Filter & Hooking in the same driver

NTDEV
1

Hi

Let’s say i have a filter driver for CDROM class that also uses
dispatch table hooking (like hooking ZwCreateFile).
Except that in general, hooking is not recommended, should i expect
special problems because the same driver filters and hooks in the same
time ?

Adevice is created inside DriverEntry() (the “hooker”) and additional
devices are created in the AddDevice function for each CDROM in the
system.

Should i split the driver into 2 drivers - one for filtering and one for
hooking or it’s ok to have both in the same driver?

Thanks.

2

I think it is a good idea to split the driver, not becasue you face problems
that would not exist when you split them. But you might comeup with
documented solution(s), hence trash the hooker driver. In fact you should
take it as a real challenge to comeup with alternative design(s).

-pro

----- Original Message -----
From: “Omer B”
To: “Windows System Software Devs Interest List”
Sent: Thursday, June 09, 2005 1:31 AM
Subject: [ntdev] Filter & Hooking in the same driver

Hi

Let’s say i have a filter driver for CDROM class that also uses
dispatch table hooking (like hooking ZwCreateFile).
Except that in general, hooking is not recommended, should i expect
special problems because the same driver filters and hooks in the same
time ?

Adevice is created inside DriverEntry() (the “hooker”) and additional
devices are created in the AddDevice function for each CDROM in the
system.

Should i split the driver into 2 drivers - one for filtering and one for
hooking or it’s ok to have both in the same driver?

Thanks.

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

No, just do not write the Unload routine. Hookers cannot unload.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Omer B”
To: “Windows System Software Devs Interest List”
Sent: Thursday, June 09, 2005 12:31 PM
Subject: [ntdev] Filter & Hooking in the same driver

Hi

Let’s say i have a filter driver for CDROM class that also uses
dispatch table hooking (like hooking ZwCreateFile).
Except that in general, hooking is not recommended, should i expect
special problems because the same driver filters and hooks in the same
time ?

Adevice is created inside DriverEntry() (the “hooker”) and additional
devices are created in the AddDevice function for each CDROM in the
system.

Should i split the driver into 2 drivers - one for filtering and one for
hooking or it’s ok to have both in the same driver?

Thanks.

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com