Hi
I develop a file filter driver and in my Create(IRP_MJ_CREATE) entry point
I do the following for testing(of course I use synchronization with my own
create requests):
{
HANDLE q;
ZwCreateFile(&q,(GENERIC_READ |
SYNCHRONIZE),&oa,&iosbl,NULL,FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ,
FILE_OPEN , FILE_SYNCHRONOUS_IO_NONALERT|FILE_NON_DIRECTORY_FILE,
NULL, 0 );
…
ZwReadFile(q,0,0, 0,&iosbl,buff,howmuch,NULL,0);
…//DbgPrint buff
ZwClose(q);
}
The file filter work fine ,but when I open certain files the ring3(GUI)
process from which I request the open for that files hangs.In my debugger I
see that this happened when I receive IRP_MJ_CLEANUP.
Now the other GUI applications open files fine until they try to open that
files again.
My question is what happened?
Could be the ZwCreate/ZwRead flags?
Thanks