Strange behaviour for TDI_SET_EVENT_HANDLER in a filter

Hi

I have a TDI filter and I'm filtering TDI_SET_EVENT_HANDLER.
Application can send this IRP to "reset" a previously event
handler.
What I don't understand is, why when someone above me tries to reset
a previously set event handler, it's already NULL in my filter?

if( pSrc->EventHandler )
{
// Hook The Caller's Event Handler
.........
}
else
{
// Reset the Event Handler

// Printing EventHandler and EventContext now, will show they are
NULLed !!
// Why pDest->EventHandler and pDest->EventContext are ALREADY = NULL?
(Before I put my null in it)

pDest->EventHandler = NULL;
pDest->EventContext = NULL;
}

Thanks.

mirage2k2
Tue Mar 14 22:20:27 CST 2006

it has been a while ...
the event handlers are linked to the address object ... if the event
handlers are always null in your filter then I can only assume that you did
not correctly capture TDI_SET_EVENT_HANDLER in the first place, or you did
not correctly capture the creation of the address object. It's also possible
that your driver was not loaded when the address object/event handler was
created, i.e. if you loaded your driver after the system had already started
up.

Check out tdi_fw tdi filter project - this is great for learning.

"zedy1984@gmail.com" wrote:

> Hi
>
> I have a TDI filter and I'm filtering TDI_SET_EVENT_HANDLER.
> Application can send this IRP to "reset" a previously event
> handler.
> What I don't understand is, why when someone above me tries to reset
> a previously set event handler, it's already NULL in my filter?
>
> if( pSrc->EventHandler )
> {
> // Hook The Caller's Event Handler
> .........
> }
> else
> {
> // Reset the Event Handler
>
> // Printing EventHandler and EventContext now, will show they are
> NULLed !!
> // Why pDest->EventHandler and pDest->EventContext are ALREADY = NULL?
> (Before I put my null in it)
>
> pDest->EventHandler = NULL;
> pDest->EventContext = NULL;
> }
>
> Thanks.
>
>