It appears that fltkd.filter is also broken (which is a shame because it was one of the few things I was looking forward to using inVista).
I’m not going to cross post, but FMI, wouldn’t this be better in NTFSD? As Drew has pointed out previously, all that the WinDbg guys do is package other people’s plugin.
=====================
Type “!fltkd.filter 8E8FC2E8 8 1” in the debugger for a list of leaked references
Break, ignore, zap or remove ? b
b
Breaking in… (press g to return to assert menu)
Break instruction exception - code 80000003 (first chance)
nt!DbgBreakPoint:
8183ce90 cc int 3
1: kd> !fltkd.filter 8E8FC2E8 8 1
*** Extension DLL(5457 Free) does not match target system(5600 Free)
FLT_FILTER: 8e8fc2e8 “MyDrv” “221100”
InstanceList : (8e8fc318)
Resource (8e8fc350) List [8e8fc350-8e8fc350] rCount=0
Object usage/reference information:
References to FLT_CONTEXT : 0
Allocations of FLT_CALLBACK_DATA : 0
Allocations of FLT_DEFERRED_IO_WORKITEM : 0
Allocations of FLT_GENERIC_WORKITEM : 0
References to FLT_FILE_NAME_INFORMATION : 0
Open files : 14
References to FLT_OBJECT : 0
List of objects used/referenced::
Could not read offset of field “TreeLink” from type fltmgr!_FLT_VERIFIER_OBJECT