IRQL of Minifilter's MessageNotifyCallback

NTFSD
1

When a user-mode application calls FilterSendMessage, the filter manager will call the minifilter’s MessageNotifyCallback routine. Then at which IRQL will this routine be running? Is it safe to use Resources here, or a spin lock is better?

thanks

¸Ï¿ì×¢²áÑÅ»¢³¬´óÈÝÁ¿Ãâ·ÑÓÊÏä?
http://cn.mail.yahoo.com

2

Why not look at the example? miniSpy has all the code for this.
“dot qian” wrote in message news:xxxxx@ntfsd…
When a user-mode application calls FilterSendMessage, the filter manager will call the minifilter’s MessageNotifyCallback routine. Then at which IRQL will this routine be running? Is it safe to use Resources here, or a spin lock is better?

thanks
__________________________________________________
?Ͽ?ע???Ż???
http://cn.mail.yahoo.com

3

Thanks David. I do have looked at the miniSpy example. But in my case, a multi-read, exclusively write synchronization object like resource is preferable to the spin lock. So I want to know if it can be used in the message callback routine, for it cannot be acquired at IRQL >= DISPATCH_LEVEL.

“David J. Craig” дµÀ£º Why not look at the example? miniSpy has all the code for this.
“dot qian” wrote in message news:xxxxx@ntfsd…
When a user-mode application calls FilterSendMessage, the filter manager will call the minifilter’s MessageNotifyCallback routine. Then at which IRQL will this routine be running? Is it safe to use Resources here, or a spin lock is better?

thanks

¸Ï¿ì×¢²áÑÅ»¢³¬´óÈÝÁ¿Ãâ·ÑÓÊÏä?
http://cn.mail.yahoo.com

—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


¸Ï¿ì×¢²áÑÅ»¢³¬´óÈÝÁ¿Ãâ·ÑÓÊÏä?
http://cn.mail.yahoo.com

4

You should have asked the question differently. Maybe asking why miniSpy uses a spinlock and not a resource. I suspect that if you read the comments in the miniSpy code where the log records are placed in the queue, that might give you a clue.
“dot qian” wrote in message news:xxxxx@ntfsd…
Thanks David. I do have looked at the miniSpy example. But in my case, a multi-read, exclusively write synchronization object like resource is preferable to the spin lock. So I want to know if it can be used in the message callback routine, for it cannot be acquired at IRQL >= DISPATCH_LEVEL.

“David J. Craig” д???
Why not look at the example? miniSpy has all the code for this.
“dot qian” wrote in message news:xxxxx@ntfsd…
When a user-mode application calls FilterSendMessage, the filter manager will call the minifilter’s MessageNotifyCallback routine. Then at which IRQL will this routine be running? Is it safe to use Resources here, or a spin lock is better?

thanks

?Ͽ?ע???Ż???
http://cn.mail.yahoo.com

—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


?Ͽ?ע???Ż???
http://cn.mail.yahoo.com

5

The PAGED_CODE macro in the minispy sample suggests that IRQL<=APC_LEVEL like in most of the other minifilter callbacks.

/Daniel

“dot qian” wrote in message news:xxxxx@ntfsd…
When a user-mode application calls FilterSendMessage, the filter manager will call the minifilter’s MessageNotifyCallback routine. Then at which IRQL will this routine be running? Is it safe to use Resources here, or a spin lock is better?

6

Thanks David. I read the miniSpy example again. And I think miniSpy donnot need the multi-read, exclusively write feature, and, the log records are placed in the queue in the postoperation routine, which can be called at IRQL DISPATCH_LEVEL.

Thanks Daniel, Maybe you are right. If the callback routine can be called at DPC level, then it must be NON-PAGED.

Anybody gives me more suggestions? Thanks.

¸Ï¿ì×¢²áÑÅ»¢³¬´óÈÝÁ¿Ãâ·ÑÓÊÏä?
http://cn.mail.yahoo.com

7

At the top there is an alloc_pragma(PAGE, SpyMessage)
which VERY explicitly specifies that SpyMessage CANNOT be called at
DISPATCH_LEVEL.
PAGED_CODE() macro is used to check that the current code does not
run at DISPATCH_LEVEL - another explicit sign.

–
Kind regards, Dejan M.
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32
developers.
Alfa File Monitor - File monitoring library for Win32 developers.