I’m tracking changed made to file and would like to “remember” and pass some information from the pre-operation callback to the post-operation callback.
What is the best way to do it?
Can I just allocate a buffer in pre-operation and pass it in CompletionContext, then use it in post-operation and free it?
The driver should only support Windows 10 if it makes it easier.
Naftaly Avadiaev wrote:
Can I just allocate a buffer in pre-operation and pass it in CompletionContext,
then use it in post-operation and free it?
Yes, you can.
Moreover, this parameter is designed specifically for passing data to the
post-operation callback:
If this callback routine returns FLT_PREOP_SUCCESS_WITH_CALLBACK or
FLT_PREOP_SYNCHRONIZE, this parameter is an optional context pointer to
be passed to the corresponding post-operation callback routine.
(MSDN)
Thank you for the answer, however for some reason I’m having troubles with using the buffers passed in CompletionContext.
Within the preop callback I do the following:
PRecordEntry record = FltAllocatePoolAlignedWithTag(FltObjects->Instance, NonPagedPool, sizeof(RecordEntry), ‘ncaS’);
record->pre_op_filename.Buffer = FltAllocatePoolAlignedWithTag(FltObjects->Instance, NonPagedPool, 1024, ‘ncaS’);
record->pre_op_filename.Length = 0;
record->pre_op_filename.MaximumLength = 1024;
record->post_op_filename.Buffer = FltAllocatePoolAlignedWithTag(FltObjects->Instance, NonPagedPool, 1024, ‘ncaS’);
record->post_op_filename.Length = 0;
record->post_op_filename.MaximumLength = 1024;
In the postop callback I try to do the following:
PRecordEntry record = (PRecordEntry)CompletionContext;
RtlCopyUnicodeString(&record->post_op_filename, &nameInfo->Name);
I’m getting an exception at copying the unicode string.
What am I missing?
Never mind, just a stupid mistake.
Thanks!