The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
I was working on a mouse and a keyboard filter driver and decided to look at Microsoft's examples and noticed that their 'MouFilter_EvtIoInternalDeviceControl' function (same with the keyboard version) had a description that said, "This routine is the dispatch routine for internal device control requests.". After more investigating it seems like this function runs at Dispatch Level if this is true, I wonder why they would have '#pragma alloc_text (PAGE, MouFilter_EvtIoInternalDeviceControl)' and 'PAGED_CODE()' located inside the function because I thought functions running at Dispatch Level can never be paged out without causing a fault.
My second question pertains to the same function where I have been advised to add a SpinLock to the Device Extension and then acquire that lock inside of 'case IOCTL_INTERNAL_MOUSE_DISCONNECT:' and then release it before breaking out. I was advised that this was good to do in order to mitigate other threads from trying to run the 'IOCTL_INTERNAL_MOUSE_CONNECT' case while 'IOCTL_INTERNAL_MOUSE_DISCONNECT' is being ran from a separate thread. This seems very unlikely to be an issue, but I don't see what being a little extra carful could harm.
|Upcoming OSR Seminars
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
|13-17 May 2024
|1-5 Apr 2024
|Internals & Software Drivers
|11-15 Mar 2024
|Writing WDF Drivers
|20-24 May 2024