Hi,
I took the AVSCAN example from github and wanted to extend it to support network volumes. However, every time I try to close the section created by the minifilter for this file (Using FltCloseSectionForDataScan), I get a BSOD RESOURCE_NOT_OWNED.
So I went further and read that FltCreateSectionForDataScan can fail on volumes that do not support synchronization, like network volumes and I should use FsRtlCreateSectionForDataScan instead.
But the call to FltCreateSectionForDataScan doesn’t fail, it’s just the close operation that does.
I the example, a user mode thread sends a message via FilerSendMessage to the minifilter for both creating and closing the section. So it can be that the thread that created the section isn’t the thread that closes it, but I don’t know if that means anything, obviously on a different volume it works flawlessly.
What should I do here?
Thanks!