I ran into such a problem, a callback is registered in my minifilter here is its prototype:
FLT_PREOP_CALLBACK_STATUS DelProtectPreSetInformation(
_Inout_ PFLT_CALLBACK_DATA Data,
_In_ PCFLT_RELATED_OBJECTS FltObjects,
_Flt_CompletionContext_Outptr_ PVOID* CompletionContext);|
here it writes to the callback array:
CONST FLT_OPERATION_REGISTRATION Callbacks[] = {
{ IRP_MJ_CREATE, 0, DelProtectPreCreate, nullptr},
{ IRP_MJ_SET_INFORMATION, 0, DelProtectPreSetInformation, nullptr },
{ IRP_MJ_OPERATION_END }
};
But when my driver is running this callback just isn't called