Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:

Read .txt file using FltReadFile() from minifilter

santidediegosantidediego Member Posts: 3

I am trying to read a config.txt file that contains a list of paths separated by ";" from a minifilter.

config.txt file looks like:


Then, in instance_setup() method I do:

     HANDLE fileHandle = NULL;
     OBJECT_ATTRIBUTES objectAttributes;
     PVOID result;
     result = ExAllocatePool(NonPagedPool, 65536);
     PFILE_OBJECT fileObject = NULL;
     UNICODE_STRING myUnicodeStr;
     RtlInitUnicodeString(&myUnicodeStr, config_file_path);
     InitializeObjectAttributes(&objectAttributes, &myUnicodeStr, OBJ_CASE_INSENSITIVE | OBJ_OPENIF, NULL,NULL);
     IO_STATUS_BLOCK ioStatus;
     FltCreateFile(flt_objects->Filter, flt_objects->Instance, &fileHandle, GENERIC_READ, &objectAttributes, &ioStatus, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ, FILE_OPEN, FILE_SEQUENTIAL_ONLY, NULL, 0, 0);
     ObReferenceObjectByHandle(fileHandle, GENERIC_READ, NULL, KernelMode, &fileObject, NULL);
     ULONG bytes_read;
     FltReadFile(flt_objects->Instance, fileObject, NULL, 65536, result, FLTFL_IO_OPERATION_DO_NOT_UPDATE_BYTE_OFFSET, &bytes_read, NULL, NULL);

    //result should have the content of file

I am getting a blue screen when starting the minifilter. I´ve tested that the code works properly until FltCreateFile (I am able to get a proper fileHandler). I do not see what I am doing wrong after this.


  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,265
    edited October 2022

    More data needed:

    • What does the BSOD say.
    • What is the stack when you catch it in the debugger?
    • What does analyze -v say?
    • Why are you ignoring all the possible failures (pool allocation, file opening, file object creation)?

    I'll also observer that ExAllocatePool is deprecated and that there is a variant FltCreateFile which sets up an FO for you.

  • santidediegosantidediego Member Posts: 3

    I can provide for the moment just this data because I am not using a debugger:

    • FltCreateFile() works as I can get a handler and actually create a file in the filesystem, then discarding file opening and file object creation problems
    • Same error with ExAllocatePool2()
  • Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 611
    via Email
    Where do you initialize the NULL file object?
  • Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 611
    via Email
    And note that ; is a valid file name character.
  • santidediegosantidediego Member Posts: 3
    edited November 2022

    @Dejan_Maksimovic said:
    Where do you initialize the NULL file object?

    Missed this. I´ve allocated space for PFILE_OBJECT with ExAllocatePool2(), but same blue screen.

    @Dejan_Maksimovic said:
    And note that ; is a valid file name character.

    Yes, but the .txt file is generated by other application that does not use ; but for separation, not for filenames.

    Post edited by santidediego on
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 13-17 May 2024 Live, Online
Developing Minifilters 1-5 Apr 2024 Live, Online
Internals & Software Drivers 11-15 Mar 2024 Live, Online
Writing WDF Drivers 26 Feb - 1 Mar 2024 Live, Online