IRP_MJ_CREATE and DuplicateHandle(SDK)

NTDEV
1

Hi All,
I was just curious that what is the behaviour of DuplicateHandle(API) with respect to IRP_MJ_CREATE.

First the scenerio:

  1. One application (APP-1) calls CreateFile to open a handle to a function driver’s FDO.
  2. Other thread/or other process (APP-2) calls DuplicateHandle for the same device.

Questions:

  1. When the other process calls DuplicateHandle, will the function driver’s IRP_MJ_CREATE handler gets called?
  2. When will the IRP_MJ_CLEANUP get called? (After both the handles are closed or only when the original handle gets closed?)
  3. Will the IRP from both the process have same Irp->FileObject.

Your answers are highly appreciated.
Thanks,
– Ajitabh.

2

Guys…I need this…anyone please. :slight_smile:

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Ajitabh Saxena
Sent: Friday, March 12, 2010 4:47 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)

Hi All,
I was just curious that what is the behaviour of DuplicateHandle(API) with respect to IRP_MJ_CREATE.

First the scenerio:

  1. One application (APP-1) calls CreateFile to open a handle to a function driver’s FDO.
  2. Other thread/or other process (APP-2) calls DuplicateHandle for the same device.

Questions:

  1. When the other process calls DuplicateHandle, will the function driver’s IRP_MJ_CREATE handler gets called?
  2. When will the IRP_MJ_CLEANUP get called? (After both the handles are closed or only when the original handle gets closed?)
  3. Will the IRP from both the process have same Irp->FileObject.

Your answers are highly appreciated.
Thanks,
– Ajitabh.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

>1. When the other process calls DuplicateHandle, will the function driver’s IRP_MJ_CREATE

handler gets called?

No, the driver will not be notified in any way.

  1. When will the IRP_MJ_CLEANUP get called? (After both the handles are closed or only when the
    original handle gets closed?)

After all handles are closed.

  1. Will the IRP from both the process have same Irp->FileObject.

Yes.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

4

This is so dirt simple for you to test on your own, have you done that? I mean in the time it took you to send the 2nd msg, you could have already written the test app

d

tiny phone keyboard + fat thumbs = you do the muth

From: Ajitabh Saxena
Sent: Friday, March 12, 2010 5:37 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)

Guys…I need this…anyone please. :slight_smile:

________________________________
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Ajitabh Saxena
Sent: Friday, March 12, 2010 4:47 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)

Hi All,
I was just curious that what is the behaviour of DuplicateHandle(API) with respect to IRP_MJ_CREATE.

First the scenerio:
===============
1. One application (APP-1) calls CreateFile to open a handle to a function driver’s FDO.
2. Other thread/or other process (APP-2) calls DuplicateHandle for the same device.

Questions:
===========
1. When the other process calls DuplicateHandle, will the function driver’s IRP_MJ_CREATE handler gets called?
2. When will the IRP_MJ_CLEANUP get called? (After both the handles are closed or only when the original handle gets closed?)
3. Will the IRP from both the process have same Irp->FileObject.

Your answers are highly appreciated.
Thanks,
– Ajitabh.

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

5

Hi Doron,
I know it’s dirt simple to test but not when you are travelling and do not have access to your development environment.

Thanks,
– Aj

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Friday, March 12, 2010 5:49 PM
To: Windows System Software Devs Interest List
Subject: RE: RE:[ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)

This is so dirt simple for you to test on your own, have you done that? I mean in the time it took you to send the 2nd msg, you could have already written the test app

d

tiny phone keyboard + fat thumbs = you do the muth

From: Ajitabh Saxena
Sent: Friday, March 12, 2010 5:37 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)

Guys…I need this…anyone please. :slight_smile:

________________________________
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Ajitabh Saxena
Sent: Friday, March 12, 2010 4:47 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)

Hi All,
I was just curious that what is the behaviour of DuplicateHandle(API) with respect to IRP_MJ_CREATE.

First the scenerio:
===============
1. One application (APP-1) calls CreateFile to open a handle to a function driver’s FDO.
2. Other thread/or other process (APP-2) calls DuplicateHandle for the same device.

Questions:
===========
1. When the other process calls DuplicateHandle, will the function driver’s IRP_MJ_CREATE handler gets called?
2. When will the IRP_MJ_CLEANUP get called? (After both the handles are closed or only when the original handle gets closed?)
3. Will the IRP from both the process have same Irp->FileObject.

Your answers are highly appreciated.
Thanks,
– Ajitabh.

