Hi,
I’m getting BSOD’s while sending I/O PFLT_PRE_OPERATION_CALLBACK and
PFLT_POST_OPERATION_CALLBACK trace info up to my user-mode application.
I’m probably overlooking something simple here. Here’s the pertinent
code:
Kernel:
// This the code that is called each time a IRP pre/post operation is
generated.
REPFS_IO_NOTIFICATION io_notification;
ULONG replyLength;
NTSTATUS status;
io_notification.Command = (preOp) ? cmd_IoPreOperation :
cmd_IoPostOperation;
io_notification.IrpFlags = Data->Iopb->IrpFlags;
io_notification.MajorFunction = Data->Iopb->MajorFunction;
io_notification.MinorFunction = Data->Iopb->MinorFunction;
io_notification.OperationFlags = Data->Iopb->OperationFlags;
io_notification.Reserved = 0;
replyLength = sizeof(REPFS_IO_REPLY);
status = FltSendMessage(g_FilterHandle, &g_ClientPort,
&io_notification, sizeof(REPFS_IO_NOTIFICATION),
&io_notification, &replyLength, NULL);
User-space:
// This is the thread worker function that gets all the messages from
the minifilter.
REPFS_IO_MESSAGE io_notification;
REPFS_IO_REPLY_MESSAGE io_reply;
HRESULT hResult = S_OK;
printf(“Entering the worker thread loop…\n”);
while (hResult == S_OK && g_quit_state == eRunning)
{
hResult = FilterGetMessage(data.hPort,
(PFILTER_MESSAGE_HEADER)&io_notification,
sizeof(REPFS_IO_MESSAGE), NULL);
if (hResult != S_OK && hResult != HRESULT_FROM_WIN32(ERROR_IO_PENDING))
break;
if (io_notification.Notification.Command == cmd_IoPreOperation)
{
printf(“I/O Pre-Operation: Major=%lu, Minor=%lu\n”,
io_notification.Notification.MajorFunction,
io_notification.Notification.MinorFunction);
}
else if (io_notification.Notification.Command ==
cmd_IoPostOperation)
{
printf(“I/O Post-Operation: Major=%lu, Minor=%lu\n”,
io_notification.Notification.MajorFunction,
io_notification.Notification.MinorFunction);
}
else
{
printf(“Unknown command!\n”);
}
if (io_notification.Notification.Command == cmd_IoPreOperation ||
io_notification.Notification.Command == cmd_IoPostOperation)
{
io_reply.Reply.NotificationReceived = TRUE;
printf(“Replying to message, NotificationReceived: %d\n”,
io_reply.Reply.NotificationReceived);
HRESULT hr = FilterReplyMessage(data.hPort,
(PFILTER_REPLY_HEADER)&io_reply,
sizeof(io_reply));
if (SUCCEEDED(hr))
printf(“Reply to message successful\n”);
else
printf(“Error replying to message: Error 0x%X\n”, hr);
}
}
printf(“Exiting the worker thread loop…\n”);