Getting fastio in minifilter

I am trying to build a filespy filter can anyone tell me how to intercept the fastio callbacks in minifilter.

FltMgr abstracts the Fast I/O callbacks as IRP_MJ_XXX operations. You can use the FLT_IS_FASTIO_OPERATION macro to know if the FLT_CALLBACK_DATA actually represents a Fast I/O operation:

1 Like