Re: FSFD CloseHandle Interception
Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance
CLOSE is called only when the last reference to the file object is gone,
and Cc holds such references, sometimes for hours after all handles were
closed.
--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@xxxxxxxxxxxxxxxx
http://www.storagecraft.com
"Bajamani" <bajamani@xxxxxxxxxxx> wrote in message
news:1112934346.990399.309010@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Why? What is wrong with IRP_MJ_CLOSE?
...Mani
.
Relevant Pages
- Re: Why is IRP_MJ_CLOSE needed (when there is IRP_MJ_CLEANUP)?
... In things like file systems that also use these IRP's, the cleanup ... In fact in file system filters I have ... The handle count is the number of handles that point to a file object, ... reference count on a file object has reached zero." ...
(microsoft.public.development.device.drivers) - Re: file object address
... > MJ_CLOSE is sent at the moment the reference count is about to drop to ... zero. ... the file object that is associated with the target device object ****has ... >> From my point of view, you obviously asked about the file object *memory ...
(microsoft.public.development.device.drivers) - Re: file object address
... once the ref count has gone to zero, ... > - MJ_CLOSE seems to be sent when the reference count to the FILE_OBJECT is ... ObReferenceObject on the FILE_OBJECT seems to produce ... >> reference to the file object during MJ_CLOSE, ...
(microsoft.public.development.device.drivers) - Re: file object address
... > MJ_CLOSE is sent at the moment the reference count is about to drop to ... zero. ... the file object that is associated with the target device object ****has ... >> From my point of view, you obviously asked about the file object *memory ...
(microsoft.public.windowsxp.device_driver.dev) - Re: file object address
... once the ref count has gone to zero, ... > - MJ_CLOSE seems to be sent when the reference count to the FILE_OBJECT is ... ObReferenceObject on the FILE_OBJECT seems to produce ... >> reference to the file object during MJ_CLOSE, ...
(microsoft.public.windowsxp.device_driver.dev) |
|
