MiniFilter Driver ERROR : IRQL_NOT_LESS_OR_EQUAL

NTFSD
1

Hi,all
I want call FltReadFile in Post-Create routine to check the file’s
content,the system crash random with the error IRQL_NOT_LESS_OR_EQUAL on
this call. As the ddk help said,the caller of FltReadFile must run at
Passive Level,but the Post-Create routine is run at DPC Level,and in
microsoft’s minifilter sample(scanner),call the fltreadfile in post-create
routin. How to fix this problem?BTW,which IRQL the pre-operation run at?

Thanks!

Murphy

English is not my mother language,please forgive my awful syntax.

2

Welcome to the “I have a driver and it does not work” club.

Get crash dump, install Windbg, invoke the crash again, do
!analyze on it and see why and where it crashed.

L.

3

PostCreate is always called in the requestor’s thread at IRQL <= APC_LEVEL
therefore, e.g. this function can be declared in #pragma alloc_text( PAGE, … )

you had to call a routine which raises IRQL before FltReadFile function, haven’t you?

  • Petr Kurtin

“ntfsd” wrote in message news:xxxxx@ntfsd…
> Hi,all
> I want call FltReadFile in Post-Create routine to check the file’s
> content,the system crash random with the error IRQL_NOT_LESS_OR_EQUAL on
> this call. As the ddk help said,the caller of FltReadFile must run at
> Passive Level,but the Post-Create routine is run at DPC Level,and in
> microsoft’s minifilter sample(scanner),call the fltreadfile in post-create
> routin. How to fix this problem?BTW,which IRQL the pre-operation run at?
>
> Thanks!
>
>
> Murphy
>
> English is not my mother language,please forgive my awful syntax.
>
>
>
>
>