I had a previous thread about the way to make a corect message for IRP_MJ_READ, so if you read it u know that I am making a file system filter driver based on the sfilter exmaple from the WDK from Microsoft. For those who don’t know sfilter, it attaches to all the volume devices, and processes the IRP’s as pass throughs.
The problem is that whenever I write some code in the driver entry, except the existent code, code like calling a function or something it has something to do with the code later on and I don’t understand why.
for example I have a function called NTSTATUS
GetFileObjectFromPathEx(
PDEVICE_OBJECT DeviceObject,
PUNICODE_STRING Path,
PFILE_OBJECT *FileObject,
PHANDLE FileHandle,
IN ACCESS_MASK DesiredAccess)
which give u the file object for a file by a given path, by sending the request to a specific Device.
the thing is that when I call this function in my IRP_MJ_WRITE dispatch routine the function works great, every time, I have no problem using it.
well when I call the funtion in driver entry, just for testing I mean, the things change later on.
In my IRP_MJ_WRITE I need to get the file name for the current file and compare it
I use RtlCompareUnicodeString
If I don’t call GetFileObjectFromPathEx or other functions made by me in driverentry, the comparing goes smoothly, but if I call this function or any other function that calls some api like: IoCreateFileSpecifyDeviceObjectHint or ZwCreateKey or ZwQueryValueKey the code crashes in the RtlCompareUnicodeString
If i comment the rtlcompareunicodestring in my dispatch routines and also call the functions in the driver entry everything goes smoothly.
Why does this happen.
How should I make my initializations. . .
I close all the handles I open in the driverentry and dereference all objects if I reference any, so I have no memory leaks that could affect in the future.
Please help, note that this is file system filter driver, and the device is of this type: FILE_DEVICE_DISK_FILE_SYSTEM.
thank you