how to use a event which created in User Application?

NTFSD
1

i have create a event in a application

and my file driver want to open and signal it.

I try ZwOpenEvent ,thus obtain a handle of the event,

but when i use ZwSetEvent it can not success.

it return a error is IVALID HANLDE

i don’t know how to do !

2

Have you ever looked at the examples in the WDK? There is one that does
just this event passing and ZwOpenEvent is not called so of course it will
not work. It is already opened by the application. A place where you have
some work to do is when the application terminates and its handle to your
driver is closed, you must also clean up the kernel mode reference to the
event so Windows can clean up after the application.

PS the sample name is ‘event’ and shows multiple ways for signalling to be
done, but I like the event unless lots of data must be transferred from the
driver to the application.

wrote in message news:xxxxx@ntfsd…
>i have create a event in a application
>
> and my file driver want to open and signal it.
>
> I try ZwOpenEvent ,thus obtain a handle of the event,
>
> but when i use ZwSetEvent it can not success.
>
> it return a error is IVALID HANLDE
>
> i don’t know how to do !
>

3

My OS is XP!
I use DDK.
i faced another problem.
i use ObReferenceObjectByName to obtain a pointer to the object!
but i failed,why?

4

First, you should be using the WDK. The DDK is obsolete, and the WDK
supports building drivers all the way back to Windows 2000. Besides you
are asking this question on the the File System group, so you should either
be using the IFS kit (spending the money) or WDK which is newer and free.

If the event was created by a user application, have the application pass
the event handle to the driver and then use ObReferenceObjectByHandle to
get a pointer to the event. But the real question is what is the event
for? Most newbie’s which you obviosly are get wrapped up with using an
event, when it makes no sense to and is a detriment to reliable operation.
If you are using the event to signal the application that something is
going on, consider using the inverted call model instead, see
http://www.osronline.com/login.cfm?prompt=ntInsider&id=94. The advantages
of the inverted call are:

  1. If you need to send data to the application, this is built in with
    the inverted call, since returning the IOCTL provides the data. Using an
    event typically requires a request for a the data, which means you are
    doing more code and overhead to achieve the same thing.

  2. Inverted calls have a built in notification that the application
    went away (crashed, killed, etc) since the IOCTL request is canceled and
    the handle for the requests is closed. This can be one of the trickiest
    items with the event model, and there is no reason to be signalling the
    event and buffering data if the application is not there to read it.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

wrote in message news:xxxxx@ntfsd…
> My OS is XP!
> I use DDK.
> i faced another problem.
> i use ObReferenceObjectByName to obtain a pointer to the object!
> but i failed,why?
>