windows I/O manager - IRP's classification in read-like and write-like
I am writing a windows filesystem minifilter driver that must fail I/O Request Packets (IRP's) in a preoperation callback based on their type (read/write). How can I find out from the callback parameters (or elsewhere?) if the operation is read-like ( only reads data ) or it's write-like ( modifies data on the disk - write, delete, forma...