The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
I am testing a filter, which would redirect literally all file
opens (this is just a test, nothing specific in mind). And I am worried about the possibility of memory fragmentation
after some number of file name string buffers get allocated and
deallocated, which will happen, and is only a matter of time.
Now, aside form allocating, say 10K, buffers when the driver loads,
and using those, is there any mechanism which would allow me to
replace the file names, and still not get memory fragmentations, at
10K string will get eaten within minutes, if not seconds, and even
if I allocate only 256 BYTES (which I would often require), that is
not a small amount of memory.
The second idea was to allocate 4K aligned buffers only, hoping
that would simply lead to less fragmentation, but a lookaside list
would be the best approach. I just don't see any present in the API.
Does IoReplaceFileObjectName use lookaside lists internally, by any chance?
Kind regards, Dejan.
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||15 Jun 2020||LIVE ONLINE|
|Writing WDF Drivers||22 June 2020||LIVE ONLINE|
|Internals & Software Drivers||28 Sept 2020||Dulles, VA|