![]() |
|
|
|
#1
|
|||
|
|||
|
Two method:
1. Add a special flag on you call to zwCreateFile/zwCloseFile so that your driver can distinct them. 2. Create file and close file directly use IRP to lower driver. You must construct IRP that you want to use. It is very difficult because many things is undocument. But it may be work. |
|
#2
|
|||
|
|||
|
You're right! i know if i can create the IRP for create/close file and call "IoCallDriver" to pass the IRP to the lower driver , my problem is solved .
but setting all of the IRP fields correctly is a bit difficult ! and about flagging the IRP , what do u mean ? change the input param of ZwCreateFile/ZwClose ?
|
![]() |
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Hi there~ Im back.. | OrionOnion | General Discussion | 3 | 01-03-2014 05:29 |
| Come Back | LOUZEW | General Discussion | 12 | 10-01-2013 18:55 |
| decompiling back to C++? | Rhodium | General Discussion | 44 | 10-11-2004 08:30 |