ObReferenceObjectByName

Hello,

Can anyone tell me if it’s something wrong here? I get a BSOD…


UNICODE_STRING uszCore;
KEVENT *pObCore;
NTSTATUS status;

RtlInitUnicodeString( &uszCore, L"\BaseNamedObjects\MyStopEvent" );
status = ObReferenceObjectByName(
&uszCore,
OBJ_CASE_INSENSITIVE | OBJ_OPENIF | OBJ_PERMANENT,
NULL,
0,
(POBJECT_TYPE)ExEventObjectType,
KernelMode,
NULL,
&pObCore );
if( STATUS_SUCCESS != status )
{
goto clean_up;
}
ObDereferenceObject( pObCore );

MyStopEvent it’s an event created by an windows application. I want to see if this event exists. If exists I just dereference it because i don’t need the object anymore.


Thank you,

Andrei Ciubotaru

It would help if you provided the windbg ‘analyze -v’ output from the
bugcheck. The only obvious error in your code is the following:

if( STATUS_SUCCESS != status )
{
goto clean_up;
}

Which should of course be written instead as:

if (!NT_SUCCESS(status))
{
goto clean_up;
}

Also see ZwCreateEvent which is now documented outside of the ifs kit in the
beta WDK.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
Ciubotaru [Hardwired]
Sent: Sunday, August 28, 2005 7:40 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] ObReferenceObjectByName

Hello,

Can anyone tell me if it’s something wrong here? I get a BSOD…


UNICODE_STRING uszCore;
KEVENT *pObCore;
NTSTATUS status;

RtlInitUnicodeString( &uszCore,
L"\BaseNamedObjects\MyStopEvent" );
status = ObReferenceObjectByName(
&uszCore,
OBJ_CASE_INSENSITIVE | OBJ_OPENIF | OBJ_PERMANENT,
NULL,
0,
(POBJECT_TYPE)ExEventObjectType,
KernelMode,
NULL,
&pObCore );
if( STATUS_SUCCESS != status )
{
goto clean_up;
}
ObDereferenceObject( pObCore );

MyStopEvent it’s an event created by an windows application.
I want to see if this event exists. If exists I just
dereference it because i don’t need the object anymore.


Thank you,

Andrei Ciubotaru


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as:
xxxxx@hollistech.com To unsubscribe send a blank email to
xxxxx@lists.osr.com

No. I found it. My problem is that I was calling the routine at dispatch
level. What’s wierd is that on some other computer, my driver runs at
Passive level… how is this possible?!

Finaly!!! ZwCreateEvent is documented!!! … Is there something about
mutexes also?(ZwCreateMutex I think…)

Thank you,

Andrei Ciubotaru

Mark Roddy wrote:

It would help if you provided the windbg ‘analyze -v’ output from the
bugcheck. The only obvious error in your code is the following:

if( STATUS_SUCCESS != status )
{
goto clean_up;
}

Which should of course be written instead as:

if (!NT_SUCCESS(status))
{
goto clean_up;
}

Also see ZwCreateEvent which is now documented outside of the ifs kit in the
beta WDK.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

>-----Original Message-----
>From: xxxxx@lists.osr.com
>[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
>Ciubotaru [Hardwired]
>Sent: Sunday, August 28, 2005 7:40 AM
>To: Windows System Software Devs Interest List
>Subject: [ntdev] ObReferenceObjectByName
>
>Hello,
>
>Can anyone tell me if it’s something wrong here? I get a BSOD…
>
>
>…
> UNICODE_STRING uszCore;
> KEVENT *pObCore;
> NTSTATUS status;
>
>…
>
> RtlInitUnicodeString( &uszCore,
>L"\BaseNamedObjects\MyStopEvent" );
> status = ObReferenceObjectByName(
> &uszCore,
> OBJ_CASE_INSENSITIVE | OBJ_OPENIF | OBJ_PERMANENT,
> NULL,
> 0,
> (POBJECT_TYPE)ExEventObjectType,
> KernelMode,
> NULL,
> &pObCore );
> if( STATUS_SUCCESS != status )
> {
> goto clean_up;
> }
> ObDereferenceObject( pObCore );
>…
>
>
>MyStopEvent it’s an event created by an windows application.
>I want to see if this event exists. If exists I just
>dereference it because i don’t need the object anymore.
>
>–
>Thank you,
>
>Andrei Ciubotaru
>
>
>—
>Questions? First check the Kernel Driver FAQ at
>http://www.osronline.com/article.cfm?id=256
>
>You are currently subscribed to ntdev as:
>xxxxx@hollistech.com To unsubscribe send a blank email to
>xxxxx@lists.osr.com
>
>
>


Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@icode.ro
To unsubscribe send a blank email to xxxxx@lists.osr.com

Mark, please can you give more info about ZwOpenEvent? Momentarly I
cannot download the beta. Or point me where to look for. Here on OSR I
haven’t found any relevant info about: ZwCreate/OpenXXXX(event or
mutexes). Is this ZwOpenEvent working on <= DISPATCH_LEVEL? Is it
faster or slower than ObReferenceObjectByName?

Thank you,

Andrei Ciubotaru

Mark Roddy wrote:

It would help if you provided the windbg ‘analyze -v’ output from the
bugcheck. The only obvious error in your code is the following:

if( STATUS_SUCCESS != status )
{
goto clean_up;
}

Which should of course be written instead as:

if (!NT_SUCCESS(status))
{
goto clean_up;
}

Also see ZwCreateEvent which is now documented outside of the ifs kit in the
beta WDK.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

>-----Original Message-----
>From: xxxxx@lists.osr.com
>[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
>Ciubotaru [Hardwired]
>Sent: Sunday, August 28, 2005 7:40 AM
>To: Windows System Software Devs Interest List
>Subject: [ntdev] ObReferenceObjectByName
>
>Hello,
>
>Can anyone tell me if it’s something wrong here? I get a BSOD…
>
>
>…
> UNICODE_STRING uszCore;
> KEVENT *pObCore;
> NTSTATUS status;
>
>…
>
> RtlInitUnicodeString( &uszCore,
>L"\BaseNamedObjects\MyStopEvent" );
> status = ObReferenceObjectByName(
> &uszCore,
> OBJ_CASE_INSENSITIVE | OBJ_OPENIF | OBJ_PERMANENT,
> NULL,
> 0,
> (POBJECT_TYPE)ExEventObjectType,
> KernelMode,
> NULL,
> &pObCore );
> if( STATUS_SUCCESS != status )
> {
> goto clean_up;
> }
> ObDereferenceObject( pObCore );
>…
>
>
>MyStopEvent it’s an event created by an windows application.
>I want to see if this event exists. If exists I just
>dereference it because i don’t need the object anymore.
>
>–
>Thank you,
>
>Andrei Ciubotaru
>
>
>—
>Questions? First check the Kernel Driver FAQ at
>http://www.osronline.com/article.cfm?id=256
>
>You are currently subscribed to ntdev as:
>xxxxx@hollistech.com To unsubscribe send a blank email to
>xxxxx@lists.osr.com
>
>
>


Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@icode.ro
To unsubscribe send a blank email to xxxxx@lists.osr.com

ZwOpenEvent remains undocumented. However I think you should be able to set
the parameters to ZwCreateEvent such that it will not succeed if the event
does not exist. The entire IFS kit is in the WDK - so you should really just
go download it. No ZwCreateMutex.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
Ciubotaru [Hardwired]
Sent: Sunday, August 28, 2005 1:28 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] ObReferenceObjectByName

Mark, please can you give more info about ZwOpenEvent?
Momentarly I cannot download the beta. Or point me where to
look for. Here on OSR I haven’t found any relevant info
about: ZwCreate/OpenXXXX(event or mutexes). Is this
ZwOpenEvent working on <= DISPATCH_LEVEL? Is it faster or
slower than ObReferenceObjectByName?

