example, both are used calling different library function.

What is the difference and which one must be referenced by calling Flt.... library functions.




  • The differences are subtle:

    The Iopb one is a Parameter to the request and can be changed, just as any
    of the contents of the Iopb can. It is only valid for as long as the iopb
    is valid (so, for instance if you call a FltFunction (or any other function)
    passing in the FLT_CALLBACK_DATA structure and that function returns
    FLT_PREOP_PENDING then you MUST NOT look at that value any longer.

    The FltObjects one is a parameter to the Function call and so it valid for
    the entire function call. However it is strictly an input only function.

    My general habit is to always use the FltObjects ones (up to and including
    putting the values in an associated context). Most simple filters will use
    them interoperably. A quick scan of the change minifilter shows that it
    doesn't go into any of the danger areas, further is uses the
    FLT_CALLBACK_DATA as the "context" to subfunctions and so grabbing the
    parameters from it make sense structurally.
  • Hi Rod

    Before asking my question, I realized that one pair of them is defined as


    in FLT_RELATED_OBJECTS structure which is passed as "FltObjects" variable. But, the others are not defined as CONST in Data->Iopb. I can understand the difference but seems weird to me.

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!