windows I/O manager - IRP's classification in read-like and write-like
- by clyfe
I am writing a windows filesystem minifilter driver that must fail IRP's in a preoperation callback.
How can I find out from the callback parameters if the operation is read-like ( only reads data ) or it's write-like ( modifies data on the disk - write, delete etc ) ?
I'm thinking on:
Data->Iopb->TargetFileObject->ReadAccess …