we all know,there is a bug at IoCancelFileOpen.OSR have described it:
Mm,CC will Obrenence the fileObject.
In my situation,I Create a fileobject(by my ShadowDO,it can resolve the
problem about recursive).and I read some data,then I ZwClose this file.
But,this ZwClose will result that other filter do
someting:eg,ZwCreateFile.
So,I think I should use IoCancelFileOpen(myfileobject).but there is a
famous bug.
I can’t use the famous solution:StreamFileObject.
So,I think:
I roll an IRP_MJ_CLEAP to lower.and I ObDereference this FileObject.if my
ObDereference drop to zero,OK ,System will send IRP_MJ_CLOSE
automatically.if not(Cc,Mm keep other reference),then System willnot send
IRP_MJ_CLOSE.
I resolve this bug?It can work?
and,how to construct an IRP_MJ_CLEANUP irp?There is no document.
thanks for your help.