It does seem odd, the resource isn't DISCARDABLE.It is actually the KsLoadResource that faults while looking for the resource, the pointer looks like its about 0x400 away from the imagebase. If I load the resource, then store the resources pointer that pointer won't throw an access violation and seems to work just fine.
Tim Roberts wrote:
SP wrote:The following works when put inside "DriverEntry"ntStatus = KsLoadResource(DriverObject->DriverStart,PagedPool,102,RT_RCDATA,&pData,&dataSize);What is interesting is that the same KsLoadResource will throw an access violation if you store DriverStart and use it later inside a function like NewStream running at PASSIVE_LEVEL.Really? I'm surprised by that. I could understand it at DISPATCH_LEVEL, because the resource segment is probably marked as pageable.Is the resource marked as DISCARDABLE?
****************** WDMAUDIODEV addresses: Post message: mailto:wdmaudiodev@xxxxxxxxxxxxx Subscribe: mailto:wdmaudiodev-request@xxxxxxxxxxxxx?subject=subscribe Unsubscribe: mailto:wdmaudiodev-request@xxxxxxxxxxxxx?subject=unsubscribe Moderator: mailto:wdmaudiodev-moderators@xxxxxxxxxxxxx URL to WDMAUDIODEV page: http://www.wdmaudiodev.com/