- 应用程序通过DeviceIoControl把Event句柄传送给驱动程序.
bResult=DeviceIoControl(m_hDevice,
IOCTL_SEND_EVENT_HANDLE,
&m_hEvent,
sizeof(HANDLE),
ReData,
4,
&nBytes,
NULL);
- 驱动程序的分发例程序中通过ObReferentceObjectByHandle函数得到内核事件对象
case IOCTL_SEND_EVENT_HANDLE:
HANDLE hEvent=*(HANDLE *)IoBuffer;
stStatus=ObeferenceObjectByHandle(hEvent,
EVENT_MODIFY_STATE,
*ExEventObjectType,
KernelMode,
(PVOID*)pdx->pEvent,
NULL);
...
break;