Quantcast
Channel: Programming
Viewing all articles
Browse latest Browse all 20

Best Way to read file in precleanUp

$
0
0
I monitor Delete File Operation and i want to read specific byte with fltreadfile

but my issue is best way to read file

i see some example to read file in precleanup clearly but another example is create queue and work item (i think for IRQL issue best way use this method)

but i really confused about that . what is problem? why i should use queue and what method FltQueueDeferredIoWorkItem OR FltQueueGenericWorkItem

really sorry about that. i'm really new in kernel environment

Viewing all articles
Browse latest Browse all 20

Trending Articles