Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Sept/Oct 2019 Issue of The NT Insider available


Download PDF here: http://insider.osr.com/2019/ntinsider_2019_01.pdf

It’s a particularly BIG issue, too: 40 pages of technical goodness, ranging from WDF to Minifilters. Check it out.
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

FltRegisterFilter returns 2 "File not found"

Dim_RyDim_Ry Member Posts: 2

Hello,

I have just created an empty miniFilter with Visual Studio 2019.
I have copied MyFsFilter.cat MyFsFilter.inf MyFsFilter.sys to a target machine and successfully registered it by the mean of OSR Driver Loader.

When i try to start it with OSR Driver Loader I will see in DebugView that DriverEntry invoked. But FltRegisterFilter fails with
Status 2 "File not found".

How can i find what is missing ?

NTSTATUS
DriverEntry (
In PDRIVER_OBJECT DriverObject,
In PUNICODE_STRING RegistryPath
)

{
NTSTATUS status;

UNREFERENCED_PARAMETER( RegistryPath );

PT_DBG_PRINT( PTDBG_TRACE_ROUTINES,
              ("MyFsFilter!DriverEntry: try FltRegisterFilter\n") ); **/// OK I see this in DebugView**

status = FltRegisterFilter( DriverObject,
                            &FilterRegistration,
                            &gFilterHandle ); **/// not OK 2 file not found error**

//FLT_ASSERT( NT_SUCCESS( status ) );

if (NT_SUCCESS( status )) {

            PT_DBG_PRINT(PTDBG_TRACE_ROUTINES,
                    ("MyFsFilter!DriverEntry: try FltStartFiltering\n"));

    status = FltStartFiltering( gFilterHandle );

    if (!NT_SUCCESS( status )) {

        FltUnregisterFilter( gFilterHandle );
    }
}

return status;

}

Sincerely
Dmitry Rybakov

PS the same issue with SC.exe. SC.exe successfully creates a registration but SC.exe fails to start that service.

PPS
I tried Sysinternal PROCMON.exe to monitor file access but it does not peek into driver internals.

Comments

  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,072

    The usual reason is that you haven't configured the registry correctly for filter manager. Procmon will show you that happening (filter on the registry key)

  • Dim_RyDim_Ry Member Posts: 2

    @rod_widdowson said:
    The usual reason is that you haven't configured the registry correctly for filter manager. Procmon will show you that happening (filter on the registry key)

    Thank you for support,
    I have correctly installed minifilter using .inf file and started it successfully.

    The point was in [DefaultInstall] section. New version of Visual Studio reqiures architecture decoration. But after i deleted arch. decoration and installed .inf the service started.

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
Writing WDF Drivers 21 Oct 2019 OSR Seminar Space & ONLINE
Internals & Software Drivers 18 Nov 2019 Dulles, VA
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 27 Apr 2020 OSR Seminar Space & ONLINE