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

6

Oh come on. That is one of the lameest excuses I have heard. If you’re
traveling then how did you submit the emails? Signal flags? Smoke signals?
Carrier pidgeon? If it’s vacataion for you, then don’t ask till you get home
and go back to work. If it’s on business and you used your business laptop,
then why in the bloody hell don’t you have a build environment installed on
your laptop, with your latest source? I can always do a build at the
customers site if I have to, as well as using WinDbg either serial or 1394.
So “not when you are traveling” really only applies to them looking at the
world through their navel.

The personal opinion of

Gary G. Little

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ajitabh Saxena
Sent: Monday, March 15, 2010 10:54 AM
To: Windows System Software Devs Interest List
Subject: RE: RE:[ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)

Hi Doron,

I know it’s dirt simple to test but not when you are travelling and
do not have access to your development environment.

Thanks,

– Aj

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Friday, March 12, 2010 5:49 PM
To: Windows System Software Devs Interest List
Subject: RE: RE:[ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)

This is so dirt simple for you to test on your own, have you done that? I
mean in the time it took you to send the 2nd msg, you could have already
written the test app

d

tiny phone keyboard + fat thumbs = you do the muth

From: Ajitabh Saxena
Sent: Friday, March 12, 2010 5:37 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)

Guys…I need this…anyone please. :slight_smile:

_____

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ajitabh Saxena
Sent: Friday, March 12, 2010 4:47 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)

Hi All,

I was just curious that what is the behaviour of DuplicateHandle(API)
with respect to IRP_MJ_CREATE.

First the scenerio:

===============

1. One application (APP-1) calls CreateFile to open a handle to a function
driver’s FDO.

2. Other thread/or other process (APP-2) calls DuplicateHandle for the same
device.

Questions:

===========

1. When the other process calls DuplicateHandle, will the function driver’s
IRP_MJ_CREATE handler gets called?

2. When will the IRP_MJ_CLEANUP get called? (After both the handles are
closed or only when the original handle gets closed?)

3. Will the IRP from both the process have same Irp->FileObject.

Your answers are highly appreciated.

Thanks,

– Ajitabh.

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

__________ Information from ESET Smart Security, version of virus signature
database 4946 (20100315) __________

The message was checked by ESET Smart Security.

http://www.eset.com

7

Come on Gary…I am glad you marked that as your “Personal Opinion”. I had my laptop with all the build environment and everything. The only thing that was missing was my hardware in the system. My hardware is a PCI-E card (with a huge formfactor since its the debug version of the hardware with all JTAG and UARTS) and I have a WDM driver for that. Do you expect me to open the laptop put the hardware in it and then test it out…by the way I did test it out once I reached the customer site. The reason I requested a response was because before reaching there I wanted know the expected behaviour.

Anyway, with all due respect…there is no reason for anyone to give excuses on this mailing list. Its a forum of experts and I belive sometime or other everyone would have been in situations like these.

I did not give a lame excuse it was the reality of situation.
Are you a professor or something? :slight_smile:

The personal Opinion of…
– Aj.

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Gary G. Little
Sent: Monday, March 15, 2010 12:49 PM
To: Windows System Software Devs Interest List
Subject: RE: RE:[ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)

Oh come on. That is one of the lameest excuses I have heard. If you’re traveling then how did you submit the emails? Signal flags? Smoke signals? Carrier pidgeon? If it’s vacataion for you, then don’t ask till you get home and go back to work. If it’s on business and you used your business laptop, then why in the bloody hell don’t you have a build environment installed on your laptop, with your latest source? I can always do a build at the customers site if I have to, as well as using WinDbg either serial or 1394. So “not when you are traveling” really only applies to them looking at the world through their navel.

The personal opinion of
Gary G. Little

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Ajitabh Saxena
Sent: Monday, March 15, 2010 10:54 AM
To: Windows System Software Devs Interest List
Subject: RE: RE:[ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)

Hi Doron,
I know it’s dirt simple to test but not when you are travelling and do not have access to your development environment.

Thanks,
– Aj

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Friday, March 12, 2010 5:49 PM
To: Windows System Software Devs Interest List
Subject: RE: RE:[ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)
This is so dirt simple for you to test on your own, have you done that? I mean in the time it took you to send the 2nd msg, you could have already written the test app

d

tiny phone keyboard + fat thumbs = you do the muth

From: Ajitabh Saxena
Sent: Friday, March 12, 2010 5:37 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)
Guys…I need this…anyone please. :slight_smile:

________________________________
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Ajitabh Saxena
Sent: Friday, March 12, 2010 4:47 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)
Hi All,
I was just curious that what is the behaviour of DuplicateHandle(API) with respect to IRP_MJ_CREATE.

