FsRtlRegisterFileSystemFilterCallbacks and volume instance

NTFSD
1

Hi all,

I think this is a silly question, but I can?t solve it. I am trying to write a minifilter to catch all opened memory mapped files. I have found on this forum the function FsRtlRegisterFileSystemFilterCallbacks(), but my problem is how can I obtain the volume instance of the file being opened?

I have seen this functions returns a File Object, but I also need the volume instance to retrieve its stream context.

Thanks a lot in advanced!!
Santi

2

>I am trying to write a minifilter to catch all opened memory mapped files.

If you are in a minifilter you should be registering for the pseudo-opcode
IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION .

Then you will get a standard call back with the usual suspects as
parameters…