Is there a way to retrieve the streamcontext associated to the FIle_object passed in LoadImageNotifyRoutine? The FltGetStreamContext needs the Instance which I do not know where to get from.
FltGetVolumeFromFileObject followed by FltEnumerateInstances will get you the instance
1 Like