IRQL

I find that sometimes I get IRQL = 1 in FilemonHookRoutine in the example
Filemon. Is it normal to have IRQL > PASSIVE_LEVEL?

I cannot use any ZwCreateFile, ZwReadFile,… some Rtl… in IRQL other
than PASSIVE_LEVEL?

Can filter driver only run at PASSIVE_LEVEL?

> I find that sometimes I get IRQL = 1 in FilemonHookRoutine in the example

Filemon. Is it normal to have IRQL > PASSIVE_LEVEL?

Paging IO (at least reads) always run on APC_LEVEL.

Max

Yap, and an interesting thing to note is that at those times a filter must
not call into the file system to ask for a file name, if it doesn’t have it,
otherwise, the system is VERY likely to hang totally, in a stressed situation -
such as encrypting a large number of files on NTFS.

Regards, Dejan.

“Maxim S. Shatskih” wrote:

> I find that sometimes I get IRQL = 1 in FilemonHookRoutine in the example
> Filemon. Is it normal to have IRQL > PASSIVE_LEVEL?

Paging IO (at least reads) always run on APC_LEVEL.

Max


You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to %%email.unsub%%


Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa Registry Monitor - Registry monitoring library for Win32 developers.
Alfa Registry Protector - Registry protection library for Win32 developers.

I want to use Rtl… and Zw… when an IRP_MJ_CREATE is receieved.

Can I assume that IRP_MJ_CREATE is always at PASSIVE_LEVEL?

Thanks.