Everhart, Glenn (FUSA)
From:	Chris Cant [chris@phdcc.com]
Sent:	Tuesday, April 27, 1999 5:07 AM
To:	ntdev@atria.com; Hernan Ochoa
Subject:	Re: [ntdev] using zwcreatefile from a flter driver
>i use zwXXX functions to write to my log file. the function that writes the
>information to a log file
>works ok, because i tested it with another dummy driver i wrote.

The problem is almost certainly that the Zw file functions are thread
dependent.  The handle returned from ZwCreateFile can only be used within
the same thread.  When you call ZwWriteFile when processing a later IRP you
are almost certainly in a different thread context.
(ZwWriteFile also has to be called at PASSIVE_LEVEL as far as I remember.)
All this is not very clear from the DDK documentation.

The only solution to this is have a system thread working away in the
background doing your logging.  Call ZwCreateFile, ZwWriteFile and
ZwCloseFile in this system thread.  You have to set up a way of passing your
log data to the system thread. An interlocked doubly linked list and a
kernel event will do the job

I have successfully used exactly such a technique for our DebugPrint
software. DebugPrint lets you include debug trace statements in driver code.
This may be exactly what you want.  If you buy DebugPrint you will get the
source which shows this technique.

Chris Cant, PHD Computer Consultants Ltd
www.phdcc.com

 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[ To unsubscribe, send email to ntdev-request@atria.com with body
UNSUBSCRIBE (the subject is ignored). ]