Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

EvtChildListIdentificationDescriptionCopy vs Duplicate

James_HarperJames_Harper Member Posts: 1,615
I'm unsure about the difference between EvtChildListIdentificationDescriptionCopy and EvtChildListIdentificationDescriptionDuplicate.

My IdentificationDescription contains two UNICODE_STRING's of arbitrary length. Given that Copy cannot indicate an error am I right in assuming that it can never perform an operation that could fail (eg allocate memory) and so it is expected that the destination will share the string buffer with the source? If so, and if Copy cannot allocate any memory I'm having trouble imagining a scenario where the EvtChildListIdentificationDescriptionCopy is ever required (eg does it ever do anything more than RtlCopyMemory?)

And if the source and destination share string buffers, then the framework would never call Cleanup for both of them, right?

Thanks

James

Comments

  • Doron_HolanDoron_Holan Member - All Emails Posts: 10,435
    Iirc

    EvtChildListIdentificationDescriptionCopy => invoked when a new description shows up that needs to be added to the list. Copy over the pointers and then assume the dest copy owns them

    EvtChildListIdentificationDescriptionDuplicate => called when the framework wants to duplicate an already in list description, ie when reenumerate self on the stack and kmdf wants to create a new identical pdo

    d

    Bent from my phone
    ________________________________
    From: James Harper
    Sent: ?12/?6/?2013 4:24 PM
    To: Windows System Software Devs Interest List
    Subject: [ntdev] EvtChildListIdentificationDescriptionCopy vs Duplicate

    I'm unsure about the difference between EvtChildListIdentificationDescriptionCopy and EvtChildListIdentificationDescriptionDuplicate.

    My IdentificationDescription contains two UNICODE_STRING's of arbitrary length. Given that Copy cannot indicate an error am I right in assuming that it can never perform an operation that could fail (eg allocate memory) and so it is expected that the destination will share the string buffer with the source? If so, and if Copy cannot allocate any memory I'm having trouble imagining a scenario where the EvtChildListIdentificationDescriptionCopy is ever required (eg does it ever do anything more than RtlCopyMemory?)

    And if the source and destination share string buffers, then the framework would never call Cleanup for both of them, right?

    Thanks

    James


    ---
    NTDEV is sponsored by OSR

    Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

    OSR is HIRING!! See http://www.osr.com/careers

    For our schedule of WDF, WDM, debugging and other seminars visit:
    http://www.osr.com/seminars

    To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
    d
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
Developing Minifilters 29 July 2019 OSR Seminar Space
Writing WDF Drivers 23 Sept 2019 OSR Seminar Space
Kernel Debugging 21 Oct 2019 OSR Seminar Space
Internals & Software Drivers 18 Nov 2019 Dulles, VA