pEvent is Nonpaged pool allocate by ExAllocatePoolWithTag.
But i get a BSOD with IRQL_NOT_LESS_OR_EQUAL
1: kd> g
Driver Verifier: Enabled for MyDriver_ProcMon.sys, 0:0x100009, 1:0x2, build 19042, key 4XXOFJKTWokcIDxOlNSWC
KDTARGET: Refreshing KD connection
*** Fatal System Error: 0x0000000a
(0x0000000000000000,0x0000000000000002,0x0000000000000000,0xFFFFF8015AA156F1)
Break instruction exception - code 80000003 (first chance)
A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.
A fatal system error has occurred.
Are you calling this from inside DriverEntry? (Looks like it) … you can’t wait forever in DriverEntry, that system thread will need to return at some point and the Verifier is calling you on this …
@craig_howard said:
Are you calling this from inside DriverEntry? (Looks like it) … you can’t wait forever in DriverEntry, that system thread will need to return at some point and the Verifier is calling you on this …
No, I call it in IRP_MJ_DEVICE_CONTROL dispatch function.
@craig_howard said:
Are you calling this from inside DriverEntry? (Looks like it) … you can’t wait forever in DriverEntry, that system thread will need to return at some point and the Verifier is calling you on this …
I put the all source code in the DriverEntry.cpp file …
It doesn’t mean i call it from DriverEntry function.