How to use that Windows Driver Samples - MiniFilter - AVSCAN ?

[noblesys]

Hellow, Team.

My Project code be inserted minifilter sample code, then has BSOD.

developing code,

FLT_POSTOP_CALLBACK_STATUS
sok_post_create (
__inout PFLT_CALLBACK_DATA Data,
__in PCFLT_RELATED_OBJECTS FltObjects,
__in PVOID CompletionContext,
__in FLT_POST_OPERATION_FLAGS Flags
)
{

NTSTATUS status_csv = STATUS_SUCCESS;
PAV_INSTANCE_CONTEXT instanceContext = NULL;

PAGED_CODE();

status_csv = FltGetInstanceContext(FltObjects->Instance, (PFLT_CONTEXT*)&instanceContext );

if (NT_SUCCESS( status_csv ))
DbgPrint({"[Ctx]: CtxPostSetInfo -> Instance context info for volume n\tVolumeName = %wZ", &instanceContext->VolumeName);

FltReleaseContext( instanceContext );
}


Anyone Help Me. appreciate

Below WinDbg, BSOD Screenshot.


*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************


Use !analyze -v to get detailed debugging information.

BugCheck 50, {ffff8e8f9435b000, 0, fffff80257db7c7e, 0}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

nt!DbgBreakPointWithStatus:
fffff802`57dcba60 cc int 3
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffff8e8f9435b000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80257db7c7e, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------

Continue reading...