title: Windows: How to intercept/hook FastIO filesystem calls?
body: <p>I've developed a DLL library that intercepts calls to <code>NtQueryInformationFile()</code> - mainly by using mhook. Unfortunately calls for the file information class <code>FileBasicInformation</code> are resolved by FastIO calls instead of regular IRP's. So my intercept library isn't called.</p>
  
  <p>I want to archive that a particular application does the file sorting in a different way by changing <code>ChangeTime</code>, <code>LastAccessTime</code>, <code>LastWriteTime</code> and <code>CreationTime</code>.</p>
  
  <p>FastIO (instead of IRP's) calls are only used when a few boundary conditions are met, so I tried unmet some of these conditions - but I failed.</p>
  
  <p>These boundary conditions are</p>
  
  <ul>
  <li>Synchronous file system operation</li>
  <li>Caching is initiated</li>
  </ul>
  
  <p>Caching for file information class <code>FileBasicInformation</code> makes no sense to me and I couldn't find a way to intercept library calls to make (or simulate) a asynchronous file system operation of the upper target application.</p>
  
  <p>I'm looking for a way that my DLL library is called even for file information class <code>FileBasicInformation</code>, either by</p>
  
  <ul>
  <li>Intercepting FastIO calls</li>
  <li>Unmet FastIO boundary conditions</li>
  </ul>
  
  <p>I've no clue (and googling does not provide more information) how to intercept FastIO calls.</p>
  
  <p>Or how to unmet FastIO boundary conditions.</p>
  
  <p>Has someone experience in this area and can give me a hint?</p>
  
  <p>Thanks.</p>