DriverEntry例程中IoCreateNotificationEvent()为什么失败？

    我想在内核建立一个命名事件，然后应用程序获得这个事件对象的句柄，之后，驱动程序就可以把通知送到应用程序。
    然后，在DriverEntry作如下调用却总是返回失败，请指点迷津。
UNICODE_STRING uEventName,
WCHAR wEventName[]=L\"abcdefghijklmn\"
PKEVENT   pEvent;
PHANDLE   pHandle;

RtlInitUnicodeString(&uEventName,wEventName);
pEvent=IoCreateNotificationEvent(&uEventName,pHandle);
if( !pEvent )
{
    return STATUS_INSUFFICIENT_RESOURCE;
}

The \\BasedNamedObjects object directory is not created until the Win32? system initializes. Therefore, drivers that are loaded at boot time cannot create event objects in their DriverEntry routines that are visible to user-mode programs.

你是怎么写的？不应该出问题呀。我一直都是由驱动程序创建事件，应用程序来获得句柄的。
hEvent=OpenEvent(SYNCHRONIZE, FALSE, EVENT_NAME);

同意Tom.Cat的观点. 让 USER  APP 准备一个EVENT,然后, 在KERNEL下打开,AND FIRE 是可行的.

新的问题：怎么驱动程序端好了，应用程序端OpenEvent返回为空？GetLastError()返回5（ACCESS_DENIED），这是什么原因？
命名如下：
应用程序TCHAR EventName[]=_T(\"SharedEvent\");
驱动程序WCHAR EventName[]=L\"\\\\BaseNamedObject\\\\SharedEvent\";

我是直接在微软网站上搜索的，应该是较新的吧。

在DDK中也有对IoCreateNotificationEvent的解释是Initializes a named notification event to be used to synchronize access between two or more components.
我想，这是它的命名规则，并不只限于和应用程序之间。

另：你的DDK是什么版本？我的DDK就没有详细但错误的那段话。

以下是DDK文档中的关于IoCreateNotificationEvent的描述，真他妈的混蛋。

IoCreateNotificationEvent
IoCreateNotificationEvent creates or opens a named notification event used to notify one or more threads of execution that an event has occurred.

PKEVENT
  IoCreateNotificationEvent(
    IN PUNICODE_STRING  EventName,
    OUT PHANDLE  EventHandle
    );
Parameters
EventName
Points to a buffer containing a zero-terminated Unicode string that names the event.
EventHandle
Points to a location in which to return a handle for the event object. The handle includes bookkeeping information, such as a reference count and security context.
Return Value
IoCreateNotificationEvent returns a pointer to the created or opened event object or NULL if the event object could not be created or opened.

Headers
Declared in wdm.h and ntddk.h. Include wdm.h or ntddk.h.

Comments
IoCreateNotificationEvent creates and opens the event object if it does not already exist. IoCreateNotificationEvent sets the state of a new notification event to Signaled. If the event object already exists, IoCreateNotificationEvent just opens the event object.

When a notification event is set to the Signaled state it remains in that state until it is explicitly cleared.

Notification events, like synchronization events, are used to coordinate execution. Unlike a synchronization event, a notification event is not auto-resetting. Once a notification event is in the Signaled state, it remains in that state until it is explicitly reset (with a call to KeClearEvent or KeResetEvent).

To synchronize on a notification event:

Open the notification event with IoCreateNotificationEvent. Identify the event with the EventName string.
Wait for the event to be signaled by calling KeWaitForSingleObject with the PKEVENT returned by IoCreateNotificationEvent. More than one thread of execution can wait on a given notification event. To poll instead of stall, specify a Timeout of zero to KeWaitForSingleObject.
Close the handle to the notification event with ZwClose when access to the event is no longer needed.
Sharing event objects between user mode and kernel mode requires care. The system creates user-mode event objects relative to the \\\\BasedNamedObjects object directory, and only those event objects are visible to user-mode programs. The Xxx user-mode event corresponds to the \\\\BasedNamedObjects\\Xxx kernel-mode event. The preferred method to share event objects between user mode and kernel mode is for the user-mode program to create the event object and pass it to the driver through an IOCTL. The \\\\BasedNamedObjects object directory is not created until the Win32? system initializes. Therefore, drivers that are loaded at boot time cannot create event objects in their DriverEntry routines that are visible to user-mode programs.

