There is an event created in the user mode and passed through IOCTL to kernel and from kernel it will be signaled.
In the user it waiting on the event to be signaled then do some job.
My problem is i am not able to find who is signalling this event in kernel like in which function in the driver . Is there a way to debug in windbg to break when this event is signalled ?
It looks like you're new here. If you want to get involved, click one of these buttons!
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||20 Apr 2020||LIVE ONLINE|
|Writing WDF Drivers||11 May 2020||LIVE ONLINE|
|Internals & Software Drivers||28 Sept 2020||Dulles, VA|