Thank you,

Andrei Ciubotaru

Mark Roddy wrote:

>It would help if you provided the windbg ‘analyze -v’ output
from the
>bugcheck. The only obvious error in your code is the following:
>
> if( STATUS_SUCCESS != status )
> {
> goto clean_up;
> }
>
>Which should of course be written instead as:
>
> if (!NT_SUCCESS(status))
> {
> goto clean_up;
> }
>
>Also see ZwCreateEvent which is now documented outside of
the ifs kit
>in the beta WDK.
>
>=====================
>Mark Roddy DDK MVP
>Windows 2003/XP/2000 Consulting
>Hollis Technology Solutions 603-321-1032 www.hollistech.com
>
>
>
>>-----Original Message-----
>>From: xxxxx@lists.osr.com
>>[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
>>Ciubotaru [Hardwired]
>>Sent: Sunday, August 28, 2005 7:40 AM
>>To: Windows System Software Devs Interest List
>>Subject: [ntdev] ObReferenceObjectByName
>>
>>Hello,
>>
>>Can anyone tell me if it’s something wrong here? I get a BSOD…
>>
>>
>>…
>> UNICODE_STRING uszCore;
>> KEVENT *pObCore;
>> NTSTATUS status;
>>
>>…
>>
>> RtlInitUnicodeString( &uszCore,
>>L"\BaseNamedObjects\MyStopEvent" );
>> status = ObReferenceObjectByName(
>> &uszCore,
>> OBJ_CASE_INSENSITIVE | OBJ_OPENIF | OBJ_PERMANENT,
>> NULL,
>> 0,
>> (POBJECT_TYPE)ExEventObjectType,
>> KernelMode,
>> NULL,
>> &pObCore );
>> if( STATUS_SUCCESS != status )
>> {
>> goto clean_up;
>> }
>> ObDereferenceObject( pObCore );
>>…
>>
>>
>>MyStopEvent it’s an event created by an windows application.
>>I want to see if this event exists. If exists I just dereference it
>>because i don’t need the object anymore.
>>
>>–
>>Thank you,
>>
>>Andrei Ciubotaru
>>
>>
>>—
>>Questions? First check the Kernel Driver FAQ at
>>http://www.osronline.com/article.cfm?id=256
>>
>>You are currently subscribed to ntdev as:
>>xxxxx@hollistech.com To unsubscribe send a blank email to
>>xxxxx@lists.osr.com
>>
>>
>>
>
>
>
>—
>Questions? First check the Kernel Driver FAQ at
>http://www.osronline.com/article.cfm?id=256
>
>You are currently subscribed to ntdev as: xxxxx@icode.ro To
>unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as:
xxxxx@hollistech.com To unsubscribe send a blank email to
xxxxx@lists.osr.com

Thank you! I solved the problem with ZwOpenEvent. Works just fine. But
my real problem was something else. I made the same mistake with
ZwOpenEvent too. Soemthing like this:

KeAcquireSpinLock( &SomeSpin, &irql );
__try
{
ZwOpen…
ZwClose…
}
__finally
{
KeReleaseSpinLock( &SomeSpin, irql );
}

It seems that it’s not a good thing to acquire a spin lock and try
open/access/close some named object :). This made me realize that I
don’t know s#$@ and put my hands on THE BOOK again!

Again, thank you for your help. Anyway I managed to get “Windows Native
API” book. Till MS releases the next ddk(let’s all pray that “the one to
rules them all” thinks to properly document this) this one rules.

Thank you,

Andrei Ciubotaru

Mark Roddy wrote:

ZwOpenEvent remains undocumented. However I think you should be able to set
the parameters to ZwCreateEvent such that it will not succeed if the event
does not exist. The entire IFS kit is in the WDK - so you should really just
go download it. No ZwCreateMutex.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

>-----Original Message-----
>From: xxxxx@lists.osr.com
>[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
>Ciubotaru [Hardwired]
>Sent: Sunday, August 28, 2005 1:28 PM
>To: Windows System Software Devs Interest List
>Subject: Re: [ntdev] ObReferenceObjectByName
>
>Mark, please can you give more info about ZwOpenEvent?
>Momentarly I cannot download the beta. Or point me where to
>look for. Here on OSR I haven’t found any relevant info
>about: ZwCreate/OpenXXXX(event or mutexes). Is this
>ZwOpenEvent working on <= DISPATCH_LEVEL? Is it faster or
>slower than ObReferenceObjectByName?
>
>
>Thank you,
>
>Andrei Ciubotaru
>
>
>
>
>
>Mark Roddy wrote:
>
>
>
>>It would help if you provided the windbg ‘analyze -v’ output
>>
>>
>from the
>
>
>>bugcheck. The only obvious error in your code is the following:
>>
>>if( STATUS_SUCCESS != status )
>> {
>> goto clean_up;
>> }
>>
>>Which should of course be written instead as:
>>
>>if (!NT_SUCCESS(status))
>>{
>> goto clean_up;
>>}
>>
>>Also see ZwCreateEvent which is now documented outside of
>>
>>
>the ifs kit
>
>
>>in the beta WDK.
>>
>>=====================
>>Mark Roddy DDK MVP
>>Windows 2003/XP/2000 Consulting
>>Hollis Technology Solutions 603-321-1032 www.hollistech.com
>>
>>
>>
>>
>>
>>>-----Original Message-----
>>>From: xxxxx@lists.osr.com
>>>[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
>>>Ciubotaru [Hardwired]
>>>Sent: Sunday, August 28, 2005 7:40 AM
>>>To: Windows System Software Devs Interest List
>>>Subject: [ntdev] ObReferenceObjectByName
>>>
>>>Hello,
>>>
>>>Can anyone tell me if it’s something wrong here? I get a BSOD…
>>>
>>>
>>>…
>>> UNICODE_STRING uszCore;
>>> KEVENT *pObCore;
>>> NTSTATUS status;
>>>
>>>…
>>>
>>> RtlInitUnicodeString( &uszCore,
>>>L"\BaseNamedObjects\MyStopEvent" );
>>> status = ObReferenceObjectByName(
>>> &uszCore,
>>> OBJ_CASE_INSENSITIVE | OBJ_OPENIF | OBJ_PERMANENT,
>>> NULL,
>>> 0,
>>> (POBJECT_TYPE)ExEventObjectType,
>>> KernelMode,
>>> NULL,
>>> &pObCore );
>>> if( STATUS_SUCCESS != status )
>>> {
>>> goto clean_up;
>>> }
>>> ObDereferenceObject( pObCore );
>>>…
>>>
>>>
>>>MyStopEvent it’s an event created by an windows application.
>>>I want to see if this event exists. If exists I just dereference it
>>>because i don’t need the object anymore.
>>>
>>>–
>>>Thank you,
>>>
>>>Andrei Ciubotaru
>>>
>>>
>>>—
>>>Questions? First check the Kernel Driver FAQ at
>>>http://www.osronline.com/article.cfm?id=256
>>>
>>>You are currently subscribed to ntdev as:
>>>xxxxx@hollistech.com To unsubscribe send a blank email to
>>>xxxxx@lists.osr.com
>>>
>>>
>>>
>>>
>>>
>>
>>—
>>Questions? First check the Kernel Driver FAQ at
>>http://www.osronline.com/article.cfm?id=256
>>
>>You are currently subscribed to ntdev as: xxxxx@icode.ro To
>>unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>>
>>
>>
>—
>Questions? First check the Kernel Driver FAQ at
>http://www.osronline.com/article.cfm?id=256
>
>You are currently subscribed to ntdev as:
>xxxxx@hollistech.com To unsubscribe send a blank email to
>xxxxx@lists.osr.com
>
>
>


Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@icode.ro
To unsubscribe send a blank email to xxxxx@lists.osr.com

If you are at passive level and need to serialize against other passive
level threads, consider using a resource lock or an event lock instead. By
the way, the exception handling should not be neccesary.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
Ciubotaru [Hardwired]
Sent: Sunday, August 28, 2005 8:06 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] ObReferenceObjectByName

Thank you! I solved the problem with ZwOpenEvent. Works just
fine. But my real problem was something else. I made the same
mistake with ZwOpenEvent too. Soemthing like this:

KeAcquireSpinLock( &SomeSpin, &irql );
__try
{
ZwOpen…
ZwClose…
}
__finally
{
KeReleaseSpinLock( &SomeSpin, irql ); }

It seems that it’s not a good thing to acquire a spin lock
and try open/access/close some named object :). This made me
realize that I don’t know s#$@ and put my hands on THE BOOK again!

Again, thank you for your help. Anyway I managed to get
“Windows Native API” book. Till MS releases the next
ddk(let’s all pray that “the one to rules them all” thinks to
properly document this) this one rules.