Callers of IoCreateNotificationEvent must be running at IRQL PASSIVE_LEVEL.

See Also
IoCreateSynchronizationEvent, KeClearEvent, KeResetEvent, KeSetEvent, KeWaitForSingleObject, RtlInitUnicodeString, ZwClose

Built on Wednesday, October 03, 2001
 Contact Us   |  E-Mail this Page   |  MSDN Flash Newsletter  
 ? 2002 Microsoft Corporation. All rights reserved.   Terms of Use  Privacy Statement   Accessibility  

    问题解决：MS真他妈的混蛋，我分明是在DDK文档中看到的这个描述，没想到竟然是错误的 。
    不过有一个疑问是： 只有在这个事件在应用程序和内核之间共享时才需要遵守这个命名规范，那为什么我不能随便取一个名字呢？我换上另外任何一个名字都失败，不知是为什么？

是BaseNamedObjects， 而不是BasedNamedObjects

你看不出两者有差别吗？

[quoto]
版主，你确信吗？我刚刚在我的DriverEntry中试了，正常启动。
UNICODE_STRING uEventName;
WCHAR wEventName[]=L\"\\\\BaseNamedObjects\\\\sharedevent\";
PKEVENT pEvent;
HANDLE Handle;

RtlInitUnicodeString(&uEventName,wEventName);
pEvent=IoCreateNotificationEvent(&uEventName,&Handle);
if(!pEvent)
{
return STATUS_UNSUCCESSFUL;
}

你再看看！

[/quoto]

这是我的源代码：
WCHAR    wEventNameBuf[]=L\"\\\\BasedNamedObjects\\\\SharedEvent\";
UNICODE_STRING uEventName;

PKEVENT pEvent;
HANDLE  hEvent;

RtlInitUnicodeString(&uEventName,wEventNameBuf);

pEvent = IoCreateNotificationEvent(&uEventName,&hEvent);
if(! pEvent )
{
    return STATUS_INSUFFICIENT_RESOURCE;
}

版主，你确信吗？我刚刚在我的DriverEntry中试了，正常启动。
UNICODE_STRING uEventName;
WCHAR wEventName[]=L\"\\\\BaseNamedObjects\\\\sharedevent\";
PKEVENT pEvent;
HANDLE Handle;

RtlInitUnicodeString(&uEventName,wEventName);
pEvent=IoCreateNotificationEvent(&uEventName,&Handle);
if(!pEvent)
{
return STATUS_UNSUCCESSFUL;
}

你再看看！

pEvent=IoCreateNotificationEvent(&uEventName,pHandle);

第二个参数为输出参数，该函数不会为你分配内存空间，所以你应该定义HANDLE hHandle,然后把地址传入
pEvent=IoCreateNotificationEvent(&uEventName,&hHandle);


 

那样我也试过，没用。

Tom_lyd版主，人家ymvv得你这二十分可是理所当然阿。
快给吧！

pEvent=IoCreateNotificationEvent(&uEventName,pHandle);

第二个参数为输出参数，该函数不会为你分配内存空间，所以你应该定义HANDLE hHandle,然后把地址传入
pEvent=IoCreateNotificationEvent(&uEventName,&hHandle);

补充：
因为我的事件对象要在应用程序和驱动程序中共享，所以我的命名为：
L\"\\\\BaseNamedObjects\\\\sharedevent\"
但是在DriverEntry例程里面就是失败，真不知为何。