EvtChildListIdentificationDescriptionCopy vs Duplicate

NTDEV
1

I’m unsure about the difference between EvtChildListIdentificationDescriptionCopy and EvtChildListIdentificationDescriptionDuplicate.

My IdentificationDescription contains two UNICODE_STRING’s of arbitrary length. Given that Copy cannot indicate an error am I right in assuming that it can never perform an operation that could fail (eg allocate memory) and so it is expected that the destination will share the string buffer with the source? If so, and if Copy cannot allocate any memory I’m having trouble imagining a scenario where the EvtChildListIdentificationDescriptionCopy is ever required (eg does it ever do anything more than RtlCopyMemory?)

And if the source and destination share string buffers, then the framework would never call Cleanup for both of them, right?

Thanks

James

2

Iirc

EvtChildListIdentificationDescriptionCopy => invoked when a new description shows up that needs to be added to the list. Copy over the pointers and then assume the dest copy owns them

EvtChildListIdentificationDescriptionDuplicate => called when the framework wants to duplicate an already in list description, ie when reenumerate self on the stack and kmdf wants to create a new identical pdo

d

Bent from my phone

From: James Harpermailto:xxxxx
Sent: ?12/?6/?2013 4:24 PM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: [ntdev] EvtChildListIdentificationDescriptionCopy vs Duplicate

I’m unsure about the difference between EvtChildListIdentificationDescriptionCopy and EvtChildListIdentificationDescriptionDuplicate.

My IdentificationDescription contains two UNICODE_STRING’s of arbitrary length. Given that Copy cannot indicate an error am I right in assuming that it can never perform an operation that could fail (eg allocate memory) and so it is expected that the destination will share the string buffer with the source? If so, and if Copy cannot allocate any memory I’m having trouble imagining a scenario where the EvtChildListIdentificationDescriptionCopy is ever required (eg does it ever do anything more than RtlCopyMemory?)

And if the source and destination share string buffers, then the framework would never call Cleanup for both of them, right?

Thanks

James

—
NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></mailto:xxxxx>