A forum for reverse engineering, OS internals and malware analysis 

Ask your beginner questions here.
 #7036  by lorddoskias
 Sat Jul 02, 2011 5:31 pm
Hello,

If I have a user-mode application which sends an IOCTL to my driver which contains a user-mode address I have to call MmGetSystemAddressForMdlSafe to get a system address which I can dereference. But is this address persistent only in the current invocation of the dispatch routine, that is after the current IRP is complete via IoCompleteRequest can I still continue to use the address received from mmgetsystemaddressformdlsafe or after the irp is complete the IO manager automatically calls MmUnlockPages and IoFreeMdl on the irp's mdl. Furthermore if cleaning is not performed by the IO manager this means I'm free to use MmUnlockPages and IoFreeMdl on my own accord when I deem that i won't be needing the address, right?