Posted April 6, 201114 yr I am new to device driver programming.I was going through the following link http://www.codeproject.com/KB/system/hide-driver.aspx NtQueryDirectoryfile in the diagram in the section named "NT Function Call Scheme and Hook" returns an process list.Can anybody tell me how does the list transferred to user mode.Please give me a little detailed description like how irp wud be filled with data etc. Edited April 6, 201114 yr by abhijit mohanta
April 6, 201114 yr Author it was a copy paste mistake bro.sorry for the inconvinienceStrange topic title.
Create an account or sign in to comment