Hi,
I experience some strange behaviour with IoCreateFile on a Win2k sp1 box.
My filter is filtering IRP_MJ_CREATE and opens files before they are send
down to lower-level drivers.
The strangest thing happened, when I remove (!) a CD from the CD-Rom drive:
my driver sees an IRP_MJ_CREATE for \AutoRun.Inf. (yes, after removal, but
before detach)
So the filter tries to open this file via IoCreateFile, but than the
IoCreateFile function never returns. It deadlocks.
This is how I call IoCreateFile:
ntStatus = IoCreateFile(&NtFileHandle,
SYNCHRONIZE | FILE_GENERIC_READ,
&ObjectAttributes,
&IoStatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_OPEN,
FILE_SYNCHRONOUS_IO_ALERT
|FILE_NON_DIRECTORY_FILE,
NULL,
0,
CreateFileTypeNone,
0,
IO_NO_PARAMETER_CHECKING
|IO_CHECK_CREATE_PARAMETERS);
Also, when I change the IoCreateFile parameters to only
IO_NO_PARAMETER_CHECKING or to only IO_CHECK_CREATE_PARAMETERS,
IoCreateFile returns 0xC0000005… What would that mean ? Access violation
within IOCreateFile ?
Any clues here ?
–
Bartjan.
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com