A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #29941  by ithurricane
 Thu Feb 09, 2017 5:22 am
Hi there,

I use FltReadFile in miniFilter at PostCreate, sometime cause system very slowly.

status = FltReadFile( Instance,
FileObject,
&offset,
length,
buffer,
FLTFL_IO_OPERATION_NON_CACHED |
FLTFL_IO_OPERATION_DO_NOT_UPDATE_BYTE_OFFSET,
&bytesRead,
NULL,
NULL );

as same as Windows-driver-samples\filesys\miniFilter\scanner

Any ideas?