Thank you,

Andrei Ciubotaru

Mark Roddy wrote:

>ZwOpenEvent remains undocumented. However I think you should
be able to
>set the parameters to ZwCreateEvent such that it will not succeed if
>the event does not exist. The entire IFS kit is in the WDK - so you
>should really just go download it. No ZwCreateMutex.
>
>=====================
>Mark Roddy DDK MVP
>Windows 2003/XP/2000 Consulting
>Hollis Technology Solutions 603-321-1032 www.hollistech.com
>
>
>
>>-----Original Message-----
>>From: xxxxx@lists.osr.com
>>[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
>>Ciubotaru [Hardwired]
>>Sent: Sunday, August 28, 2005 1:28 PM
>>To: Windows System Software Devs Interest List
>>Subject: Re: [ntdev] ObReferenceObjectByName
>>
>>Mark, please can you give more info about ZwOpenEvent?
>>Momentarly I cannot download the beta. Or point me where to
look for.
>>Here on OSR I haven’t found any relevant info
>>about: ZwCreate/OpenXXXX(event or mutexes). Is this ZwOpenEvent
>>working on <= DISPATCH_LEVEL? Is it faster or slower than
>>ObReferenceObjectByName?
>>
>>
>>Thank you,
>>
>>Andrei Ciubotaru
>>
>>
>>
>>
>>
>>Mark Roddy wrote:
>>
>>
>>
>>>It would help if you provided the windbg ‘analyze -v’ output
>>>
>>>
>>from the
>>
>>
>>>bugcheck. The only obvious error in your code is the following:
>>>
>>>if( STATUS_SUCCESS != status )
>>> {
>>> goto clean_up;
>>> }
>>>
>>>Which should of course be written instead as:
>>>
>>>if (!NT_SUCCESS(status))
>>>{
>>> goto clean_up;
>>>}
>>>
>>>Also see ZwCreateEvent which is now documented outside of
>>>
>>>
>>the ifs kit
>>
>>
>>>in the beta WDK.
>>>
>>>=====================
>>>Mark Roddy DDK MVP
>>>Windows 2003/XP/2000 Consulting
>>>Hollis Technology Solutions 603-321-1032 www.hollistech.com
>>>
>>>
>>>
>>>
>>>
>>>>-----Original Message-----
>>>>From: xxxxx@lists.osr.com
>>>>[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
>>>>Ciubotaru [Hardwired]
>>>>Sent: Sunday, August 28, 2005 7:40 AM
>>>>To: Windows System Software Devs Interest List
>>>>Subject: [ntdev] ObReferenceObjectByName
>>>>
>>>>Hello,
>>>>
>>>>Can anyone tell me if it’s something wrong here? I get a BSOD…
>>>>
>>>>
>>>>…
>>>> UNICODE_STRING uszCore;
>>>> KEVENT *pObCore;
>>>> NTSTATUS status;
>>>>
>>>>…
>>>>
>>>> RtlInitUnicodeString( &uszCore,
>>>>L"\BaseNamedObjects\MyStopEvent" );
>>>> status = ObReferenceObjectByName(
>>>> &uszCore,
>>>> OBJ_CASE_INSENSITIVE | OBJ_OPENIF | OBJ_PERMANENT,
>>>> NULL,
>>>> 0,
>>>> (POBJECT_TYPE)ExEventObjectType,
>>>> KernelMode,
>>>> NULL,
>>>> &pObCore );
>>>> if( STATUS_SUCCESS != status )
>>>> {
>>>> goto clean_up;
>>>> }
>>>> ObDereferenceObject( pObCore );
>>>>…
>>>>
>>>>
>>>>MyStopEvent it’s an event created by an windows application.
>>>>I want to see if this event exists. If exists I just
dereference it
>>>>because i don’t need the object anymore.
>>>>
>>>>–
>>>>Thank you,
>>>>
>>>>Andrei Ciubotaru
>>>>
>>>>
>>>>—
>>>>Questions? First check the Kernel Driver FAQ at
>>>>http://www.osronline.com/article.cfm?id=256
>>>>
>>>>You are currently subscribed to ntdev as:
>>>>xxxxx@hollistech.com To unsubscribe send a blank email to
>>>>xxxxx@lists.osr.com
>>>>
>>>>
>>>>
>>>>
>>>>
>>>
>>>—
>>>Questions? First check the Kernel Driver FAQ at
>>>http://www.osronline.com/article.cfm?id=256
>>>
>>>You are currently subscribed to ntdev as: xxxxx@icode.ro To
>>>unsubscribe send a blank email to xxxxx@lists.osr.com
>>>
>>>
>>>
>>>
>>>
>>—
>>Questions? First check the Kernel Driver FAQ at
>>http://www.osronline.com/article.cfm?id=256
>>
>>You are currently subscribed to ntdev as:
>>xxxxx@hollistech.com To unsubscribe send a blank email to
>>xxxxx@lists.osr.com
>>
>>
>>
>
>
>
>—
>Questions? First check the Kernel Driver FAQ at
>http://www.osronline.com/article.cfm?id=256
>
>You are currently subscribed to ntdev as: xxxxx@icode.ro To
>unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as:
xxxxx@hollistech.com To unsubscribe send a blank email to
xxxxx@lists.osr.com

I got used with __try… i put it everywhere i have the ocasion:) - bad
habbit.

I’ll try with the event. Is it faster that the spin lock? What if
somewhere I am not allowed to wait?.. i got about 80 BSODs today…

Thank you,

Andrei Ciubotaru

Mark Roddy wrote:

If you are at passive level and need to serialize against other passive
level threads, consider using a resource lock or an event lock instead. By
the way, the exception handling should not be neccesary.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

>-----Original Message-----
>From: xxxxx@lists.osr.com
>[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
>Ciubotaru [Hardwired]
>Sent: Sunday, August 28, 2005 8:06 PM
>To: Windows System Software Devs Interest List
>Subject: Re: [ntdev] ObReferenceObjectByName
>
>Thank you! I solved the problem with ZwOpenEvent. Works just
>fine. But my real problem was something else. I made the same
>mistake with ZwOpenEvent too. Soemthing like this:
>
>KeAcquireSpinLock( &SomeSpin, &irql );
>__try
>{
> ZwOpen…
> ZwClose…
>}
>__finally
>{
> KeReleaseSpinLock( &SomeSpin, irql ); }
>
>It seems that it’s not a good thing to acquire a spin lock
>and try open/access/close some named object :). This made me
>realize that I don’t know s#$@ and put my hands on THE BOOK again!
>
>Again, thank you for your help. Anyway I managed to get
>“Windows Native API” book. Till MS releases the next
>ddk(let’s all pray that “the one to rules them all” thinks to
>properly document this) this one rules.
>
>
>Thank you,
>
>Andrei Ciubotaru
>
>
>
>
>
>Mark Roddy wrote:
>
>
>
>>ZwOpenEvent remains undocumented. However I think you should
>>
>>
>be able to
>
>
>>set the parameters to ZwCreateEvent such that it will not succeed if
>>the event does not exist. The entire IFS kit is in the WDK - so you
>>should really just go download it. No ZwCreateMutex.
>>
>>=====================
>>Mark Roddy DDK MVP
>>Windows 2003/XP/2000 Consulting
>>Hollis Technology Solutions 603-321-1032 www.hollistech.com
>>
>>
>>
>>
>>
>>>-----Original Message-----
>>>From: xxxxx@lists.osr.com
>>>[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
>>>Ciubotaru [Hardwired]
>>>Sent: Sunday, August 28, 2005 1:28 PM
>>>To: Windows System Software Devs Interest List
>>>Subject: Re: [ntdev] ObReferenceObjectByName
>>>
>>>Mark, please can you give more info about ZwOpenEvent?
>>>Momentarly I cannot download the beta. Or point me where to
>>>
>>>
>look for.
>
>
>>>Here on OSR I haven’t found any relevant info
>>>about: ZwCreate/OpenXXXX(event or mutexes). Is this ZwOpenEvent
>>>working on <= DISPATCH_LEVEL? Is it faster or slower than
>>>ObReferenceObjectByName?
>>>
>>>
>>>Thank you,
>>>
>>>Andrei Ciubotaru
>>>
>>>
>>>
>>>
>>>
>>>Mark Roddy wrote:
>>>
>>>
>>>
>>>
>>>
>>>>It would help if you provided the windbg ‘analyze -v’ output
>>>>
>>>>
>>>>
>>>>
>>>from the
>>
>>
>>>
>>>
>>>
>>>
>>>>bugcheck. The only obvious error in your code is the following:
>>>>
>>>>if( STATUS_SUCCESS != status )
>>>> {
>>>> goto clean_up;
>>>> }
>>>>
>>>>Which should of course be written instead as:
>>>>
>>>>if (!NT_SUCCESS(status))
>>>>{
>>>> goto clean_up;
>>>>}
>>>>
>>>>Also see ZwCreateEvent which is now documented outside of
>>>>
>>>>
>>>>
>>>>
>>>the ifs kit
>>>
>>>
>>>
>>>
>>>>in the beta WDK.
>>>>
>>>>=====================
>>>>Mark Roddy DDK MVP
>>>>Windows 2003/XP/2000 Consulting
>>>>Hollis Technology Solutions 603-321-1032 www.hollistech.com
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>>-----Original Message-----
>>>>>From: xxxxx@lists.osr.com
>>>>>[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
>>>>>Ciubotaru [Hardwired]
>>>>>Sent: Sunday, August 28, 2005 7:40 AM
>>>>>To: Windows System Software Devs Interest List
>>>>>Subject: [ntdev] ObReferenceObjectByName
>>>>>
>>>>>Hello,
>>>>>
>>>>>Can anyone tell me if it’s something wrong here? I get a BSOD…
>>>>>
>>>>>
>>>>>…
>>>>> UNICODE_STRING uszCore;
>>>>> KEVENT *pObCore;
>>>>> NTSTATUS status;
>>>>>
>>>>>…
>>>>>
>>>>> RtlInitUnicodeString( &uszCore,
>>>>>L"\BaseNamedObjects\MyStopEvent" );
>>>>> status = ObReferenceObjectByName(
>>>>> &uszCore,
>>>>> OBJ_CASE_INSENSITIVE | OBJ_OPENIF | OBJ_PERMANENT,
>>>>> NULL,
>>>>> 0,
>>>>> (POBJECT_TYPE)ExEventObjectType,
>>>>> KernelMode,
>>>>> NULL,
>>>>> &pObCore );
>>>>> if( STATUS_SUCCESS != status )
>>>>> {
>>>>> goto clean_up;
>>>>> }
>>>>> ObDereferenceObject( pObCore );
>>>>>…
>>>>>
>>>>>
>>>>>MyStopEvent it’s an event created by an windows application.
>>>>>I want to see if this event exists. If exists I just
>>>>>
>>>>>
>dereference it
>
>
>>>>>because i don’t need the object anymore.
>>>>>
>>>>>–
>>>>>Thank you,
>>>>>
>>>>>Andrei Ciubotaru
>>>>>
>>>>>
>>>>>—
>>>>>Questions? First check the Kernel Driver FAQ at
>>>>>http://www.osronline.com/article.cfm?id=256
>>>>>
>>>>>You are currently subscribed to ntdev as:
>>>>>xxxxx@hollistech.com To unsubscribe send a blank email to
>>>>>xxxxx@lists.osr.com
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>—
>>>>Questions? First check the Kernel Driver FAQ at
>>>>http://www.osronline.com/article.cfm?id=256
>>>>
>>>>You are currently subscribed to ntdev as: xxxxx@icode.ro To
>>>>unsubscribe send a blank email to xxxxx@lists.osr.com
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>—
>>>Questions? First check the Kernel Driver FAQ at
>>>http://www.osronline.com/article.cfm?id=256
>>>
>>>You are currently subscribed to ntdev as:
>>>xxxxx@hollistech.com To unsubscribe send a blank email to
>>>xxxxx@lists.osr.com
>>>
>>>
>>>
>>>
>>>
>>
>>—
>>Questions? First check the Kernel Driver FAQ at
>>http://www.osronline.com/article.cfm?id=256
>>
>>You are currently subscribed to ntdev as: xxxxx@icode.ro To
>>unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>>
>>
>>
>—
>Questions? First check the Kernel Driver FAQ at
>http://www.osronline.com/article.cfm?id=256
>
>You are currently subscribed to ntdev as:
>xxxxx@hollistech.com To unsubscribe send a blank email to
>xxxxx@lists.osr.com
>
>
>


Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@icode.ro
To unsubscribe send a blank email to xxxxx@lists.osr.com

The only thing “faster” than a spin lock is an in stack queued spin
lock. All dispatcher objects in the system (including KEVENT objects)
are covered with the system global dispatcher database lock.

Of course, none of this matters when running on a UP system, since none
of the interlocked memory nonsense is used at all. But unless you are
talking about something you expect to be doing thousands (or tens of
thousands) of times per second the performance of the KEVENT is not
likely to make any appreciable difference.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei Ciubotaru
[Hardwired]
Sent: Sunday, August 28, 2005 10:19 PM
To: ntdev redirect
Subject: Re: [ntdev] ObReferenceObjectByName

I got used with __try… i put it everywhere i have the ocasion:) - bad
habbit.

I’ll try with the event. Is it faster that the spin lock? What if
somewhere I am not allowed to wait?.. i got about 80 BSODs today…

Thank you,

Andrei Ciubotaru

Mark Roddy wrote:

If you are at passive level and need to serialize against other passive
level threads, consider using a resource lock or an event lock instead.
By
the way, the exception handling should not be neccesary.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

>-----Original Message-----
>From: xxxxx@lists.osr.com
>[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
>Ciubotaru [Hardwired]
>Sent: Sunday, August 28, 2005 8:06 PM
>To: Windows System Software Devs Interest List
>Subject: Re: [ntdev] ObReferenceObjectByName
>
>Thank you! I solved the problem with ZwOpenEvent. Works just
>fine. But my real problem was something else. I made the same
>mistake with ZwOpenEvent too. Soemthing like this:
>
>KeAcquireSpinLock( &SomeSpin, &irql );
>__try
>{
> ZwOpen…
> ZwClose…
>}
>__finally
>{
> KeReleaseSpinLock( &SomeSpin, irql ); }
>
>It seems that it’s not a good thing to acquire a spin lock
>and try open/access/close some named object :). This made me
>realize that I don’t know s#$@ and put my hands on THE BOOK again!
>
>Again, thank you for your help. Anyway I managed to get
>“Windows Native API” book. Till MS releases the next
>ddk(let’s all pray that “the one to rules them all” thinks to
>properly document this) this one rules.
>
>
>Thank you,
>
>Andrei Ciubotaru
>
>
>
>
>
>Mark Roddy wrote:
>
>
>
>>ZwOpenEvent remains undocumented. However I think you should
>>
>>
>be able to
>
>
>>set the parameters to ZwCreateEvent such that it will not succeed if
>>the event does not exist. The entire IFS kit is in the WDK - so you
>>should really just go download it. No ZwCreateMutex.
>>
>>=====================
>>Mark Roddy DDK MVP
>>Windows 2003/XP/2000 Consulting
>>Hollis Technology Solutions 603-321-1032 www.hollistech.com
>>
>>
>>
>>
>>
>>>-----Original Message-----
>>>From: xxxxx@lists.osr.com
>>>[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
>>>Ciubotaru [Hardwired]
>>>Sent: Sunday, August 28, 2005 1:28 PM
>>>To: Windows System Software Devs Interest List
>>>Subject: Re: [ntdev] ObReferenceObjectByName
>>>
>>>Mark, please can you give more info about ZwOpenEvent?
>>>Momentarly I cannot download the beta. Or point me where to
>>>
>>>
>look for.
>
>
>>>Here on OSR I haven’t found any relevant info
>>>about: ZwCreate/OpenXXXX(event or mutexes). Is this ZwOpenEvent
>>>working on <= DISPATCH_LEVEL? Is it faster or slower than
>>>ObReferenceObjectByName?
>>>
>>>
>>>Thank you,
>>>
>>>Andrei Ciubotaru
>>>
>>>
>>>
>>>
>>>
>>>Mark Roddy wrote:
>>>
>>>
>>>
>>>
>>>
>>>>It would help if you provided the windbg ‘analyze -v’ output
>>>>
>>>>
>>>>
>>>>
>>>from the
>>
>>
>>>
>>>
>>>
>>>
>>>>bugcheck. The only obvious error in your code is the following:
>>>>
>>>>if( STATUS_SUCCESS != status )
>>>> {
>>>> goto clean_up;
>>>> }
>>>>
>>>>Which should of course be written instead as:
>>>>
>>>>if (!NT_SUCCESS(status))
>>>>{
>>>> goto clean_up;
>>>>}
>>>>
>>>>Also see ZwCreateEvent which is now documented outside of
>>>>
>>>>
>>>>
>>>>
>>>the ifs kit
>>>
>>>
>>>
>>>
>>>>in the beta WDK.
>>>>
>>>>=====================
>>>>Mark Roddy DDK MVP
>>>>Windows 2003/XP/2000 Consulting
>>>>Hollis Technology Solutions 603-321-1032 www.hollistech.com
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>>-----Original Message-----
>>>>>From: xxxxx@lists.osr.com
>>>>>[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
>>>>>Ciubotaru [Hardwired]
>>>>>Sent: Sunday, August 28, 2005 7:40 AM
>>>>>To: Windows System Software Devs Interest List
>>>>>Subject: [ntdev] ObReferenceObjectByName
>>>>>
>>>>>Hello,
>>>>>
>>>>>Can anyone tell me if it’s something wrong here? I get a BSOD…
>>>>>
>>>>>
>>>>>…
>>>>> UNICODE_STRING uszCore;
>>>>> KEVENT *pObCore;
>>>>> NTSTATUS status;
>>>>>
>>>>>…
>>>>>
>>>>> RtlInitUnicodeString( &uszCore,
>>>>>L"\BaseNamedObjects\MyStopEvent" );
>>>>> status = ObReferenceObjectByName(
>>>>> &uszCore,
>>>>> OBJ_CASE_INSENSITIVE | OBJ_OPENIF | OBJ_PERMANENT,
>>>>> NULL,
>>>>> 0,
>>>>> (POBJECT_TYPE)ExEventObjectType,
>>>>> KernelMode,
>>>>> NULL,
>>>>> &pObCore );
>>>>> if( STATUS_SUCCESS != status )
>>>>> {
>>>>> goto clean_up;
>>>>> }
>>>>> ObDereferenceObject( pObCore );
>>>>>…
>>>>>
>>>>>
>>>>>MyStopEvent it’s an event created by an windows application.
>>>>>I want to see if this event exists. If exists I just
>>>>>
>>>>>
>dereference it
>
>
>>>>>because i don’t need the object anymore.
>>>>>
>>>>>–
>>>>>Thank you,
>>>>>
>>>>>Andrei Ciubotaru
>>>>>
>>>>>
>>>>>—
>>>>>Questions? First check the Kernel Driver FAQ at
>>>>>http://www.osronline.com/article.cfm?id=256
>>>>>
>>>>>You are currently subscribed to ntdev as:
>>>>>xxxxx@hollistech.com To unsubscribe send a blank email to
>>>>>xxxxx@lists.osr.com
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>—
>>>>Questions? First check the Kernel Driver FAQ at
>>>>http://www.osronline.com/article.cfm?id=256
>>>>
>>>>You are currently subscribed to ntdev as: xxxxx@icode.ro To
>>>>unsubscribe send a blank email to xxxxx@lists.osr.com
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>—
>>>Questions? First check the Kernel Driver FAQ at
>>>http://www.osronline.com/article.cfm?id=256
>>>
>>>You are currently subscribed to ntdev as:
>>>xxxxx@hollistech.com To unsubscribe send a blank email to
>>>xxxxx@lists.osr.com
>>>
>>>
>>>
>>>
>>>
>>
>>—
>>Questions? First check the Kernel Driver FAQ at
>>http://www.osronline.com/article.cfm?id=256
>>
>>You are currently subscribed to ntdev as: xxxxx@icode.ro To
>>unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>>
>>
>>
>—
>Questions? First check the Kernel Driver FAQ at
>http://www.osronline.com/article.cfm?id=256
>
>You are currently subscribed to ntdev as:
>xxxxx@hollistech.com To unsubscribe send a blank email to
>xxxxx@lists.osr.com
>
>
>