First the scenerio:
===============
1. One application (APP-1) calls CreateFile to open a handle to a function driver’s FDO.
2. Other thread/or other process (APP-2) calls DuplicateHandle for the same device.

Questions:
===========
1. When the other process calls DuplicateHandle, will the function driver’s IRP_MJ_CREATE handler gets called?
2. When will the IRP_MJ_CLEANUP get called? (After both the handles are closed or only when the original handle gets closed?)
3. Will the IRP from both the process have same Irp->FileObject.

Your answers are highly appreciated.
Thanks,
– Ajitabh.

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

__________ Information from ESET Smart Security, version of virus signature database 4946 (20100315)

The message was checked by ESET Smart Security.

http://www.eset.com

 Information from ESET Smart Security, version of virus signature database 4946 (20100315) __________

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

8

You could easily install a root enumerated UMDF driver (take the skeleton sample for instance) and run the entire experiment from your laptop. Or using a VM and debug a km root enumerated driver.

d

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Ajitabh Saxena
Sent: Monday, March 15, 2010 2:03 PM
To: Windows System Software Devs Interest List
Subject: RE: RE:[ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)

Come on Gary…I am glad you marked that as your “Personal Opinion”. I had my laptop with all the build environment and everything. The only thing that was missing was my hardware in the system. My hardware is a PCI-E card (with a huge formfactor since its the debug version of the hardware with all JTAG and UARTS) and I have a WDM driver for that. Do you expect me to open the laptop put the hardware in it and then test it out…by the way I did test it out once I reached the customer site. The reason I requested a response was because before reaching there I wanted know the expected behaviour.

Anyway, with all due respect…there is no reason for anyone to give excuses on this mailing list. Its a forum of experts and I belive sometime or other everyone would have been in situations like these.

I did not give a lame excuse it was the reality of situation.
Are you a professor or something? :slight_smile:

The personal Opinion of…
– Aj.

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Gary G. Little
Sent: Monday, March 15, 2010 12:49 PM
To: Windows System Software Devs Interest List
Subject: RE: RE:[ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)
Oh come on. That is one of the lameest excuses I have heard. If you?re traveling then how did you submit the emails? Signal flags? Smoke signals? Carrier pidgeon? If it?s vacataion for you, then don?t ask till you get home and go back to work. If it?s on business and you used your business laptop, then why in the bloody hell don?t you have a build environment installed on your laptop, with your latest source? I can always do a build at the customers site if I have to, as well as using WinDbg either serial or 1394. So ?not when you are traveling? really only applies to them looking at the world through their navel.

The personal opinion of
Gary G. Little

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Ajitabh Saxena
Sent: Monday, March 15, 2010 10:54 AM
To: Windows System Software Devs Interest List
Subject: RE: RE:[ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)

Hi Doron,
I know it’s dirt simple to test but not when you are travelling and do not have access to your development environment.

Thanks,
– Aj

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Friday, March 12, 2010 5:49 PM
To: Windows System Software Devs Interest List
Subject: RE: RE:[ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)
This is so dirt simple for you to test on your own, have you done that? I mean in the time it took you to send the 2nd msg, you could have already written the test app

d

tiny phone keyboard + fat thumbs = you do the muth

From: Ajitabh Saxena
Sent: Friday, March 12, 2010 5:37 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)
Guys…I need this…anyone please. :slight_smile:

________________________________
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Ajitabh Saxena
Sent: Friday, March 12, 2010 4:47 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)
Hi All,
I was just curious that what is the behaviour of DuplicateHandle(API) with respect to IRP_MJ_CREATE.

First the scenerio:
===============
1. One application (APP-1) calls CreateFile to open a handle to a function driver’s FDO.
2. Other thread/or other process (APP-2) calls DuplicateHandle for the same device.

Questions:
===========
1. When the other process calls DuplicateHandle, will the function driver’s IRP_MJ_CREATE handler gets called?
2. When will the IRP_MJ_CLEANUP get called? (After both the handles are closed or only when the original handle gets closed?)
3. Will the IRP from both the process have same Irp->FileObject.

Your answers are highly appreciated.
Thanks,
– Ajitabh.

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

__________ Information from ESET Smart Security, version of virus signature database 4946 (20100315)

The message was checked by ESET Smart Security.

http://www.eset.com

 Information from ESET Smart Security, version of virus signature database 4946 (20100315) __________

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

9

That is right…but I did not think of it then.
Will remeber this.
Thanks, Doron.
– Aj.

