Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results


More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

IRP_MJ_READ from File System Mini Filter

samalexander620samalexander620 Member Posts: 6

I am developing a file system mini filter driver, where I try to read a file by allocating/sending an IRP with major function IRP_MJ_READ.
But, IoCallDriver fails with status = STATUS_INVALID_USER_BUFFER (0XC00000E8). Below are the setup details & steps.

Setup Details

OS : Windows 10 20h1
WDk SDK : Vs 2019 with 10.0.19041
Filter LoadOrderGroup : FSFilter Encryption
Altitude : 141000

Steps in sending IRP

IoCreateFileSpecifyDeviceObjectHint - Send a create request for the file
ObReferenceObjectByHandle - Get FILE_OBJECT for the file.
FltGetVolumeFromFileObject - Get the Volume that a given file stream resides on
FltGetDeviceObject - Get pointer to the Filter Manager's volume device
object (VDO) for a given volume
IoGetDeviceAttachmentBaseRef - Get the lowest-level device object in a file system driver stack.
IoAllocateIrp - Allocate IRP
IoSetCompletionRoutineEx - Set a completion routine.
IoCallDriver - Send the IRP to the lowest-level device object
obtained using IoGetDeviceAttachmentBaseRef)


  1. Is it possible to read a file by sending IRP_MJ_READ (if we have a FILE_OBJECT )

  2. FILE _OBJECT does not give the length of file. How can we get it?

  3. What value we need to give "irpStack->Parameters.Read.Key"

  4. What need to be done if the IocallDriver returns STATUS_INVALID_USER_BUFFER (0XC00000E8)

Please let me know your inputs



  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,215

    It is ‘misguided’ to use any of the IoXXXX operations you are calling, they all have FltXXX homologs (or are not needed). Also what you are doing won’t work within the filter manager architecture (which is why there are Flt versions)

    FltCreateFileEx(....) FltReadFile()

  • Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 450
    via Email
    Oh, how lucky you are that you never needed to go out of FltXxx domain :)
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Writing WDF Drivers 24 January 2022 Live, Online
Internals & Software Drivers 7 February 2022 Live, Online
Kernel Debugging 21 March 2022 Live, Online
Developing Minifilters 23 May 2022 Live, Online