I have a minifilter driver which shadows FILE_OBJECTs to create the illusion that create operations succeeded when the ACLs would normally have caused them to fail (see earlier post).
If I unload my driver while one of these FILE_OBJECTs is open, that FILE_OBJECT will find its way to the ntfs driver and cause a BSOD because the whole approach hangs on my driver being present in order to switch these invalid 'upper' FILE_OBJECTs for corresponding valid 'lower' ones. Is there a way I can defer my driver being unloaded until none of these upper FILE_OBJECTs are in existence?
It looks like you're new here. If you want to get involved, click one of these buttons!
|Upcoming OSR Seminars|
|Writing WDF Drivers||25 Feb 2019||OSR Seminar Space|
|Developing Minifilters||8 April 2019||OSR Seminar Space|