Thank you! The following works when put inside "DriverEntry"ntStatus = KsLoadResource(DriverObject->DriverStart,PagedPool,102,RT_RCDATA,&pData,&dataSize);
What is interesting is that the same KsLoadResource will throw an access violation if you store DriverStart and use it later inside a function like NewStream running at PASSIVE_LEVEL.
Tim Roberts wrote:
SP wrote:Does anyone have an example of using KsLoadResource?I am trying to read a resource out of a kernel driver, but it keeps coming up with the error STATUS_RESOURCE_DATA_NOT_FOUND. I am not sure if it's the ImageBase (which I passed in NULL) or some mapping issue with the type RCDATA versus RT_RCDATA.You can't pass NULL for the ImageBase. Unlike a user-mode process, there's no good way for KsLoadResource to find your driver. You have to provide the ImageBase.Fortunately, that's easy to get: DriverStart in your DRIVER_OBJECT.What I don't see is how you pass a string to the ResourceName: LPSTR, LPWSTR, ANSI_STRING, or UNICODE_STRING. Perhaps you should just use an integer.
****************** WDMAUDIODEV addresses: Post message: mailto:wdmaudiodev@xxxxxxxxxxxxx Subscribe: mailto:wdmaudiodev-request@xxxxxxxxxxxxx?subject=subscribe Unsubscribe: mailto:wdmaudiodev-request@xxxxxxxxxxxxx?subject=unsubscribe Moderator: mailto:wdmaudiodev-moderators@xxxxxxxxxxxxx URL to WDMAUDIODEV page: http://www.wdmaudiodev.com/