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@icode.ro
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

> mutexes). Is this ZwOpenEvent working on <= DISPATCH_LEVEL? Is it

== PASSIVE, as most Zwxxx calls.

faster or slower than ObReferenceObjectByName?

It uses ObReferenceObjectByName internally to parse the name.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

You cannot use __try at DISPATCH_LEVEL - this mechanism is not supported on
a high IRQL and will work only by mere luck or not work at all.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Andrei Ciubotaru [Hardwired]”
To: “Windows System Software Devs Interest List”
Sent: Monday, August 29, 2005 4:06 AM
Subject: Re: [ntdev] ObReferenceObjectByName

> Thank you! I solved the problem with ZwOpenEvent. Works just fine. But
> my real problem was something else. I made the same mistake with
> ZwOpenEvent too. Soemthing like this:
>
> KeAcquireSpinLock( &SomeSpin, &irql );
> try
> {
> ZwOpen…
> ZwClose…
> }
>
finally
> {
> KeReleaseSpinLock( &SomeSpin, irql );
> }
>
> It seems that it’s not a good thing to acquire a spin lock and try
> open/access/close some named object :). This made me realize that I
> don’t know s#$@ and put my hands on THE BOOK again!
>
> Again, thank you for your help. Anyway I managed to get “Windows Native
> API” book. Till MS releases the next ddk(let’s all pray that “the one to
> rules them all” thinks to properly document this) this one rules.
>
>
> Thank you,
>
> Andrei Ciubotaru
>
>
>
>
>
> Mark Roddy wrote:
>
> >ZwOpenEvent remains undocumented. However I think you should be able to set
> >the parameters to ZwCreateEvent such that it will not succeed if the event
> >does not exist. The entire IFS kit is in the WDK - so you should really just
> >go download it. No ZwCreateMutex.
> >
> >=====================
> >Mark Roddy DDK MVP
> >Windows 2003/XP/2000 Consulting
> >Hollis Technology Solutions 603-321-1032
> >www.hollistech.com
> >
> >
> >
> >>-----Original Message-----
> >>From: xxxxx@lists.osr.com
> >>[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
> >>Ciubotaru [Hardwired]
> >>Sent: Sunday, August 28, 2005 1:28 PM
> >>To: Windows System Software Devs Interest List
> >>Subject: Re: [ntdev] ObReferenceObjectByName
> >>
> >>Mark, please can you give more info about ZwOpenEvent?
> >>Momentarly I cannot download the beta. Or point me where to
> >>look for. Here on OSR I haven’t found any relevant info
> >>about: ZwCreate/OpenXXXX(event or mutexes). Is this
> >>ZwOpenEvent working on <= DISPATCH_LEVEL? Is it faster or
> >>slower than ObReferenceObjectByName?
> >>
> >>
> >>Thank you,
> >>
> >>Andrei Ciubotaru
> >>
> >>
> >>
> >>
> >>
> >>Mark Roddy wrote:
> >>
> >>
> >>
> >>>It would help if you provided the windbg ‘analyze -v’ output
> >>>
> >>>
> >>from the
> >>
> >>
> >>>bugcheck. The only obvious error in your code is the following:
> >>>
> >>>if( STATUS_SUCCESS != status )
> >>> {
> >>> goto clean_up;
> >>> }
> >>>
> >>>Which should of course be written instead as:
> >>>
> >>>if (!NT_SUCCESS(status))
> >>>{
> >>> goto clean_up;
> >>>}
> >>>
> >>>Also see ZwCreateEvent which is now documented outside of
> >>>
> >>>
> >>the ifs kit
> >>
> >>
> >>>in the beta WDK.
> >>>
> >>>=====================
> >>>Mark Roddy DDK MVP
> >>>Windows 2003/XP/2000 Consulting
> >>>Hollis Technology Solutions 603-321-1032 www.hollistech.com
> >>>
> >>>
> >>>
> >>>
> >>>
> >>>>-----Original Message-----
> >>>>From: xxxxx@lists.osr.com
> >>>>[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
> >>>>Ciubotaru [Hardwired]
> >>>>Sent: Sunday, August 28, 2005 7:40 AM
> >>>>To: Windows System Software Devs Interest List
> >>>>Subject: [ntdev] ObReferenceObjectByName
> >>>>
> >>>>Hello,
> >>>>
> >>>>Can anyone tell me if it’s something wrong here? I get a BSOD…
> >>>>
> >>>>
> >>>>…
> >>>> UNICODE_STRING uszCore;
> >>>> KEVENT *pObCore;
> >>>> NTSTATUS status;
> >>>>
> >>>>…
> >>>>
> >>>> RtlInitUnicodeString( &uszCore,
> >>>>L"\BaseNamedObjects\MyStopEvent" );
> >>>> status = ObReferenceObjectByName(
> >>>> &uszCore,
> >>>> OBJ_CASE_INSENSITIVE | OBJ_OPENIF | OBJ_PERMANENT,
> >>>> NULL,
> >>>> 0,
> >>>> (POBJECT_TYPE)ExEventObjectType,
> >>>> KernelMode,
> >>>> NULL,
> >>>> &pObCore );
> >>>> if( STATUS_SUCCESS != status )
> >>>> {
> >>>> goto clean_up;
> >>>> }
> >>>> ObDereferenceObject( pObCore );
> >>>>…
> >>>>
> >>>>
> >>>>MyStopEvent it’s an event created by an windows application.
> >>>>I want to see if this event exists. If exists I just dereference it
> >>>>because i don’t need the object anymore.
> >>>>
> >>>>–
> >>>>Thank you,
> >>>>
> >>>>Andrei Ciubotaru
> >>>>
> >>>>
> >>>>—
> >>>>Questions? First check the Kernel Driver FAQ at
> >>>>http://www.osronline.com/article.cfm?id=256
> >>>>
> >>>>You are currently subscribed to ntdev as:
> >>>>xxxxx@hollistech.com To unsubscribe send a blank email to
> >>>>xxxxx@lists.osr.com
> >>>>
> >>>>
> >>>>
> >>>>
> >>>>
> >>>
> >>>—
> >>>Questions? First check the Kernel Driver FAQ at
> >>>http://www.osronline.com/article.cfm?id=256
> >>>
> >>>You are currently subscribed to ntdev as: xxxxx@icode.ro To
> >>>unsubscribe send a blank email to xxxxx@lists.osr.com
> >>>
> >>>
> >>>
> >>>
> >>>
> >>—
> >>Questions? First check the Kernel Driver FAQ at
> >>http://www.osronline.com/article.cfm?id=256
> >>
> >>You are currently subscribed to ntdev as:
> >>xxxxx@hollistech.com To unsubscribe send a blank email to
> >>xxxxx@lists.osr.com
> >>
> >>
> >>
> >
> >
> >
> >—
> >Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
> >
> >You are currently subscribed to ntdev as: xxxxx@icode.ro
> >To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
> >
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

