This is not the same question that I posted to WinDBG, but it’s related. It
is the same tip.
First the tip:
I want to display the contents of memory referenced by a local pointer
variable. Since the pointer is changing frequently, its far easier to deref
the pointer in the memory window than to copy the address and paste it into
the offset. If I paste the name of the pointer variable into the offset, I
get the contents of the local, which is the address of the memory I want to
see. It doesn’t get deref’d. So to deref the pointer, I used
poi(pVariable), and it worked. Cool! Caused a bazillion “Unable to verify
Timestamp” warnings, though.
Now the question:
My driver is the boot ATAPI driver, replacing atapi.sys, and I am trying to
open a file from the disk during initialization, which is the only time I am
ever called at any IRQL < DIRQL, so it’s the only time I *can* open a file.
I only want to read it, and only once. Since my driver is the system disk
driver, the runtime file system isn’t initialized yet, because it is waiting
for my driver to startup properly. So far, I have confirmed that
ZwCreateFile, ends up in NtCreateFile, which subsequently calls
IoCreateFile, which I very highly suspect will eventually try to call my
driver. I have not yet determined whether IoCreateFile will use the boot
file loader, since the disk driver isn’t initialized yet, but I doubt it,
based on information in Inside Windows 2000 and some communications from the
WinDBG guys at Microsoft. With enough time, which I don’t really have, I
can trace through IoCreateFile, and all the calls it makes, and eventually
confirm my suspicions, or (remote possibility) be pleasantly surprised.
Instead of continuing to chug through kernel assembly, I’d like to know if
anyone knows conclusively that IoCreateFile will or will not call the boot
file loader during initialization. Further, since I think calling any of
the kernel mode file routines is a fool’s errand, since they are dependent
on my initialization succeeding, I am wondering if there is any way to use
the existing boot file loader to find the file I need to load.
Thanks,
Phil
* Philip D. Barila | (503) 264-8386
* Intel Corp. | M/S JF2-53 Office JF2-2-G6
* Storage Architecture and Performance
* Internet Systems Lab
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com