Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.More Info on Driver Writing and Debugging
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Detect if request was reparsed
When a driver returns STATUS_REPARSE from PreCreate is there a way to detect when the reparsed request comes back down the pipe? I'm curious if there is a flag set to indicate that the request was the result of a previous reparse.
Howdy, Stranger!
| Upcoming OSR Seminars | ||
|---|---|---|
| OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
| Internals & Software Drivers | 7 February 2022 | Live, Online |
| Kernel Debugging | 21 March 2022 | Live, Online |
| Developing Minifilters | 23 May 2022 | Live, Online |
| Writing WDF Drivers | 12 September 2022 | Live, Online |
Comments
ECPs survive reparse. So you'd usually attach one to the (post) create and look for it in the pre-create. That's a big hammer, but its the only one I'm aware of
Thank Rod but that only works if the filter below reparses. Wouldn't work for my own reparsing or for a filter above. I was hoping there was a global solution that could be detected at an arbitrary level but I don't think there is.
In theory your filter shouldn't care about reparses done above you. Even if there was something that said, "this is a reissue of a reparse" you wouldn't have ever seen the original reparse so not sure what you'd do with it.
-scott
OSR