Getting stream context in LoadImageNotifyRoutine

Is there a way to retrieve the streamcontext associated to the FIle_object passed in LoadImageNotifyRoutine? The FltGetStreamContext needs the Instance which I do not know where to get from.

FltGetVolumeFromFileObject followed by FltEnumerateInstances will get you the instance

1 Like