The stack cost of _try/_except is rather ugly. Consider using it only
where it is documented as required.

As for locking - see Tony’s response, speed is probably not the issue
here. Correctness is the issue. You have to use a lock with the
appropriate IRQL characteristics. You cannot use spinlocks as your code
is currently implemented, as you found out, because you cannot use the
kernel Zw DDIs at DISPATCH_LEVEL. You have to determine the IRQL level
of all code paths that need to be serialized and that analysis will
guide you toward the selection of the appropriate lock mechanism.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei Ciubotaru
[Hardwired]
Sent: Sunday, August 28, 2005 10:19 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] ObReferenceObjectByName

I got used with __try… i put it everywhere i have the ocasion:) - bad
habbit.

I’ll try with the event. Is it faster that the spin lock? What if
somewhere I am not allowed to wait?.. i got about 80 BSODs today…

Thank you,

Andrei Ciubotaru

Mark Roddy wrote:

If you are at passive level and need to serialize against other passive
level threads, consider using a resource lock or an event lock instead.
By
the way, the exception handling should not be neccesary.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

>-----Original Message-----
>From: xxxxx@lists.osr.com
>[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
>Ciubotaru [Hardwired]
>Sent: Sunday, August 28, 2005 8:06 PM
>To: Windows System Software Devs Interest List
>Subject: Re: [ntdev] ObReferenceObjectByName
>
>Thank you! I solved the problem with ZwOpenEvent. Works just
>fine. But my real problem was something else. I made the same
>mistake with ZwOpenEvent too. Soemthing like this:
>
>KeAcquireSpinLock( &SomeSpin, &irql );
>__try
>{
> ZwOpen…
> ZwClose…
>}
>__finally
>{
> KeReleaseSpinLock( &SomeSpin, irql ); }
>
>It seems that it’s not a good thing to acquire a spin lock
>and try open/access/close some named object :). This made me
>realize that I don’t know s#$@ and put my hands on THE BOOK again!
>
>Again, thank you for your help. Anyway I managed to get
>“Windows Native API” book. Till MS releases the next
>ddk(let’s all pray that “the one to rules them all” thinks to
>properly document this) this one rules.
>
>
>Thank you,
>
>Andrei Ciubotaru
>
>
>
>
>
>Mark Roddy wrote:
>
>
>
>>ZwOpenEvent remains undocumented. However I think you should
>>
>>
>be able to
>
>
>>set the parameters to ZwCreateEvent such that it will not succeed if
>>the event does not exist. The entire IFS kit is in the WDK - so you
>>should really just go download it. No ZwCreateMutex.
>>
>>=====================
>>Mark Roddy DDK MVP
>>Windows 2003/XP/2000 Consulting
>>Hollis Technology Solutions 603-321-1032 www.hollistech.com
>>
>>
>>
>>
>>
>>>-----Original Message-----
>>>From: xxxxx@lists.osr.com
>>>[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
>>>Ciubotaru [Hardwired]
>>>Sent: Sunday, August 28, 2005 1:28 PM
>>>To: Windows System Software Devs Interest List
>>>Subject: Re: [ntdev] ObReferenceObjectByName
>>>
>>>Mark, please can you give more info about ZwOpenEvent?
>>>Momentarly I cannot download the beta. Or point me where to
>>>
>>>
>look for.
>
>
>>>Here on OSR I haven’t found any relevant info
>>>about: ZwCreate/OpenXXXX(event or mutexes). Is this ZwOpenEvent
>>>working on <= DISPATCH_LEVEL? Is it faster or slower than
>>>ObReferenceObjectByName?
>>>
>>>
>>>Thank you,
>>>
>>>Andrei Ciubotaru
>>>
>>>
>>>
>>>
>>>
>>>Mark Roddy wrote:
>>>
>>>
>>>
>>>
>>>
>>>>It would help if you provided the windbg ‘analyze -v’ output
>>>>
>>>>
>>>>
>>>>
>>>from the
>>
>>
>>>
>>>
>>>
>>>
>>>>bugcheck. The only obvious error in your code is the following:
>>>>
>>>>if( STATUS_SUCCESS != status )
>>>> {
>>>> goto clean_up;
>>>> }
>>>>
>>>>Which should of course be written instead as:
>>>>
>>>>if (!NT_SUCCESS(status))
>>>>{
>>>> goto clean_up;
>>>>}
>>>>
>>>>Also see ZwCreateEvent which is now documented outside of
>>>>
>>>>
>>>>
>>>>
>>>the ifs kit
>>>
>>>
>>>
>>>
>>>>in the beta WDK.
>>>>
>>>>=====================
>>>>Mark Roddy DDK MVP
>>>>Windows 2003/XP/2000 Consulting
>>>>Hollis Technology Solutions 603-321-1032 www.hollistech.com
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>>-----Original Message-----
>>>>>From: xxxxx@lists.osr.com
>>>>>[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
>>>>>Ciubotaru [Hardwired]
>>>>>Sent: Sunday, August 28, 2005 7:40 AM
>>>>>To: Windows System Software Devs Interest List
>>>>>Subject: [ntdev] ObReferenceObjectByName
>>>>>
>>>>>Hello,
>>>>>
>>>>>Can anyone tell me if it’s something wrong here? I get a BSOD…
>>>>>
>>>>>
>>>>>…
>>>>> UNICODE_STRING uszCore;
>>>>> KEVENT *pObCore;
>>>>> NTSTATUS status;
>>>>>
>>>>>…
>>>>>
>>>>> RtlInitUnicodeString( &uszCore,
>>>>>L"\BaseNamedObjects\MyStopEvent" );
>>>>> status = ObReferenceObjectByName(
>>>>> &uszCore,
>>>>> OBJ_CASE_INSENSITIVE | OBJ_OPENIF | OBJ_PERMANENT,
>>>>> NULL,
>>>>> 0,
>>>>> (POBJECT_TYPE)ExEventObjectType,
>>>>> KernelMode,
>>>>> NULL,
>>>>> &pObCore );
>>>>> if( STATUS_SUCCESS != status )
>>>>> {
>>>>> goto clean_up;
>>>>> }
>>>>> ObDereferenceObject( pObCore );
>>>>>…
>>>>>
>>>>>
>>>>>MyStopEvent it’s an event created by an windows application.
>>>>>I want to see if this event exists. If exists I just
>>>>>
>>>>>
>dereference it
>
>
>>>>>because i don’t need the object anymore.
>>>>>
>>>>>–
>>>>>Thank you,
>>>>>
>>>>>Andrei Ciubotaru
>>>>>
>>>>>
>>>>>—
>>>>>Questions? First check the Kernel Driver FAQ at
>>>>>http://www.osronline.com/article.cfm?id=256
>>>>>
>>>>>You are currently subscribed to ntdev as:
>>>>>xxxxx@hollistech.com To unsubscribe send a blank email to
>>>>>xxxxx@lists.osr.com
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>—
>>>>Questions? First check the Kernel Driver FAQ at
>>>>http://www.osronline.com/article.cfm?id=256
>>>>
>>>>You are currently subscribed to ntdev as: xxxxx@icode.ro To
>>>>unsubscribe send a blank email to xxxxx@lists.osr.com
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>—
>>>Questions? First check the Kernel Driver FAQ at
>>>http://www.osronline.com/article.cfm?id=256
>>>
>>>You are currently subscribed to ntdev as:
>>>xxxxx@hollistech.com To unsubscribe send a blank email to
>>>xxxxx@lists.osr.com
>>>
>>>
>>>
>>>
>>>
>>
>>—
>>Questions? First check the Kernel Driver FAQ at
>>http://www.osronline.com/article.cfm?id=256
>>
>>You are currently subscribed to ntdev as: xxxxx@icode.ro To
>>unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>>
>>
>>
>—
>Questions? First check the Kernel Driver FAQ at
>http://www.osronline.com/article.cfm?id=256
>
>You are currently subscribed to ntdev as:
>xxxxx@hollistech.com To unsubscribe send a blank email to
>xxxxx@lists.osr.com
>
>
>


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@icode.ro
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@stratus.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Wow! I didn’t know this one… thanks. I have to check all the code again.

