Hi i wanted, to know about how pending a I/O request works.
I read the guide in msdn about pending an IRP I/O request.
But one thing was unclear for me, the minifilter suppose to queue the callback data and then process it, but what exactly the minifitler suppose to queue?
Should it suppose to save the data_callback structure to the memory and then read from it? or just to save the pointer for the data_callback. This question is mainly depends on one thing, does the Filter Manager saves the data_callback in the memory while the operation is processed? or it just save some kind of identifier and the minifitler is the on who suppose to save it and complete it?
I know there is a mechanism built just for it but i might want to build such mechanism myself for my own purposes.
You are going to have to call the FltCompletedPendedXXXXOperation function
of choice and that needs the original CBD.
Precisely how you transfer all the information you need will depend on the
function you are using, but note that there are 4 pointers in the CBD which
you can use to keep pointers to other information if you want the CBD itself
to be the parameter passed to your worker thread/coroutine/deferred
call/mechanism of choice.
I think this answers your question, but put another way:
does the Filter Manager saves the data_callback in the memory while the
operation is processed?
My observation is that the CBD that you get is part of a large structure
that exists for from the time that the filter manager is first called until
the time that it completes the IRP that provoked said call.
This means that from the time you are called at pre until such time as you
either call FltCompletedPendedXXXXOperation or return FLT_PREOP_COMPLETE
or return FLT_POSTOP_FINISHED processing it is valid. (Beware of the
first - it means that as soon as you do whatever it takes to post the
request the CBD is no longer valid in the current thread)
So what you are saying that if for example i pend an operation and let’s assume that for some reason i saved the pointer to the flt_callback_data to a static variable, i can still access this structure from other callbacks and from everywhere i want as long i didnt completed the operation?
If what i said here is true then you just explained me everything and i thank you very much
otherwise thank you anyway 
> So what you are saying that if for example i pend an operation and let’s
assume that for some reason i saved the
pointer to the flt_callback_data to a static variable, i can still access
this structure from other callbacks and
from everywhere i want as long i didnt completed the operation?
yes, but a static might not be your best bet since then there can only be
one of them at once. What you need to build up is a “context” (that word
again) which gets passed to the function that is going to do the work
(e.g.the parameter to ScheduleSystemThread). That can be (or contain) the
CBD