Best Way to read file in precleanUp

Scoot3r · Apr 30, 2021

I monitor Delete File Operation and i want to read specific byte with fltreadfile

but my issue is best way to read file

i see some example to read file in precleanup clearly but another example is create queue and work item (i think for IRQL issue best way use this method)

but i really confused about that . what is problem? why i should use queue and what method FltQueueDeferredIoWorkItem OR FltQueueGenericWorkItem

really sorry about that. i'm really new in kernel environment

x BlueRobot · May 2, 2021

Scoot3r said:
really sorry about that. i'm really new in kernel environment

And this what concerns me the most. How much programming experience do you have in general? In particular, with languages which don't hold your hand too much like C? From your previous posts, it seems that you're copy and pasting sample driver code without really understanding what it does.

Scoot3r said:
why i should use queue and what method FltQueueDeferredIoWorkItem OR FltQueueGenericWorkItem

Do you understand what queues are and the what work items are used for? Both of those API functions are used for differently purposes, have you read the documentation for them?

x BlueRobot · May 2, 2021

x BlueRobot said:
Do you understand what queues are and the what work items are used for?

This article should provide some insight for you - Processing I/O Operations - Windows drivers

Scoot3r · May 6, 2021

x BlueRobot said:
And this what concerns me the most. How much programming experience do you have in general? In particular, with languages which don't hold your hand too much like C? From your previous posts, it seems that you're copy and pasting sample driver code without really understanding what it does.

I said before that I have no experience in this field and in my experience the best way to learn is to study on sample codes

x BlueRobot said:
Do you understand what queues are and the what work items are used for? Both of those API functions are used for differently purposes, have you read the documentation for them?

boss, i'm confused about this API in this issue and that's why I asked the question
File MiniFilter Deferred Processing using Callback Data Queues

x BlueRobot said:
This article should provide some insight for you - Processing I/O Operations - Windows drivers

Thank you so much,
i will be owe you

x BlueRobot · May 7, 2021

Scoot3r said:
I said before that I have no experience in this field and in my experience the best way to learn is to study on sample codes

I understand that, however, I'm trying to establish what you do know so I'm able to guide you more effectively. I assume you're fairly proficient in using a language like C then?

Scoot3r said:
boss, i'm confused about this API in this issue and that's why I asked the question
File MiniFilter Deferred Processing using Callback Data Queues

The article I referenced should clear some things up for you, let me know if you have any questions about it.

Search

Search

Best Way to read file in precleanUp

Scoot3r

Member

x BlueRobot

Administrator

x BlueRobot

Administrator

Scoot3r

Member

x BlueRobot

Administrator