Detecting NonPaged Memory

Yes you are missing something.

The point is that you have to know something about that other code and how it works. It does not work by magic and there is prescriptive set of rules. This means that the odds that you don

I have read all of the documentation I can find, and other than the comments in the example drivers, such as SwapBuffer,
I have never found a description of these types of IO.

Well, I don’t really know where you are looking for info, but MSDN documentation does not seem to be on the list of your sources…

Look - this is, apparently, one of the most basic things that a driver writer has to learn, and, hence, it is thoroughly described on MSDN.

Start from

https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/methods-for-accessing-data-buffers

This doc presents a general overview of IO and provides links to the docs that describe each IO type in more detail.

When it comes to IOCTLs, you may want to look at the following one

https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/defining-i-o-control-codes.

In fact, the best way to go is to start right at https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel , and to go all the way down…

Anton Bassov

@anton_bassov said:
Look - this is, apparently, one of the most basic things that a driver writer has to learn, and, hence, it is thoroughly described on MSDN.

Start from

https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/methods-for-accessing-data-buffers

Thanks Anton. I also found it clear as a bell in Windows Internal, Ch 6. I did start with all of the “start here” pages I could find, and reading Windows Internals. The only thing I can imagine is that I read that material early enough in the game that whether the buffers would be nonpaged pool or locked was not my top priority. Looks like I need to reread everything I read last fall, this time after having some actual experience so that these kind of details have significance.

_Ron

Looks like I need to reread everything I read last fall

This is where I chime in about the value of taking a seminar or two… You know how much time/effort/aggravation it would have saved you?

Peter

@Peter_Viscarola said:

Looks like I need to reread everything I read last fall

This is where I chime in about the value of taking a seminar or two… You know how much time/effort/aggravation it would have saved you?

Peter

Agreed. I held off originally because I figured a deep dive when I didn’t know anything would be a waste. I’ll see if I can talk the powers that be into it.