Assume you want to intercept IRP_MJ_WRITE IRPs sent to drivervolmgr, in particular, the device for the root partition (for example C:), and you want to monitor any writes to starting sector of this device (VBR).

The question is, what is the proper way of attaching to this device and monitoring IRP_MJ_WRITE IRPs? Using the following sample code I can attach to the target device, for example deviceharddiskvolume3, but the problem is, I no see IRP_MJ_READ or IRP_MJ_WRITE, but can see other IRPs. Note that this doesn’t happen when I attach using the AddDevice callback with the help of UpperFilter.

    auto ext = (DeviceExtension*)DeviceObject->DeviceExtension;

        DeviceObject->Flags |= LowerDeviceObject->Flags & (DO_BUFFERED_IO | DO_DIRECT_IO);

        DeviceObject->DeviceType = LowerDeviceObject->DeviceType;
        Devices[i].DeviceName.Buffer = buffer;
        Devices[i].DeviceName.MaximumLength = targetName.Length;
        RtlCopyUnicodeString(&Devices[i].DeviceName, &targetName);
        Devices[i].DeviceObject = DeviceObject;

        status = IoAttachDeviceToDeviceStackSafe(
            DeviceObject,           // filter device object
            LowerDeviceObject,      // target device object
            &ext->LowerDeviceObject);   // result
        if (!NT_SUCCESS(status))
            break;

        Devices[i].LowerDeviceObject = ext->LowerDeviceObject;
        // hardware based devices require this
        DeviceObject->Flags &= ~DO_DEVICE_INITIALIZING;
        DeviceObject->Flags |= DO_POWER_PAGABLE;