Hi All,
As per the documentation, one can use FltGetFileNameInformationUnsafe() when we are
querying file object outside of the context of an I/O operation on that file object.
Can we call FltGetFileNameInformationUnsafe() in LoadImageNotifyRoutine() callback one file object from IMAGE_INFO_EX?
Thanks,
Sujay.
I think all you have to worry about there is, quoting docs:
“In Windows 7, Windows Server 2008 R2, and earlier versions of Windows, the
operating system holds an internal system lock during calls to load-image
notify routines for images loaded in user process address space (user
space). To avoid deadlocks, load-image notify routines must not call system
routines that map, allocate, query, free, or perform other operations on
user-space virtual memory.”
I am not 100% sure if this will deadlock but might as well just test ( I
bet you will see the deadlock ). If it does deadlock, just throw a workitem
to do this call for you and just wait for the workitem to finish and get
the name that way.
There are in fact cases I have seen there where the FileObject you get
called with has already the FO_CLEANUP_COMPLETE flag set and it will not
work so might want to check for these cases.
Good luck.
On Thu, Oct 8, 2015 at 7:42 AM, wrote:
> Hi All,
>
> As per the documentation, one can use FltGetFileNameInformationUnsafe()
> when we are
> querying file object outside of the context of an I/O operation on that
> file object.
>
> Can we call FltGetFileNameInformationUnsafe() in LoadImageNotifyRoutine()
> callback one file object from IMAGE_INFO_EX?
>
> Thanks,
> Sujay.
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
–
Bercea. G.