How to Mark an IRP

I’m looking for some special IRP in File System Filter Driver.

And I would like to mark this Irp so that Storage Filter Driver would know it receives a different Irp.

I’ve tried mark the Irp by changing Irp->IoStatus.Information from 0 to 1 ,
but I found it change to 0 when Storage Filter Driver receives this Irp.

I also find that the type of Flags in IRP is ULONG. And given valid values can not cover a ULONG variable,
May I define a different flag value by my own?

If not? How should I do? Is there any other method to implement this?

Setting arbitrary flags isn’t a good idea. If it was me (and I’ve done this) I’d put the IRP pointer into a shared table. Safest way all around. Peter BTW… probably better asked in the NTFSD topic.

@“Peter_Viscarola_(OSR)” said:
Setting arbitrary flags isn’t a good idea.

If it was me (and I’ve done this) I’d put the IRP pointer into a shared table.

Safest way all around.

Peter

BTW… probably better asked in the NTFSD topic.

Thank you for your advice, @Peter_Viscarola_(OSR).

I wonder if a table would affect system response speed because of searching in order.

But a hash table may waste too much memory.

BTW… How to move this question to NTFSD topic?

(Moved at the request of the OP)

Just use a hash table and be done with it. How much memory could it use? Not bad, really…

Peter

How many IRPs do you think you’re going to have at any one time? You’re talking about maybe a dozen, not a thousand.

@“Peter_Viscarola_(OSR)” said:
Just use a hash table and be done with it. How much memory could it use? Not bad, really…

Peter

@Tim_Roberts said:
How many IRPs do you think you’re going to have at any one time? You’re talking about maybe a dozen, not a thousand.

Wow, It seems that I have to implement a hash table by myself.

And I should also make sure thread safe because of sharing.

If I have Implemented a thread safe hash table , how can I share a table between two drivers?
Send it by ZwDeviceIoControlFile?

I’d manage the table in a kernel mode DLL with shared state that both drivers link to statically and call.

See the docs here.

Peter

1 Like

@“Peter_Viscarola_(OSR)” said:
I’d manage the table in a kernel mode DLL with shared state that both drivers link to statically and call.

See the docs here.

Peter

Thank you, Peter.

I’ll try as your advice.