Best Way to read file in precleanUp

[Scoot3r]

I monitor Delete File Operation and i want to read specific byte with fltreadfile

but my issue is best way to read file

i see some example to read file in precleanup clearly but another example is create queue and work item (i think for IRQL issue best way use this method)

but i really confused about that . what is problem? why i should use queue and what method FltQueueDeferredIoWorkItem OR FltQueueGenericWorkItem

really sorry about that. i'm really new in kernel environment

 

[x BlueRobot]

really sorry about that. i'm really new in kernel environment

And this what concerns me the most. How much programming experience do you have in general? In particular, with languages which don't hold your hand too much like C? From your previous posts, it seems that you're copy and pasting sample driver code without really understanding what it does.

why i should use queue and what method FltQueueDeferredIoWorkItem OR FltQueueGenericWorkItem

Do you understand what queues are and the what work items are used for? Both of those API functions are used for differently purposes, have you read the documentation for them?

 

[x BlueRobot]

Do you understand what queues are and the what work items are used for?

This article should provide some insight for you - Processing I/O Operations - Windows drivers

 

[Scoot3r]

And this what concerns me the most. How much programming experience do you have in general? In particular, with languages which don't hold your hand too much like C? From your previous posts, it seems that you're copy and pasting sample driver code without really understanding what it does.

I said before that I have no experience in this field and in my experience the best way to learn is to study on sample codes

Do you understand what queues are and the what work items are used for? Both of those API functions are used for differently purposes, have you read the documentation for them?

boss, i'm confused about this API in this issue and that's why I asked the question
File MiniFilter Deferred Processing using Callback Data Queues

This article should provide some insight for you - Processing I/O Operations - Windows drivers

Thank you so much,
i will be owe you

 

[x BlueRobot]

I said before that I have no experience in this field and in my experience the best way to learn is to study on sample codes

I understand that, however, I'm trying to establish what you do know so I'm able to guide you more effectively. I assume you're fairly proficient in using a language like C then?

boss, i'm confused about this API in this issue and that's why I asked the question
File MiniFilter Deferred Processing using Callback Data Queues

The article I referenced should clear some things up for you, let me know if you have any questions about it.