Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.More Info on Driver Writing and Debugging
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
confuse a about FLT_PREOP_SYNCHRONIZE usage?
my purpose is: monitor files data change in specified path. so, i implement like this:
in IRP_MJ_WRITE pre-op: i created a stream handle context and return FLT_PREOP_SYNCHRONIZE. In post-op: i check io status is STATUS_SUCCESS or not, and set the stream context variable for later use.
but, as MS said: "Minifilter drivers must never return FLT_PREOP_SYNCHRONIZE for asynchronous read or write operations." MS_link
this mean that i must not return FLT_PREOP_SYNCHRONIZE when current operation is Asyn in IRP_MJ_WRITE pre-op cabllack? Or Must not call FltRead|WriteFile (or similars) with async option in IRP_MJ_WRITE pre-op callback?
pls help me figure it out, thank you.
Howdy, Stranger!
| Upcoming OSR Seminars | ||
|---|---|---|
| OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
| Internals & Software Drivers | 19-23 June 2023 | Live, Online |
| Writing WDF Drivers | 10-14 July 2023 | Live, Online |
| Kernel Debugging | 16-20 October 2023 | Live, Online |
| Developing Minifilters | 13-17 November 2023 | Live, Online |
Comments
By returning FLT_PREOP_SYNCHRONIZE you're forcing all write operations to be synchronous. At a minimum this will kill performance.
-scott
OSR
is there anyway to run post-op at APC_LEVEL or below in Async write operation?
FltDoCompletionProcessingWhenSafe and FltQueueDeferredIoWorkItem documents also said must not use in IRP_MJ_WRITE.
What do you need to do in post that requires <= APC_LEVEL?
-scott
OSR
in post-write, i get streamhandle context and set variables like bFileChanged (if IoStatus.Status success) etc.
The FltGetStreamHandleContext run <= APC_LEVEL so, i'm searching for a method to catch Sync/Aync write action for specified paths that the driver monitoring.
You ought to be able to fetch your stream handle context in your pre-op callback, which you can then make available to your post-op callback via
CompletionContextby returningFLT_PREOP_SUCCESS_WITH_CALLBACKfrom your pre-op callback. Naturally, this'll only work if your stream handle context is allocated from non-paged pool; you'll also want to release the reference in your post-op callback.