How to call IoSetCompletionRoutine before other IoSetCompletionRoutines

I’m using FileMon from SysInternal as my base. I found that I’ve to issue a
new IoSetCompletionRoutine within the FilemonHookRoutine. However, I’ve
problem in correctly calling my newly defined IoSetCompletionRoutine before
the IoSetCompletionRoutine of the FilemonHookRoutine.

I’ve attached my code below, please advise me on how to correct the code.

NTSTATUS FilemonHookRoutine(PDEVICE_OBJECT HookDevice, IN PIRP Irp)
{
switch (currentIrpStack->MajorFunction)
{
case IRP_MJ_DIRECTORY_CONTROL:

switch (currentIrpStack->MinorFunction)
{
case IRP_MN_NOTIFY_CHANGE_DIRECTORY:

break;
case IRP_MN_QUERY_DIRECTORY:

IoCopyCurrentIrpStackLocationToNext(Irp);
IoSetCompletionRoutine(Irp, FilemonDirQuery, NULL, TRUE, TRUE,
TRUE);
status = IoCallDriver(hookExt->FileSystem, Irp);
if (STATUS_PENDING == status )
{
KeWaitForSingleObject(NULL, Executive, KernelMode, FALSE, NULL);
status = Irp->IoStatus.Status;
}
Irp->IoStatus.Status = status;
Irp->IoStatus.Information = 0;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
hookCompletion = TRUE;
break;
}

}
IoSetCompletionRoutine(Irp, FilemonHookDone, NULL, FALSE, FALSE,
FALSE);
}

// Return the results of the call to the caller
return IoCallDriver(hookExt->FileSystem, Irp);
}

Thanks & Regards,

– Philip


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

hi,

once IoCallDriver is called, you cannot access the IRP in the dispatch
routine itself. You get the access to the IRP only in the completion
routine. After you set the completion routine, just call IoCallDriver and
process the status of the IRP only in the Completion routine.

Regards.


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com