IoCreateSynchronizationEvent

NTFSD
1

Hi,

I can't create a named event in my DriverEntry routine. Here is the
snippet of code:

RtlInitUnicodeString(&strEventName, L"\\BasedNamedObjects\DITEvent");

pEvent = IoCreateSynchronizationEvent(&strEventName, &hEvent);
if(!pEvent) //I can't create a named event, so for the
//testing purposes I create a regular event
{
KeInitializeEvent(&kEvent, SynchronizationEvent, FALSE);
pEvent = &kEvent;
}

I tried both

  • to create the named event in user mode first
  • to create the named event in kernel mode first

pEvent and hEvent are NULL after call to IoCreateSynchronizationEvent.

I define variables on the global scope:
PKEVENT pEvent;
HANDLE hEvent;

--
Roman Kudinov

mailto:xxxxx@rbcmail.ru

2

Surely.
Your DriverEntry runs too early, when BaseNamedObjects is not created yet.

Do not use named events. Instead, register the event by passing its handle
via IOCTL parameter.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Roman Kudinov”
To: “Windows File Systems Devs Interest List”
Sent: Monday, August 30, 2004 1:36 PM
Subject: [ntfsd] IoCreateSynchronizationEvent

> Hi,
>
> I can’t create a named event in my DriverEntry routine. Here is the
> snippet of code:
> --------------------------------------------
> RtlInitUnicodeString(&strEventName,
L"\\BasedNamedObjects\DITEvent");
>
> pEvent = IoCreateSynchronizationEvent(&strEventName, &hEvent);
> if(!pEvent) //I can’t create a named event, so for the
> //testing purposes I create a regular event
> {
> KeInitializeEvent(&kEvent, SynchronizationEvent, FALSE);
> pEvent = &kEvent;
> }
> --------------------------------------------
>
> I tried both
> - to create the named event in user mode first
> - to create the named event in kernel mode first
>
> pEvent and hEvent are NULL after call to IoCreateSynchronizationEvent.
>
>
>
> I define variables on the global scope:
> PKEVENT pEvent;
> HANDLE hEvent;
>
>
>
> –
> Roman Kudinov
>
>
> mailto:xxxxx@rbcmail.ru
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com