Code correct ? RRS feed

  • Question


    Are the code portions correct?
    For this kind of thing should I use LockVDFNotify, unLockVDFNotify?
    1st portion:


    2nd portion:

         FsRtlNotifyCleanup(vdf->NotifySync, &vdf->DirNotifyList, fsc); 

    3rd portion:

                                            FsRtlNotifyFullReportChange(                                            vdf->NotifySync,  

    void LockVDFNotify(PPARAMVDF vdf){    ExAcquireResourceExclusiveLite(&vdf->ResourceNextFile, TRUE);}
    void unLockVDFNotify(PPARAMVDF vdf){    ExReleaseResourceLite(&vdf->ResourceNextFile);

    Sunday, June 24, 2018 4:09 PM

All replies

  • Who knows? Your code snippets do not provide enough information. Next time, distill your question down to the basics, such as "Do I need to acquire a lock around calls to FsRtlNotifyFullChangeDirectory in these circumstances …".

    As a rule, you would acquire the VCB or FCB lock (possibly shared) around these calls, but you have not provided enough context to answer the question.


    Azius Developer Training Windows device driver, internals, security, & forensics training and consulting. Blog at

    Monday, June 25, 2018 8:39 PM