how can know the current is play or record

in a audio filter driver, when render or capture a stream , it can monitor IRP_MJ_CREATE. but , decode the irp, it can’t decide play or record.

how can do ?

I not entirely sure what you mean by “audio filter driver”. There is very little point in filtering an audio driver, because the audio traffic does not pass through the I/O system.

You are correct that the IRP_MJ_CREATE doesn’t tell you the direction (although the default data format is embedded in the file name). Remember that the Audio Engine opens file handles for the filter, for the topology endpoints, and for the streaming endpoints. There are a LOT of file handles into an audio driver.

The only way you can tell which direction things are going is to filter the pin property requests and monitor the outputs. The KSPROPERTY_PIN_DATAFLOW property in KSPROPSETID_Pin returns KSPIN_DATAFLOW_IN for a render/speaker pin, and KSPIN_DATAFLOW_OUT for a capture/microphone pin.