Hi all,
I met a strange problem.
When I block IRP_MJ_WRITE in my FS filter driver,
I want to know the buffer that contains the written data. So I check:
Irp->UserBuffer, Irp->AssociatedIrp->SystemBuffer and
Irp->MdlAddress. The buffer can only be one of the three.
Then I use the following if-else clauses. But strange thing is:
Whether or not it has value and whether or not the other two are NULL or not
it always executed the last two ZwWriteFile()(I check the Irp->UserBuffer)
Why it cannot judge the condition correctly?
And I tried use a local variable buffer then let buffer=Irp->UserBuffer. The
result is the same.
Then how can I do this judging?
if(Irp->UserBuffer!=NULL)
{
ntStatus=ZwWriteFile(
myCopyFile,
NULL,
NULL,
NULL,
&myIoStatus,
Irp->UserBuffer,
currentIrpStack->Parameters.Write.Length,
&(currentIrpStack->Parameters.Write.ByteOffset),
NULL);
}
else
if(Irp->AssociatedIrp.SystemBuffer!=NULL)
{
ntStatus=ZwWriteFile(
myCopyFile,
NULL,
NULL,
NULL,
&myIoStatus,
Irp->AssociatedIrp.SystemBuffer,
currentIrpStack->Parameters.Write.Length,
&(currentIrpStack->Parameters.Write.ByteOffset),
NULL);
}
else
if(Irp->MdlAddress!=NULL)
{
ntStatus=ZwWriteFile(
myCopyFile,
NULL,
NULL,
NULL,
&myIoStatus,
MmGetSystemAddressForMdlSafe(Irp->MdlAddress,NormalPagePriority),
currentIrpStack->Parameters.Write.Length,
&(currentIrpStack->Parameters.Write.ByteOffset),
NULL);
}
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com