DriverEntry is called in kernel process context, if you want to close it,
simply queue a workitem and close it there.
Bi
-----Original Message-----
From: Prokash Sinha [mailto:xxxxx@zonelabs.com]
Sent: Thursday, October 31, 2002 3:04 PM
To: File Systems Developers
Subject: [ntfsd] Are there any know way to Open(Create) a file from
DriverEntry, c lose in a different context
0:
INVALID_KERNEL_HANDLE (93)
This message occurs if kernel code (server, redirector, other driver, etc.)
attempts to close a handle that is not a valid handle.
Arguments:
Arg1: 00000474, The handle that NtClose was called with.
Arg2: 00000000, means a protected handle was closed.
Arg3: 00000000
Arg4: 00000000
1: The file being created/opened at the DriverEntry(), but trying to close
under a different context.
2: When opening —
<<< In system context - Driver Entry
RtlInitUnicodeString( &fileNameUnicodeString, cwFileName );
InitializeObjectAttributes( &objectAttributes, &fileNameUnicodeString,
OBJ_CASE_INSENSITIVE |
OBJ_INHERIT, NULL, NULL );
ntStatus = ZwCreateFile( &(pLogCtx->hLogFile), GENERIC_WRITE |
SYNCHRONIZE, &objectAttributes, &ioStatusBlock,
NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ,
FILE_SUPERSEDE,
FILE_NON_DIRECTORY_FILE | FILE_SEQUENTIAL_ONLY
| FILE_SYNCHRONOUS_IO_NONALERT,
NULL, 0 );
Q: Is it enough to use OBJ_INHERIT to let the handle be used under different
context ???
Else How could I get this to work ?
Thx in adv.
prokash
You are currently subscribed to ntfsd as: xxxxx@appstream.com
To unsubscribe send a blank email to %%email.unsub%%