[Taras]

You must not use KeWaitFor… at IRQL >= DISPATH_LEVEL if timeout is not equal zero. The problem is sometime NotifyEvent occures at DISPATCH_LEVEL and you should handle it immidiatly. So the one way is to copy net packe, hold them and return from NotifyEvent. On PASSIVE_LEVEL you can wait your application and then renew packet.

[Taras]

(1) and (2) can be done

1) When you are hijacking ClientEventReceive, ClientEventChainedReceive you should analize content and return STATUS_DATA_NOT_ACCEPTED for rejecting data.

[Author]

Posts