mini filter driver | passing information from pre-operation to post-operation

I’m tracking changed made to file and would like to “remember” and pass some information from the pre-operation callback to the post-operation callback.

What is the best way to do it?
Can I just allocate a buffer in pre-operation and pass it in CompletionContext, then use it in post-operation and free it?

The driver should only support Windows 10 if it makes it easier.

Naftaly Avadiaev wrote:

Can I just allocate a buffer in pre-operation and pass it in CompletionContext,
then use it in post-operation and free it?

Yes, you can.
Moreover, this parameter is designed specifically for passing data to the
post-operation callback:

If this callback routine returns FLT_PREOP_SUCCESS_WITH_CALLBACK or
FLT_PREOP_SYNCHRONIZE, this parameter is an optional context pointer to
be passed to the corresponding post-operation callback routine.
(MSDN)

Thank you for the answer, however for some reason I’m having troubles with using the buffers passed in CompletionContext.

Within the preop callback I do the following:
PRecordEntry record = FltAllocatePoolAlignedWithTag(FltObjects->Instance, NonPagedPool, sizeof(RecordEntry), ‘ncaS’);

record->pre_op_filename.Buffer = FltAllocatePoolAlignedWithTag(FltObjects->Instance, NonPagedPool, 1024, ‘ncaS’);
record->pre_op_filename.Length = 0;
record->pre_op_filename.MaximumLength = 1024;

record->post_op_filename.Buffer = FltAllocatePoolAlignedWithTag(FltObjects->Instance, NonPagedPool, 1024, ‘ncaS’);
record->post_op_filename.Length = 0;
record->post_op_filename.MaximumLength = 1024;

In the postop callback I try to do the following:
PRecordEntry record = (PRecordEntry)CompletionContext;
RtlCopyUnicodeString(&record->post_op_filename, &nameInfo->Name);

I’m getting an exception at copying the unicode string.

What am I missing?

Never mind, just a stupid mistake.
Thanks!