The scanner sample shows how a user mode program uses communication port,
completion port and overlapped file operation to communicate with a
minifilter.
The user mode creates N threads and N * M message blocks to wait for the
minifilter’s serving requests.
The mistake is that it creates too many message blocks. N message blocks are
enough for each thread to keep busy. Because when a thread gets a request,
it serves the request and reply to the filter, then it calls
FilterGetMessage again to put the message block in to the waiting queue for
a next request.
So one message block per thread should be enough.
The sample code is very important for new developers to understand the
mechanism. If the above statement is true, the sample code should be
corrected by MS. If it is not true, please explain.
Thanks,
Shangwu