when to use EvtIoInCallerContext
Well the search function worked fine for me just now. Just go to the
osronline.com, choose ListServer/Forum, then choose "Click Here To Search
What I meant on using METHOD_NEITHER was for example:
In user space:
DeviceIoControl( handle, IOCTL_CODE, P1, U1, P2, U2, R1, NULL);
In kernel space:
Use WdfRequestWdmGetIrp then P1 is
Parameters.DeviceIoControl.Type3InputBuffer, U1 is
Parameters.DeviceIoControl.InputBufferLength, P2 is IRP->UserBuffer, and U2
is Parameters.DeviceIoControl.OutputBufferLength where Paremeters is the
The 4 parameters can be accessed with no processing of the parameters. The
WdfCompleteRequestWithInformation returns the Information parameter as R1.
Windows Driver Consulting
[mailto:email@example.com] On Behalf Of
Sent: Monday, January 08, 2018 8:37 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] when to use EvtIoInCallerContext
Unfortunately, it is impossible to search on osronline anymore.
I read many times the case you described (with two pointer and two ULONG's )
but I do not understand it.
Let me change a bit my question.
Once I use Direct IOCTL method , The IO manager locks the user pages in
memory and creates an MDL object which describes user pages.
This more efficient than just copy .
What NIETHER method does ? Nothing.
So in driver EvtIoInCallerContext routine, we should
WdfRequestRetrieveUnsafeUserInputBuffer and OutputBuffer , then
WdfRequestProbeAndLockUserBufferForRead / Write for both buffers .
then we can return request the framework and use the buffer ...
Is that means WdfRequestProbeAndLockUserBufferForRead/Write creates MDL ?
If it creates MDL , so what the difference between two approaches ?
Anyway I can't use the buffer even if it is small or big .
NTDEV is sponsored by OSR
Visit the list online at:
MONTHLY seminars on crash dump analysis, WDF, Windows internals and software
To unsubscribe, visit the List Server section of OSR Online at