Safe operations in load image notify routine

NTDEV
1

Hello all,

In one of my drivers I call PsSetLoadImageNotifyRoutine to receive load image notifications.
In the handler routine I open the image file with a call to ZwOpenFile and start reading from it
with ZwReadFile. On Windows Vista sometimes the call to ZwReadFile hangs. I would like to know why this happens and how can this be avoided.

Thank you.

2

Cristi,
The NotifyRoutine is often called at APC_LEVEL. This will cause problems if you make file-related calls from the same thread (they require PASSIVE_LEVEL),

–David

3

Thank you David, that was the problem. I moved the code in a work item and everything is fine now.