this is the Dispatch write routine. This worked with the request that I showed you, but if I modified instead of IRP_MJ_READ, IRP_MJ_WRITE i get blue screen instantaneusly
When the IRP_MJ_READ succeded I get this on dbgview, besides my usual messages:
EX: Pageble Code at IRQL 2 (DISPATCH_LEVEL I presume) is this an exception ?
the reading is done correctly.
Is something I am missing.
the NLXxxx functions are from the sfilter example from microsoft and I think they are done correctly 
here is Dispatch write:
NTSTATUS
SfWrite (
__in PDEVICE_OBJECT DeviceObject,
__in PIRP Irp
)
{
NTSTATUS Status;
PNAME_CONTROL fileName = NULL;
PSFILTER_DEVICE_EXTENSION devExt = (PSFILTER_DEVICE_EXTENSION)(DeviceObject->DeviceExtension);
PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation( Irp );
BOOLEAN cacheName;
NAME_LOOKUP_FLAGS LookupFlags = 0x00000000;
KEVENT waitEvent;
NTSTATUS localStatus;
char *ReadBuffer;
//PMDL Mdl;
PIRP RequestIrp;
KEVENT SyncEvent;
IO_STATUS_BLOCK iosb;
PIO_STACK_LOCATION RequestStack;
UNICODE_STRING TestFile2;
LARGE_INTEGER StartOffset;
HANDLE hFile;
PFILE_OBJECT FileObject;
PAGED_CODE();
if (IS_MY_CONTROL_DEVICE_OBJECT(DeviceObject)) {
/*
nu filtram propriul device
*/
Irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST;
Irp->IoStatus.Information = 0;
IoCompleteRequest( Irp, IO_NO_INCREMENT );
return STATUS_INVALID_DEVICE_REQUEST;
}
ASSERT(IS_MY_DEVICE_OBJECT( DeviceObject ));
Status = NLAllocateNameControl( &fileName, &gSfNameBufferLookasideList );
if (NT_SUCCESS( Status )) {
//
// We are okay not checking the return value here because
// the GetFullPathName function will set the Unicode String
// length to 0. So either way, in an error it will print an empty string
//
if (devExt->NLExtHeader.DosName.Length!=0)
SetFlag(LookupFlags,NLFL_USE_DOS_DEVICE_NAME);
localStatus = NLGetFullPathName(irpSp->FileObject,
fileName,
&devExt->NLExtHeader,
LookupFlags,
&gSfNameBufferLookasideList,
&cacheName );
//if (!Once)
__try
{
if (RtlCompareUnicodeString(&TestFile,&(fileName->Name),TRUE)==0)
{
ReadBuffer=ExAllocatePoolWithTag(PagedPool,
1024,
‘abc’);
KeInitializeEvent(
&SyncEvent,
NotificationEvent,
FALSE);
RtlZeroMemory(&StartOffset,sizeof(LARGE_INTEGER));
RtlCopyMemory(ReadBuffer,“Test de scris in fisier”,sizeof(“Test de scris in fisier”));
RequestIrp=IoBuildAsynchronousFsdRequest(
IRP_MJ_WRITE,
devExt->NLExtHeader.AttachedToDeviceObject,
ReadBuffer,
sizeof(“Test de scris in fisier”),
&StartOffset,
&iosb);
if (RequestIrp)
{
RequestStack=IoGetNextIrpStackLocation(RequestIrp);
ObReferenceObjectByPointer(
irpSp->FileObject,
GENERIC_WRITE|GENERIC_READ,
*IoFileObjectType,
KernelMode);
RequestStack->FileObject=irpSp->FileObject;
RequestIrp->Tail.Overlay.OriginalFileObject=irpSp->FileObject;
IoSetCompletionRoutine(
RequestIrp,
IoReadRequestCompletion,
&SyncEvent,
TRUE,
TRUE,
TRUE);
Status = IoCallDriver(
devExt->NLExtHeader.AttachedToDeviceObject,
RequestIrp);
if (Status==STATUS_PENDING)
KeWaitForSingleObject(
&SyncEvent,
Executive,
KernelMode,
FALSE,
NULL);
if (NT_SUCCESS(iosb.Status))
{
DbgPrint("Success writting: %u ",iosb.Information);
}
else
DbgPrint(“Error writting: 0x%x”,iosb.Status);
ObDereferenceObject(irpSp->FileObject);
ExFreePoolWithTag(ReadBuffer,‘abc’);
}
}
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
Status=GetExceptionCode();
DbgPrint(“Exception raised: 0x%x”,Status);
}
DbgPrint(“IRP_MJ_WRITE: FILE: %S Process: %s, ReadLength: %u, Offset %u”,
fileName->Name.Buffer?fileName->Name.Buffer:L"N/A",
PsGetProcessImageFileName(IoGetCurrentProcess()),irpSp->Parameters.Read.Length,irpSp->Parameters.Read.ByteOffset.QuadPart);
if (NT_SUCCESS(localStatus))
NLFreeNameControl(fileName,&gSfNameBufferLookasideList);
}
else
{
DbgPrint(“Could not get name in IRP_MJ_WRITE”);
}
KeInitializeEvent( &waitEvent, NotificationEvent, FALSE );
//
// Copy the stack and set our Completion routine
//
IoCopyCurrentIrpStackLocationToNext( Irp );
IoSetCompletionRoutine(
Irp,
SfReadCompletion,
&waitEvent,
TRUE,
TRUE,
TRUE );
//
// Call the next driver in the stack.
//
Status = IoCallDriver( devExt->NLExtHeader.AttachedToDeviceObject, Irp );
//
// Wait for the completion routine to be called
//
if (STATUS_PENDING == Status)
localStatus = KeWaitForSingleObject( &waitEvent,
Executive,
KernelMode,
FALSE,
NULL );
Status = Irp->IoStatus.Status;
IoCompleteRequest( Irp, IO_NO_INCREMENT );
return Status;
}