File reading before process start notification

NTFSD
1

Hi, guys. I’d like to get an explanation about the following issue.

I have three kernel mode drivers. First - event buffer driver, second - process monitor driver, third - minifilter driver. Process monitor driver sends events to the event buffer driver from its CREATE_PROCESS_NOTIFY_ROUTINE. Minifilter driver sends events to the event buffer driver from its post-read operation handler. All operations with the event buffer are synchronized.
Today i have noticed interesting situation - post-read event that occured in a context of some process was put in event buffer before process start event of the same process. I’d like to add that post-read event i mentioned above was about reading c:\windows\prefetch\someprocess.exe-xxxxx.pf by process c:\someprocess.exe.

So how it could happen that post-read was handled in the context of a process whose CREATE_PROCESS_NOTIFY_ROUTINE was not completed?

2

Doesn’t sound right to me…Are you 100% sure of the order of your log entries? Also, which O/S version?

-scott
OSR
@OSRDrivers

3

Windows 7 x64 SP1. It was the only accident for several months. Besides while putting event in a buffer i add current time to event and post-read had really earlier time. I experimented with delaying CREATE_PROCESS_NOTIFY_ROUTINE and the event sequence was always fine so i failed in reproducing of this issue.

4

I would guess that KeStackAttachProcess was involved.