What's new Search

Recent content by Scoot3r

S
Best Way to read file in precleanUp

I said before that I have no experience in this field and in my experience the best way to learn is to study on sample codes boss, i'm confused about this API in this issue and that's why I asked the question File MiniFilter Deferred Processing using Callback Data Queues Thank you so much, i...
- Scoot3r
- Post #4
- May 6, 2021
- Forum: Programming
S
Best Way to read file in precleanUp

I monitor Delete File Operation and i want to read specific byte with fltreadfile but my issue is best way to read file i see some example to read file in precleanup clearly but another example is create queue and work item (i think for IRQL issue best way use this method) but i really...
- Scoot3r
- Thread
- Apr 30, 2021
- Replies: 4
- Forum: Programming
S
Enable Wpp for Minifilter Driver

yes, i read it but i can't find sample for my situation edit: i finally see some example microsoft/Windows-driver-samples
- Scoot3r
- Post #11
- Apr 30, 2021
- Forum: Programming
S
Enable Wpp for Minifilter Driver

this is my unicode string &Data->Iopb->TargetFileObject->FileName this is correct ? TraceEvents(TRACE_LEVEL_INFORMATION, TRACE_DRIVER, "File Name: %wZ", &Data->Iopb->TargetFileObject->FileName);
- Scoot3r
- Post #8
- Apr 30, 2021
- Forum: Programming
S
Enable Wpp for Minifilter Driver

UNICODE STRING and i use kdprint with that format string
- Scoot3r
- Post #6
- Apr 30, 2021
- Forum: Programming
S
Enable Wpp for Minifilter Driver

Error wpp Parsing "&Data->Iopb->TargetFileObject->FileName", cannot find format string (i even add %wZ but i'm not sure is correct for some situation) i trying search for find a sample but :confused:
- Scoot3r
- Post #4
- Apr 30, 2021
- Forum: Programming
S
Enable Wpp for Minifilter Driver

Hi again i finally SOLVED it but i have another problem how can use unicode string to wpp tracing? i mean like this :> TraceEvents(TRACE_LEVEL_INFORMATION, TRACE_DRIVER, &Data->Iopb->TargetFileObject->FileName); // got error
- Scoot3r
- Post #2
- Apr 29, 2021
- Forum: Programming
S
Enable Wpp for Minifilter Driver

Hi, I wanna enable wpp tracing for my first minifilter driver, i do that on normal driver but for minifilter i can't find any sample how can i enable this feature ? thank you 🙏
- Scoot3r
- Thread
- Apr 29, 2021
- Replies: 11
- Forum: Programming
S
(log)-> Delete File by minifilter Driver

Thank you your awesome
- Scoot3r
- Post #4
- Apr 22, 2021
- Forum: Programming
S
(log)-> Delete File by minifilter Driver

Hi, i read "Delete_File" Sample code by microsoft And I have a some issue what is mean in-flight change ?(I still do not understand ) microsoft/Windows-driver-samples // Race detection logic. The NumOps field in the StreamContext // counts the number of in-flight changes to delete...
- Scoot3r
- Thread
- Apr 22, 2021
- Replies: 3
- Forum: Programming

Scoot3r