In the sfilter sample of the IFS there is an element of the device extension that the filter creates called AttachedToDeviceObject. Inside the DeviceObject structure there is a guy call AttachedDevice. Both are PDEVICE_OBJECT.
Now why does the sfilter sample need AttachedToDeviceObject if the other already has been defined? Clearly there is a difference because I'm running into a situation where I rely on AttachedToDeviceObject to call to IoCreateFileSpecifyDeviceObjectHint , and therefore avoid getting called back on my own call.
But I find that after I make this call , which appears to return successfully, I cannot use IoCreateFile without things breaking up. In the case where they do break up , I find that AttachedDevice element of the DeviceObject in question is 0, yet the AttachedToDeviceObject appears valid.
What exactly are the semantics of these elements?
Any thoughts?
--
Gak -
Finecats