CODEWITHSUNDEEP
windowsdriverminifilter
Krag
Krag

Reputation: 99

Meaning of IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONISATION

I'm currently developping a miniFilter driver from scratch.

Right now i'm just trying to understand how all of this works, which actions leads to which IRP event etc...

After some tests with the miniSpy filter Driver, I can see those 3 Major operation and can't figure out what is done.

IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION    
IRP_MJ_QUERY_INFORMATION           
IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION

I'm usually using this link : https://msdn.microsoft.com/en-us/library/windows/hardware/ff548630(v=vs.85).aspx

But I can't found ACQUIRE/RELEASE_FOR_SECTION_SYNCHRONIZATION.

Can someone explain me what they mean ?

Upvotes: 1

Views: 2049

Answers (1)

Gabriel Bercea
Gabriel Bercea

Reputation: 1271

First of all you might want to check this out.

  1. You can think of the IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION as callback for CreateaFileMapping. It essentially tells you that the FILE_OBJECT in question is about to have section object created for it.
  2. IRP_MJ_QUERY_INFORMATION its the file-system callback for ZwQueryInformationFile. Check that one out for more details on various information classes and what structures are behind each buffer for each class.
  3. IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION has no parameters. Consider it as an equivalent of CloseHandle(SectionHandle). Check this.

Hope it clears things out.

Good luck.

Upvotes: 4

Related Questions