A forum for reverse engineering, OS internals and malware analysis 

Ask your beginner questions here.
 #28095  by dungai
 Wed Mar 23, 2016 11:49 am
I am currently creating a "driverless driver".

I just want to know the standard practice for working with driver handles, the CreateFile call creates a handle to my driver, is it ok to do that only once on program startup or is it better to create a new handle and close it for each ioctl request?

Another question is, if I accidentally don't close a driver handle and then in visual studio I "stop debugging" therefore terminating the process, what would happen to the driver? would the handle be left unclosed and cause problems or does the operating system close all the handles for me?

I couldn't find this info on google so this is the only place I thought I could ask ;)

Thanks
 #28100  by EP_X0FF
 Wed Mar 23, 2016 4:56 pm
dungai wrote:I just want to know the standard practice for working with driver handles, the CreateFile call creates a handle to my driver, is it ok to do that only once on program startup or is it better to create a new handle and close it for each ioctl request?
Doesn't matter. It is just a handle for device, nothing more. Open it once and use until you need it. When you call CreateFile it will query symbolic link to the driver device and system will send IRP_MJ_CREATE (https://msdn.microsoft.com/en-us/librar ... s.85).aspx), if driver set handler for it, driver code will process open request.
Another question is, if I accidentally don't close a driver handle and then in visual studio I "stop debugging" therefore terminating the process, what would happen to the driver? would the handle be left unclosed and cause problems or does the operating system close all the handles for me?
Your handle will be destroyed while process exit.