The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Isn't IRP_MJ_CREATE guaranteed to be called at PASSIVE_LEVEL according to the docs?
According to WinDbg, my post operation of IRP_MJ_CREATE was called at DISPATCH_LEVEL. (See attached screenshot) This resulted in an instant crash.
In the following thread, there are mentions of a potential faulty driver in the altitude chain messing things up https://community.osr.com/discussion/279973/irp-mj-create-irql-of-pre-and-post-handlers
If was truly a faulty driver causing this, then why doesn't a crash occur unless my driver is loaded? I guarantee, the IRQL isn't raised by my driver at any point, at all.
I'm looking for an actual solution rather than checking if the IRQL is at DISPATCH_LEVEL before calling API that can't be called at that level.
There's also a comment: "You must not lower IRQL if you have not raised it. If you detected a wrong condition complete request with an error."
Should I just return an error if the IRQL isn't at PASSIVE_LEVEL? This doesn't seem right, if the docs say "it's guaranteed", then it must be so
I'm so confused that I decided to finally make an account here after having been a guest here for years.
Thanks in advance
[Mods: Arbitrary link deleted]
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!|
|Writing WDF Drivers||12 September 2022||Live, Online|
|Internals & Software Drivers||23 October 2022||Live, Online|
|Kernel Debugging||14 November 2022||Live, Online|
|Developing Minifilters||5 December 2022||Live, Online|