I am trying to query Information about a file using IRP_MJ_QUERY_INFORMATION(basically FILE_INFORMATION_CLASS) by calling FltPerformSynchronousIo .
I get 0xC0000010.
If I try using FltReadfile function my driver was crasing. In dump I could see raw reads. To confirm it I checked for VPB_MOUNTED flag. I called FltReadFile only if the flag is mounted. post that driver was not crashing.
Cant we use FltReadFile for raw device? will this API work only if the volume is mounted?
Is there any other API I can use to read for unmounted volume?
I’m not sure how to help here…
Let’s go back to the failing query. What are you trying to query? Where are you doing the query? And what does the File Object look like when it fails?