Hi,
In my driver I have registered a Load Image notification callback with PsSetCreateProcessNotifyRoutine.
In this callback I open the corresponding file to scan for VERSION_INFO etc. On windows 7 when this callback is called and the file is e.g. a DLL APCs are disabled. I then start a system worker thread to do the opening and short scan of the file.
This works fine except on some machines especially during boot of Windows. At some point (this varies) after login ZwCreateFile just hangs and does not return. And it does not hang on the same file every time and not at the same place in the login. Sometimes it only gets to the “Welcome” screen. Other times the desktop gets loaded.
Som of my code:
In the load image notify:
if (KeAreAllApcsDisabled()) {
pwork = IoAllocateWorkItem(device_obj);
KeInitializeEvent(&fi.kevent, NotificationEvent, FALSE);
fi.pFilename = pFilename;
IoQueueWorkItem(pwork, GetImageInfoWork, DelayedWorkQueue, &fi);
KeWaitForSingleObject(&fi.kevent, Executive, KernelMode, FALSE, NULL);
In GetImageInfoWork:
InitializeObjectAttributes(&attr, pFilename, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
stat = ZwCreateFile(&hfile, FILE_READ_DATA | SYNCHRONIZE, &attr, &iostat, NULL, 0, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN, FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0);
Any ideas?
