How to flash buffer on Shut Down for NDIS Miniport?

NTDEV
1

When driver disabled, it flash all its buffers, including LOGs - everything is OK.

We run into the problem - buffers are not flushed on computer Shut Down.
ZwWriteFile() reports STATUS_TOO_LATE, means function is registered for ShutdownHandlerEx called after volume is dismounted.

How this problem may be resolved?
Probably other callback may be used for?

Driver is NDIS WDI Miniport.

Thanks for answers,
MG.

2

Though I doubt you’ll thank for this answer… NDIS miniports usually don’t call ZwWriteFile. None of their business.
This raises a traditional question: what is a bigger problem? Logging to a file without ETW?

  • Pavel
3

Pavel,
writing to file is used by (debug) Log subsystem.

What is “funny”, after Blue Screen rest of Log remains in Crash Dump - no problem.
But I did not find callback or OID which would allow flashing it on ordinary Shut Down… :frowning: