The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
reading Windows Internals 6th edition, I'd ask for a clarification about the following:
I'm aware that for each file being cached, Cache manager calls a VMM's exported function to create a Section object for it. Therefore, at any given time, there may be in the system multiple section objects for the same file object as well as multiple mapped views of the file stored in different cache slots.
For each file being cached, Cache manager maintains shared cache map instances linked in a list (see Fig 11-7 in the book). Each shared cache map instance stores a pointer to a (multilevel) VACB index array.
My question is: why can there be multiple shared cache map instances for the same cached file ? Just because can't one instance of the three-level VACB index array be enough to index all the desired views of the cached file ?
|Upcoming OSR Seminars
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
|13-17 May 2024
|1-5 Apr 2024
|Internals & Software Drivers
|11-15 Mar 2024
|Writing WDF Drivers
|20-24 May 2024