Manejo de solicitudes TDI_RECEIVE

I'm writing simple TDI filter driver (well, I remember that it's year 2013 now )))). I need to inspect first chunk of HTTP reply. So I intercept TDI_RECEIVE request, setup my completion routine and forward IRP to next driver. In completion routine I'd like to inspect returned chunk.

El código es el siguiente:

case TDI_RECEIVE:{
            PVOID buf = MmGetSystemAddressForMdlSafe(Irp->MdlAddress,HighPagePriority);
            ULONG size = MmGetMdlByteCount(Irp->MdlAddress);

            IoCopyCurrentIrpStackLocationToNext(Irp);
            ntStatus = IoSetCompletionRoutineEx(MntrDevice,Irp,IoCompletion, NULL,TRUE,TRUE,TRUE);
            break;
............................................................................
 ntStatus = IoCallDriver ( NextDevice , Irp );
 return ntStatus ;

Completion routine:

PVOID buf = MmGetSystemAddressForMdlSafe(irp->MdlAddress,HighPagePriority);
int size = Irp->IoStatus.Information;

It's very strange, but there is only one TDI_RECEIVE request with one MD about 3K, and corresponding completed IRP contains LAST chunk of the WEB-pager (i.e. no HTTP response, no page beginning). And I don't see any other recv/read requests.

Any suggestion where they are hiding (actually I need only first chunk of first HTTP response per TCP session)?

preguntado el 05 de mayo de 13 a las 15:05

1 Respuestas

You need make hook on set TDI_EVENT_CHAINED_RECEIVE callback (actually there are more callbacks, but this one works). In this callback you can analyze received data and than call original callback.

contestado el 07 de mayo de 13 a las 15:05

No es la respuesta que estás buscando? Examinar otras preguntas etiquetadas or haz tu propia pregunta.