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Monday, March 15, 2010 2:09 PM
To: Windows System Software Devs Interest List
Subject: RE: RE:[ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)

You could easily install a root enumerated UMDF driver (take the skeleton sample for instance) and run the entire experiment from your laptop. Or using a VM and debug a km root enumerated driver.

d

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Ajitabh Saxena
Sent: Monday, March 15, 2010 2:03 PM
To: Windows System Software Devs Interest List
Subject: RE: RE:[ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)

Come on Gary…I am glad you marked that as your “Personal Opinion”. I had my laptop with all the build environment and everything. The only thing that was missing was my hardware in the system. My hardware is a PCI-E card (with a huge formfactor since its the debug version of the hardware with all JTAG and UARTS) and I have a WDM driver for that. Do you expect me to open the laptop put the hardware in it and then test it out…by the way I did test it out once I reached the customer site. The reason I requested a response was because before reaching there I wanted know the expected behaviour.

Anyway, with all due respect…there is no reason for anyone to give excuses on this mailing list. Its a forum of experts and I belive sometime or other everyone would have been in situations like these.

I did not give a lame excuse it was the reality of situation.
Are you a professor or something? :slight_smile:

The personal Opinion of…
– Aj.

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Gary G. Little
Sent: Monday, March 15, 2010 12:49 PM
To: Windows System Software Devs Interest List
Subject: RE: RE:[ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)
Oh come on. That is one of the lameest excuses I have heard. If you’re traveling then how did you submit the emails? Signal flags? Smoke signals? Carrier pidgeon? If it’s vacataion for you, then don’t ask till you get home and go back to work. If it’s on business and you used your business laptop, then why in the bloody hell don’t you have a build environment installed on your laptop, with your latest source? I can always do a build at the customers site if I have to, as well as using WinDbg either serial or 1394. So “not when you are traveling” really only applies to them looking at the world through their navel.

The personal opinion of
Gary G. Little

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Ajitabh Saxena
Sent: Monday, March 15, 2010 10:54 AM
To: Windows System Software Devs Interest List
Subject: RE: RE:[ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)

Hi Doron,
I know it’s dirt simple to test but not when you are travelling and do not have access to your development environment.

Thanks,
– Aj

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Friday, March 12, 2010 5:49 PM
To: Windows System Software Devs Interest List
Subject: RE: RE:[ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)
This is so dirt simple for you to test on your own, have you done that? I mean in the time it took you to send the 2nd msg, you could have already written the test app

d

tiny phone keyboard + fat thumbs = you do the muth

From: Ajitabh Saxena
Sent: Friday, March 12, 2010 5:37 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)
Guys…I need this…anyone please. :slight_smile:

________________________________
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Ajitabh Saxena
Sent: Friday, March 12, 2010 4:47 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] IRP_MJ_CREATE and DuplicateHandle(SDK)
Hi All,
I was just curious that what is the behaviour of DuplicateHandle(API) with respect to IRP_MJ_CREATE.

First the scenerio:
===============
1. One application (APP-1) calls CreateFile to open a handle to a function driver’s FDO.
2. Other thread/or other process (APP-2) calls DuplicateHandle for the same device.

Questions:
===========
1. When the other process calls DuplicateHandle, will the function driver’s IRP_MJ_CREATE handler gets called?
2. When will the IRP_MJ_CLEANUP get called? (After both the handles are closed or only when the original handle gets closed?)
3. Will the IRP from both the process have same Irp->FileObject.

Your answers are highly appreciated.
Thanks,
– Ajitabh.

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

__________ Information from ESET Smart Security, version of virus signature database 4946 (20100315)

The message was checked by ESET Smart Security.

http://www.eset.com

 Information from ESET Smart Security, version of virus signature database 4946 (20100315) __________

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

10

>.1. When the other process calls DuplicateHandle, will the function driver’s IRP_MJ_CREATE

handler gets called?

No. Handle duplication just creates a new descriptor, but a description itself (i.e file object) always stays the same…

  1. When will the IRP_MJ_CLEANUP get called? (After both the handles are closed or only
    when the original handle gets closed?)

When handle refcount goes down to zero, which, for understandable reasons, is not going to happen as long as at least one handle is open. When total refcount goes down to zero (which may , although not necessarily will, happen when all outstanding handles are closed) IRP_MJ_CLOSE will get sent as well

  1. Will the IRP from both the process have same Irp->FileObject.

Of course - description is going to be the same for both descriptors, don’t you think …

Anton Bassov