Hello,
in my minifilter I moved the processing logic of our PostDirectoryControl callback to a deferred workitem.
During PostDirectoryControl I can access the DirectoryBuffer, but not anymore in the workitem.
In this case the windbg shows for the addres 0xf07aa2d970 (see below): Unable to retrieve information, Win32 error 0n30: The system cannot read from the specified device.
During PostDirectoryControl it shows a valid content at this address.
Here is a output from windbg (post=PostDirectoryControl , work=workitem)
post
callbackData = 0xffffe0000ec92c38 callbackData-\>Iopb-\>Parameters.DirectoryControl.QueryDirectory [Type: <unnamed-tag>]<br> [+0x000] Length : 0x268 [Type: unsigned long]<br> [+0x008] FileName : 0xffffe00005c108f0 : "file-1.txt" [Type: _UNICODE_STRING *]<br> [+0x010] FileInformationClass : FileFullDirectoryInformation (2) [Type: _FILE_INFORMATION_CLASS]<br> [+0x018] FileIndex : 0x0 [Type: unsigned long]<br> [+0x020] DirectoryBuffer : 0xf07aa2d970 [Type: void *]<br> [+0x028] MdlAddress : 0x0 [Type: _MDL *]<br>work<br> callbackData = 0xffffe0000ec92c38
callbackData->Iopb->Parameters.DirectoryControl.QueryDirectory [Type: ]
[+0x000] Length : 0x268 [Type: unsigned long]
[+0x008] FileName : 0xffffe00005c108f0 : “file-1.txt” [Type: _UNICODE_STRING *]
[+0x010] FileInformationClass : FileFullDirectoryInformation (2) [Type: _FILE_INFORMATION_CLASS]
[+0x018] FileIndex : 0x0 [Type: unsigned long]
[+0x020] DirectoryBuffer : 0xf07aa2d970 [Type: void *]
[+0x028] MdlAddress : 0x0 [Type: _MDL *]
I changed my PostDirectoryControl according to https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/pending-an-i-o-operation-in-a-postoperation-callback-routine
Do I do something wrong?
Thanks
Norbert