Article 12491 of comp.os.ms-windows.programmer.nt.kernel-mode:
Ofer Mendelevitch wrote:
> 
> Hi everyone,
> 
> Does anybody know where in its internal tables does NT keep the current
> IRQL ? When does it change, how can I read it ???
> 
> Please respond to my email: omand@netvision.net.il
> Thanx,
> Ofer.

KeGetCurrentIrql() should tell you the current Irql.If you 
want to use the field directly then it is at offset 0x24 
inside the processor control region.The processor control 
region is pointed to by the segment 0x30 on x86 machines.When 
the execution is in kernel mode register fs contains selector 
0x30.So all you have to do is ,inside the driver copy fs:[24] 
into some register and start using it.

The Irql gets changed when someone calls KeLowerIrql or
KeRaiseIrql.It also gets changed when a hardware interrupt is 
serviced or when a hardware interrupt is completed , when a 
DPC gets issued,when a APC gets isssued etc.

Fizal