I’m not ashamed at all Daniel. See, as stated many times before I’m only
a hobbyist. I don’t claim to have “Incredible kernel development skills”
like you do. As stated in a post earlier tonight too Martin, I wrote,
“If I wanted to look at blue screens I would just write some code 
.”
- in case you don’t get it, I was poking fun at myself . I don’t bolster
about skills I don’t have the way you do.
Perhaps you missed the meaning of the " " following my comment.
Quite being an over-sensitive douche bag.
Daniel Terhell wrote:
Somebody who is not ashamed to publicly post crap like this (this is
your code right ?) still needs to learn the most fundamental basics
and refrain from commenting on the coding skills of somebody else.
Since you have made it totally clear clear you have absolutely no clue
what you are doing yourself, any comment you may have about my coding
skills is plain ridiculous.
/Daniel
“MM” wrote …
> -------------------------------------------------------------------------------
>
> WCHAR NoteFile[3][200] = {
> L"\EXPLORER.EXE",
> L"\SYSTEM32\NOTEPAD.EXE", <-what I’m searching for
> …
> };
>
>
> NTSTATUS
> CouldItBeNotePad (
> in PFLT_FILE_NAME_INFORMATION nameInfo,
> out PBOOLEAN MayBe
> )
> {
> UNICODE_STRING FileName;
> NTSTATUS status;
> int i;
>
> for(i = 0; i < 3; i++)
> {
>
> FileName.Length = 0x0;
> FileName.MaximumLength = sizeof(NoteFile[i]);
> FileName.Buffer = NoteFile[i];
>
>
> if (FsRtlIsNameInExpression( &FileName, &nameInfo->Name, TRUE, NULL
> ) == TRUE)
> {
> //never get here
> DbgPrint(“A match was found %S\n”, NoteFile[i]);
> *MayBe = TRUE;
> }else{
> //FsRtlIsNameInExpression always returns no match. Expression is UCase
> *MayBe = FALSE;
> DbgPrint(“%wZ \n”, FileName);
> DbgPrint(“%wZ \n”, &nameInfo->Name);
> }
> }
> return STATUS_SUCCESS;
> }
> -------------------------------------------------------
>
>
>
>
>> What’s wrong with patchguard? I think it’s great; it keeps
>> individuals with incredible kernel development skills such as
>> yourself from f ****** up other peoples systems…
>>
>> Daniel Terhell wrote:
>>
>>> I hope in the future you are also going to start a lobby against
>>> PatchGuard. If OSR is not doing this, who else can do this ?
>>>
>>> /Daniel
>>>
>>>
>>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
Oh, one more thing. Thanks for critiquing my pseudo code. I’m really
interesting in knowing,
“COULD IT BE NOTEPAD”…
I assume you were correct in pointing out the length parameter vs the
maxlen, never tested that.
MM wrote:
I’m not ashamed at all Daniel. See, as stated many times before I’m
only a hobbyist. I don’t claim to have “Incredible kernel development
skills” like you do. As stated in a post earlier tonight too Martin, I
wrote, “If I wanted to look at blue screens I would just write some
code .” - in case you don’t get it, I was poking fun at myself . I
don’t bolster about skills I don’t have the way you do.
Perhaps you missed the meaning of the " " following my comment.
Quite being an over-sensitive douche bag.
Daniel Terhell wrote:
> Somebody who is not ashamed to publicly post crap like this (this is
> your code right ?) still needs to learn the most fundamental basics
> and refrain from commenting on the coding skills of somebody else.
> Since you have made it totally clear clear you have absolutely no
> clue what you are doing yourself, any comment you may have about my
> coding skills is plain ridiculous.
>
> /Daniel
>
>
>
> “MM” wrote …
>> -------------------------------------------------------------------------------
>>
>> WCHAR NoteFile[3][200] = {
>> L"\EXPLORER.EXE",
>> L"\SYSTEM32\NOTEPAD.EXE", <-what I’m searching for
>> …
>> };
>>
>>
>> NTSTATUS
>> CouldItBeNotePad (
>> in PFLT_FILE_NAME_INFORMATION nameInfo,
>> out PBOOLEAN MayBe
>> )
>> {
>> UNICODE_STRING FileName;
>> NTSTATUS status;
>> int i;
>>
>> for(i = 0; i < 3; i++)
>> {
>>
>> FileName.Length = 0x0;
>> FileName.MaximumLength = sizeof(NoteFile[i]);
>> FileName.Buffer = NoteFile[i];
>>
>>
>> if (FsRtlIsNameInExpression( &FileName, &nameInfo->Name, TRUE, NULL
>> ) == TRUE)
>> {
>> //never get here
>> DbgPrint(“A match was found %S\n”, NoteFile[i]);
>> *MayBe = TRUE;
>> }else{
>> //FsRtlIsNameInExpression always returns no match. Expression is UCase
>> *MayBe = FALSE;
>> DbgPrint(“%wZ \n”, FileName);
>> DbgPrint(“%wZ \n”, &nameInfo->Name);
>> }
>> }
>> return STATUS_SUCCESS;
>> }
>> -------------------------------------------------------
>>
>>
>>
>>
>>> What’s wrong with patchguard? I think it’s great; it keeps
>>> individuals with incredible kernel development skills such as
>>> yourself from f ****** up other peoples systems…
>>>
>>> Daniel Terhell wrote:
>>>
>>>> I hope in the future you are also going to start a lobby against
>>>> PatchGuard. If OSR is not doing this, who else can do this ?
>>>>
>>>> /Daniel
>>>>
>>>>
>>>
>>
>>
>> —
>> Questions? First check the Kernel Driver FAQ at
>> http://www.osronline.com/article.cfm?id=256
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
Now children… STOP please.
M or is it MM: Hobbyists are welcome here, but – just like the “pros” – you have to be well behaved. Note that people tend to get annoyed when their professional skills are questioned… Smiley face or not. And please cool it with calling people names, OK? It really is an argument that’s the last refuge of the weak minded.
Daniel: Please don’t feed the troll.
Given some of the recent posts, I’m thinkin’ it’s time for NTDEV and NTFSD to implement some sort of “reputation rating” for posters. There seem to me to be lots of people “spewing” on this list, but far too few people who actually know what they’re talking about.
Peter
OSR