Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:

confuse a about FLT_PREOP_SYNCHRONIZE usage?

tanda996tanda996 Member Posts: 24

my purpose is: monitor files data change in specified path. so, i implement like this:
in IRP_MJ_WRITE pre-op: i created a stream handle context and return FLT_PREOP_SYNCHRONIZE. In post-op: i check io status is STATUS_SUCCESS or not, and set the stream context variable for later use.
but, as MS said: "Minifilter drivers must never return FLT_PREOP_SYNCHRONIZE for asynchronous read or write operations." MS_link
this mean that i must not return FLT_PREOP_SYNCHRONIZE when current operation is Asyn in IRP_MJ_WRITE pre-op cabllack? Or Must not call FltRead|WriteFile (or similars) with async option in IRP_MJ_WRITE pre-op callback?

pls help me figure it out, thank you.


  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,678

    By returning FLT_PREOP_SYNCHRONIZE you're forcing all write operations to be synchronous. At a minimum this will kill performance.


  • tanda996tanda996 Member Posts: 24

    is there anyway to run post-op at APC_LEVEL or below in Async write operation?
    FltDoCompletionProcessingWhenSafe and FltQueueDeferredIoWorkItem documents also said must not use in IRP_MJ_WRITE.

  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,678

    What do you need to do in post that requires <= APC_LEVEL?


  • tanda996tanda996 Member Posts: 24

    in post-write, i get streamhandle context and set variables like bFileChanged (if IoStatus.Status success) etc.
    The FltGetStreamHandleContext run <= APC_LEVEL so, i'm searching for a method to catch Sync/Aync write action for specified paths that the driver monitoring.

  • Dave_BuchesDave_Buches Member Posts: 6
    edited January 2022

    You ought to be able to fetch your stream handle context in your pre-op callback, which you can then make available to your post-op callback via CompletionContext by returning FLT_PREOP_SUCCESS_WITH_CALLBACK from your pre-op callback. Naturally, this'll only work if your stream handle context is allocated from non-paged pool; you'll also want to release the reference in your post-op callback.

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 13-17 May 2024 Live, Online
Developing Minifilters 1-5 Apr 2024 Live, Online
Internals & Software Drivers 11-15 Mar 2024 Live, Online
Writing WDF Drivers 20-24 May 2024 Live, Online