I am not new to NT driver programming but am I new to NDIS. I was wondering
if it is safe to import functions from ntoskrnl.lib into an NDIS 5.0/5.1 IM
filter driver (NT platforms only)?
Specifically:
ZwCreateFile/ZwOpenFile
ZwWriteFile
PsCreateSystemThread
C run time functions like isspace etc…
Thanks, Jon
“Jon Anglin” wrote in message news:xxxxx@ntdev…
>I am not new to NT driver programming but am I new to NDIS. I was
>wondering if it is safe to import functions from ntoskrnl.lib into an NDIS
>5.0/5.1 IM filter driver (NT platforms only)?
>
> Specifically:
> ZwCreateFile/ZwOpenFile
> ZwWriteFile
> PsCreateSystemThread
> C run time functions like isspace etc…
>
>
> Thanks, Jon
>
If at all possible, use NDIS library functions. For example, perhaps
NdisScheduleWorkItem instead of PsCreateSystemThread, NdisOpenFile instead
of ZwXYZ. These have limitations/restrictions on their use but if they can
be shoe-horned into your design, then you are going to be better off.
Try to stay away from the C-runtime library. It really has no business being
used in the kernel.
String functions are particularly dangerous in the kernel. See the DDK topic
“Using Safe String Functions”. Using these functions is certainly a little
clumsy, but worth the effort if you want your driver to survive.
In reality you can use almost any kernel API in a NDIS IM driver. However,
you will have to justify the use of any non-NDIS functions to WHQL to get
your driver signed.
Hope this helps.
Thomas F. Divine, Windows DDK MVP
http://www.pcausa.com