Thank you,

Andrei Ciubotaru

Maxim S. Shatskih wrote:

You cannot use __try at DISPATCH_LEVEL - this mechanism is not supported on
a high IRQL and will work only by mere luck or not work at all.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Andrei Ciubotaru [Hardwired]”
>To: “Windows System Software Devs Interest List”
>Sent: Monday, August 29, 2005 4:06 AM
>Subject: Re: [ntdev] ObReferenceObjectByName
>
>
>
>
>>Thank you! I solved the problem with ZwOpenEvent. Works just fine. But
>>my real problem was something else. I made the same mistake with
>>ZwOpenEvent too. Soemthing like this:
>>
>>KeAcquireSpinLock( &SomeSpin, &irql );
>> try
>>{
>> ZwOpen…
>> ZwClose…
>>}
>>
finally
>>{
>> KeReleaseSpinLock( &SomeSpin, irql );
>>}
>>
>>It seems that it’s not a good thing to acquire a spin lock and try
>>open/access/close some named object :). This made me realize that I
>>don’t know s#$@ and put my hands on THE BOOK again!
>>
>>Again, thank you for your help. Anyway I managed to get “Windows Native
>>API” book. Till MS releases the next ddk(let’s all pray that “the one to
>>rules them all” thinks to properly document this) this one rules.
>>
>>
>>Thank you,
>>
>>Andrei Ciubotaru
>>
>>
>>
>>
>>
>>Mark Roddy wrote:
>>
>>
>>
>>>ZwOpenEvent remains undocumented. However I think you should be able to set
>>>the parameters to ZwCreateEvent such that it will not succeed if the event
>>>does not exist. The entire IFS kit is in the WDK - so you should really just
>>>go download it. No ZwCreateMutex.
>>>
>>>=====================
>>>Mark Roddy DDK MVP
>>>Windows 2003/XP/2000 Consulting
>>>Hollis Technology Solutions 603-321-1032
>>>www.hollistech.com
>>>
>>>
>>>
>>>
>>>
>>>>-----Original Message-----
>>>>From: xxxxx@lists.osr.com
>>>>[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
>>>>Ciubotaru [Hardwired]
>>>>Sent: Sunday, August 28, 2005 1:28 PM
>>>>To: Windows System Software Devs Interest List
>>>>Subject: Re: [ntdev] ObReferenceObjectByName
>>>>
>>>>Mark, please can you give more info about ZwOpenEvent?
>>>>Momentarly I cannot download the beta. Or point me where to
>>>>look for. Here on OSR I haven’t found any relevant info
>>>>about: ZwCreate/OpenXXXX(event or mutexes). Is this
>>>>ZwOpenEvent working on <= DISPATCH_LEVEL? Is it faster or
>>>>slower than ObReferenceObjectByName?
>>>>
>>>>
>>>>Thank you,
>>>>
>>>>Andrei Ciubotaru
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>Mark Roddy wrote:
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>>It would help if you provided the windbg ‘analyze -v’ output
>>>>>
>>>>>
>>>>>
>>>>>
>>>>from the
>>>
>>>
>>>>
>>>>
>>>>>bugcheck. The only obvious error in your code is the following:
>>>>>
>>>>>if( STATUS_SUCCESS != status )
>>>>> {
>>>>> goto clean_up;
>>>>> }
>>>>>
>>>>>Which should of course be written instead as:
>>>>>
>>>>>if (!NT_SUCCESS(status))
>>>>>{
>>>>> goto clean_up;
>>>>>}
>>>>>
>>>>>Also see ZwCreateEvent which is now documented outside of
>>>>>
>>>>>
>>>>>
>>>>>
>>>>the ifs kit
>>>>
>>>>
>>>>
>>>>
>>>>>in the beta WDK.
>>>>>
>>>>>=====================
>>>>>Mark Roddy DDK MVP
>>>>>Windows 2003/XP/2000 Consulting
>>>>>Hollis Technology Solutions 603-321-1032 www.hollistech.com
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>>-----Original Message-----
>>>>>>From: xxxxx@lists.osr.com
>>>>>>[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
>>>>>>Ciubotaru [Hardwired]
>>>>>>Sent: Sunday, August 28, 2005 7:40 AM
>>>>>>To: Windows System Software Devs Interest List
>>>>>>Subject: [ntdev] ObReferenceObjectByName
>>>>>>
>>>>>>Hello,
>>>>>>
>>>>>>Can anyone tell me if it’s something wrong here? I get a BSOD…
>>>>>>
>>>>>>
>>>>>>…
>>>>>> UNICODE_STRING uszCore;
>>>>>> KEVENT *pObCore;
>>>>>> NTSTATUS status;
>>>>>>
>>>>>>…
>>>>>>
>>>>>> RtlInitUnicodeString( &uszCore,
>>>>>>L"\BaseNamedObjects\MyStopEvent" );
>>>>>> status = ObReferenceObjectByName(
>>>>>> &uszCore,
>>>>>> OBJ_CASE_INSENSITIVE | OBJ_OPENIF | OBJ_PERMANENT,
>>>>>> NULL,
>>>>>> 0,
>>>>>> (POBJECT_TYPE)ExEventObjectType,
>>>>>> KernelMode,
>>>>>> NULL,
>>>>>> &pObCore );
>>>>>> if( STATUS_SUCCESS != status )
>>>>>> {
>>>>>> goto clean_up;
>>>>>> }
>>>>>> ObDereferenceObject( pObCore );
>>>>>>…
>>>>>>
>>>>>>
>>>>>>MyStopEvent it’s an event created by an windows application.
>>>>>>I want to see if this event exists. If exists I just dereference it
>>>>>>because i don’t need the object anymore.
>>>>>>
>>>>>>–
>>>>>>Thank you,
>>>>>>
>>>>>>Andrei Ciubotaru
>>>>>>
>>>>>>
>>>>>>—
>>>>>>Questions? First check the Kernel Driver FAQ at
>>>>>>http://www.osronline.com/article.cfm?id=256
>>>>>>
>>>>>>You are currently subscribed to ntdev as:
>>>>>>xxxxx@hollistech.com To unsubscribe send a blank email to
>>>>>>xxxxx@lists.osr.com
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>—
>>>>>Questions? First check the Kernel Driver FAQ at
>>>>>http://www.osronline.com/article.cfm?id=256
>>>>>
>>>>>You are currently subscribed to ntdev as: xxxxx@icode.ro To
>>>>>unsubscribe send a blank email to xxxxx@lists.osr.com
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>—
>>>>Questions? First check the Kernel Driver FAQ at
>>>>http://www.osronline.com/article.cfm?id=256
>>>>
>>>>You are currently subscribed to ntdev as:
>>>>xxxxx@hollistech.com To unsubscribe send a blank email to
>>>>xxxxx@lists.osr.com
>>>>
>>>>
>>>>
>>>>
>>>>
>>>
>>>—
>>>Questions? First check the Kernel Driver FAQ at
>>>
>>>
>http://www.osronline.com/article.cfm?id=256
>
>
>>>You are currently subscribed to ntdev as: xxxxx@icode.ro
>>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>>
>>>
>>>
>>>
>>>
>>—
>>Questions? First check the Kernel Driver FAQ at
>>
>>
>http://www.osronline.com/article.cfm?id=256
>
>
>>You are currently subscribed to ntdev as: xxxxx@storagecraft.com
>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>
>
>—
>Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
>
>You are currently subscribed to ntdev as: xxxxx@icode.ro
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>

I understand… Hmmmm, my small 1000-lines-of-code driver… it does not
look so simple right now.

Thank you,

Andrei Ciubotaru

Roddy, Mark wrote:

The stack cost of _try/_except is rather ugly. Consider using it only
where it is documented as required.

