Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:

Maintaining thread stack context in WFP callbacks

Gregory_MessermanGregory_Messerman Member Posts: 49

Hi all,

A question regarding the subj.
WFP callbacks are called asynchronously, sometimes at DPC level.
Say, I wanted to capture the stack of the calling thread in a callback.
This is entirely possible in a TDI filter (RIP), but seems to be unachievable using WFP (supposedly being the replacement).
What would you suggest?
Thanks in advance.

P.S. This would be possible by intercepting the AFD IOCTL interface, but, alas, it's of course undocumented.


  • anton_bassovanton_bassov Member MODERATED Posts: 5,218

    What would you suggest?

    Redefine your problem in such way that the requirement in question simply disappears. This is the only right way to go. More on it below

    This is entirely possible in a TDI filter

    .....because your callback is invoked in context of a thread that has actually originated the request, so that you can safely capture the target thread's stack. However, if it is invoked in arbitrary context (i.e. the way it works with WFP filters) you simply have no control over what the thread of your interest is actually doing at the moment. For example,you may make a bold assumption that the target thread went blocking, and is in the waiting state at the moment, which means you can capture its stack. Although this scenario will work fine in most cases, consider what happens if the target thread receives an APC

    Anton Bassov

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Writing WDF Drivers 7 Dec 2020 LIVE ONLINE
Internals & Software Drivers 25 Jan 2021 LIVE ONLINE
Developing Minifilters 8 March 2021 LIVE ONLINE