Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

How to Mark an IRP

ILBPNSILBPNS Member Posts: 11
edited July 14 in NTFSD

I'm looking for some special IRP in File System Filter Driver.

And I would like to mark this Irp so that Storage Filter Driver would know it receives a different Irp.

I've tried mark the Irp by changing Irp->IoStatus.Information from 0 to 1 ,
but I found it change to 0 when Storage Filter Driver receives this Irp.

I also find that the type of Flags in IRP is ULONG. And given valid values can not cover a ULONG variable,
May I define a different flag value by my own?

If not? How should I do? Is there any other method to implement this?

Post edited by Peter_Viscarola_(OSR) on

Comments

  • Peter_Viscarola_(OSR)Peter_Viscarola_(OSR) Administrator Posts: 8,704
    Setting arbitrary flags isn’t a good idea.

    If it was me (and I’ve done this) I’d put the IRP pointer into a shared table.

    Safest way all around.

    Peter

    BTW… probably better asked in the NTFSD topic.

    Peter Viscarola
    OSR
    @OSRDrivers

  • ILBPNSILBPNS Member Posts: 11

    @Peter_Viscarola_(OSR) said:
    Setting arbitrary flags isn’t a good idea.

    If it was me (and I’ve done this) I’d put the IRP pointer into a shared table.

    Safest way all around.

    Peter

    BTW… probably better asked in the NTFSD topic.

    Thank you for your advice, @Peter_Viscarola_(OSR).

    I wonder if a table would affect system response speed because of searching in order.

    But a hash table may waste too much memory.

    BTW... How to move this question to NTFSD topic?

  • Peter_Viscarola_(OSR)Peter_Viscarola_(OSR) Administrator Posts: 8,704

    (Moved at the request of the OP)

    Peter Viscarola
    OSR
    @OSRDrivers

  • Peter_Viscarola_(OSR)Peter_Viscarola_(OSR) Administrator Posts: 8,704

    Just use a hash table and be done with it. How much memory could it use? Not bad, really…

    Peter

    Peter Viscarola
    OSR
    @OSRDrivers

  • Tim_RobertsTim_Roberts Member - All Emails Posts: 14,111

    How many IRPs do you think you're going to have at any one time? You're talking about maybe a dozen, not a thousand.

    Tim Roberts, [email protected]
    Providenza & Boekelheide, Inc.

  • ILBPNSILBPNS Member Posts: 11
    edited July 15

    @Peter_Viscarola_(OSR) said:
    Just use a hash table and be done with it. How much memory could it use? Not bad, really…

    Peter

    @Tim_Roberts said:
    How many IRPs do you think you're going to have at any one time? You're talking about maybe a dozen, not a thousand.

    Wow, It seems that I have to implement a hash table by myself.

    And I should also make sure thread safe because of sharing.

    If I have Implemented a thread safe hash table , how can I share a table between two drivers?
    Send it by ZwDeviceIoControlFile?

  • Peter_Viscarola_(OSR)Peter_Viscarola_(OSR) Administrator Posts: 8,704

    I’d manage the table in a kernel mode DLL with shared state that both drivers link to statically and call.

    See the docs here.

    Peter

    Peter Viscarola
    OSR
    @OSRDrivers

  • ILBPNSILBPNS Member Posts: 11

    @Peter_Viscarola_(OSR) said:
    I’d manage the table in a kernel mode DLL with shared state that both drivers link to statically and call.

    See the docs here.

    Peter

    Thank you, Peter.

    I'll try as your advice.

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Internals & Software Drivers 15 November 2021 Live, Online
Writing WDF Drivers 24 January 2022 Live, Online
Developing Minifilters 7 February 2022 Live, Online
Kernel Debugging 21 March 2022 Live, Online