I am testing a filter, which would redirect literally all file
opens (this is just a test, nothing specific in mind). And I am worried about the possibility of memory fragmentation
after some number of file name string buffers get allocated and
deallocated, which will happen, and is only a matter of time.
Now, aside form allocating, say 10K, buffers when the driver loads,
and using those, is there any mechanism which would allow me to
replace the file names, and still not get memory fragmentations, at
10K string will get eaten within minutes, if not seconds, and even
if I allocate only 256 BYTES (which I would often require), that is
not a small amount of memory.
The second idea was to allocate 4K aligned buffers only, hoping
that would simply lead to less fragmentation, but a lookaside list
would be the best approach. I just don't see any present in the API.
Does IoReplaceFileObjectName use lookaside lists internally, by any chance?
Kind regards, Dejan.
It looks like you're new here. If you want to get involved, click one of these buttons!
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||20 Apr 2020||LIVE ONLINE|
|Writing WDF Drivers||11 May 2020||LIVE ONLINE|
|Internals & Software Drivers||28 Sept 2020||Dulles, VA|