As for locking - see Tony’s response, speed is probably not the issue
here. Correctness is the issue. You have to use a lock with the
appropriate IRQL characteristics. You cannot use spinlocks as your code
is currently implemented, as you found out, because you cannot use the
kernel Zw DDIs at DISPATCH_LEVEL. You have to determine the IRQL level
of all code paths that need to be serialized and that analysis will
guide you toward the selection of the appropriate lock mechanism.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei Ciubotaru
[Hardwired]
Sent: Sunday, August 28, 2005 10:19 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] ObReferenceObjectByName

I got used with __try… i put it everywhere i have the ocasion:) - bad
habbit.

I’ll try with the event. Is it faster that the spin lock? What if
somewhere I am not allowed to wait?.. i got about 80 BSODs today…

Thank you,

Andrei Ciubotaru

Mark Roddy wrote:

>If you are at passive level and need to serialize against other passive
>level threads, consider using a resource lock or an event lock instead.
>
>
By

>the way, the exception handling should not be neccesary.
>
>=====================
>Mark Roddy DDK MVP
>Windows 2003/XP/2000 Consulting
>Hollis Technology Solutions 603-321-1032
>www.hollistech.com
>
>
>
>
>
>>-----Original Message-----
>>From: xxxxx@lists.osr.com
>>[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
>>Ciubotaru [Hardwired]
>>Sent: Sunday, August 28, 2005 8:06 PM
>>To: Windows System Software Devs Interest List
>>Subject: Re: [ntdev] ObReferenceObjectByName
>>
>>Thank you! I solved the problem with ZwOpenEvent. Works just
>>fine. But my real problem was something else. I made the same
>>mistake with ZwOpenEvent too. Soemthing like this:
>>
>>KeAcquireSpinLock( &SomeSpin, &irql );
>>__try
>>{
>> ZwOpen…
>> ZwClose…
>>}
>>__finally
>>{
>> KeReleaseSpinLock( &SomeSpin, irql ); }
>>
>>It seems that it’s not a good thing to acquire a spin lock
>>and try open/access/close some named object :). This made me
>>realize that I don’t know s#$@ and put my hands on THE BOOK again!
>>
>>Again, thank you for your help. Anyway I managed to get
>>“Windows Native API” book. Till MS releases the next
>>ddk(let’s all pray that “the one to rules them all” thinks to
>>properly document this) this one rules.
>>
>>
>>Thank you,
>>
>>Andrei Ciubotaru
>>
>>
>>
>>
>>
>>Mark Roddy wrote:
>>
>>
>>
>>
>>
>>>ZwOpenEvent remains undocumented. However I think you should
>>>
>>>
>>>
>>>
>>be able to
>>
>>
>>
>>
>>>set the parameters to ZwCreateEvent such that it will not succeed if
>>>the event does not exist. The entire IFS kit is in the WDK - so you
>>>should really just go download it. No ZwCreateMutex.
>>>
>>>=====================
>>>Mark Roddy DDK MVP
>>>Windows 2003/XP/2000 Consulting
>>>Hollis Technology Solutions 603-321-1032 www.hollistech.com
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>>-----Original Message-----
>>>>From: xxxxx@lists.osr.com
>>>>[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
>>>>Ciubotaru [Hardwired]
>>>>Sent: Sunday, August 28, 2005 1:28 PM
>>>>To: Windows System Software Devs Interest List
>>>>Subject: Re: [ntdev] ObReferenceObjectByName
>>>>
>>>>Mark, please can you give more info about ZwOpenEvent?
>>>>Momentarly I cannot download the beta. Or point me where to
>>>>
>>>>
>>>>
>>>>
>>look for.
>>
>>
>>
>>
>>>>Here on OSR I haven’t found any relevant info
>>>>about: ZwCreate/OpenXXXX(event or mutexes). Is this ZwOpenEvent
>>>>working on <= DISPATCH_LEVEL? Is it faster or slower than
>>>>ObReferenceObjectByName?
>>>>
>>>>
>>>>Thank you,
>>>>
>>>>Andrei Ciubotaru
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>Mark Roddy wrote:
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>>It would help if you provided the windbg ‘analyze -v’ output
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>from the
>>>
>>>
>>>
>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>>bugcheck. The only obvious error in your code is the following:
>>>>>
>>>>>if( STATUS_SUCCESS != status )
>>>>> {
>>>>> goto clean_up;
>>>>> }
>>>>>
>>>>>Which should of course be written instead as:
>>>>>
>>>>>if (!NT_SUCCESS(status))
>>>>>{
>>>>> goto clean_up;
>>>>>}
>>>>>
>>>>>Also see ZwCreateEvent which is now documented outside of
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>the ifs kit
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>>in the beta WDK.
>>>>>
>>>>>=====================
>>>>>Mark Roddy DDK MVP
>>>>>Windows 2003/XP/2000 Consulting
>>>>>Hollis Technology Solutions 603-321-1032 www.hollistech.com
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>>-----Original Message-----
>>>>>>From: xxxxx@lists.osr.com
>>>>>>[mailto:xxxxx@lists.osr.com] On Behalf Of Andrei
>>>>>>Ciubotaru [Hardwired]
>>>>>>Sent: Sunday, August 28, 2005 7:40 AM
>>>>>>To: Windows System Software Devs Interest List
>>>>>>Subject: [ntdev] ObReferenceObjectByName
>>>>>>
>>>>>>Hello,
>>>>>>
>>>>>>Can anyone tell me if it’s something wrong here? I get a BSOD…
>>>>>>
>>>>>>
>>>>>>…
>>>>>> UNICODE_STRING uszCore;
>>>>>> KEVENT *pObCore;
>>>>>> NTSTATUS status;
>>>>>>
>>>>>>…
>>>>>>
>>>>>> RtlInitUnicodeString( &uszCore,
>>>>>>L"\BaseNamedObjects\MyStopEvent" );
>>>>>> status = ObReferenceObjectByName(
>>>>>> &uszCore,
>>>>>> OBJ_CASE_INSENSITIVE | OBJ_OPENIF | OBJ_PERMANENT,
>>>>>> NULL,
>>>>>> 0,
>>>>>> (POBJECT_TYPE)ExEventObjectType,
>>>>>> KernelMode,
>>>>>> NULL,
>>>>>> &pObCore );
>>>>>> if( STATUS_SUCCESS != status )
>>>>>> {
>>>>>> goto clean_up;
>>>>>> }
>>>>>> ObDereferenceObject( pObCore );
>>>>>>…
>>>>>>
>>>>>>
>>>>>>MyStopEvent it’s an event created by an windows application.
>>>>>>I want to see if this event exists. If exists I just
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>dereference it
>>
>>
>>
>>
>>>>>>because i don’t need the object anymore.
>>>>>>
>>>>>>–
>>>>>>Thank you,
>>>>>>
>>>>>>Andrei Ciubotaru
>>>>>>
>>>>>>
>>>>>>—
>>>>>>Questions? First check the Kernel Driver FAQ at
>>>>>>http://www.osronline.com/article.cfm?id=256
>>>>>>
>>>>>>You are currently subscribed to ntdev as:
>>>>>>xxxxx@hollistech.com To unsubscribe send a blank email to
>>>>>>xxxxx@lists.osr.com
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>—
>>>>>Questions? First check the Kernel Driver FAQ at
>>>>>http://www.osronline.com/article.cfm?id=256
>>>>>
>>>>>You are currently subscribed to ntdev as: xxxxx@icode.ro To
>>>>>unsubscribe send a blank email to xxxxx@lists.osr.com
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>—
>>>>Questions? First check the Kernel Driver FAQ at
>>>>http://www.osronline.com/article.cfm?id=256
>>>>
>>>>You are currently subscribed to ntdev as:
>>>>xxxxx@hollistech.com To unsubscribe send a blank email to
>>>>xxxxx@lists.osr.com
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>—
>>>Questions? First check the Kernel Driver FAQ at
>>>http://www.osronline.com/article.cfm?id=256
>>>
>>>You are currently subscribed to ntdev as: xxxxx@icode.ro To
>>>unsubscribe send a blank email to xxxxx@lists.osr.com
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>—
>>Questions? First check the Kernel Driver FAQ at
>>http://www.osronline.com/article.cfm?id=256
>>
>>You are currently subscribed to ntdev as:
>>xxxxx@hollistech.com To unsubscribe send a blank email to
>>xxxxx@lists.osr.com
>>
>>
>>
>>
>>
>
>—
>Questions? First check the Kernel Driver FAQ at
>
>
http://www.osronline.com/article.cfm?id=256

>You are currently subscribed to ntdev as: xxxxx@icode.ro
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>
>


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@stratus.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com