Installing filter driver above another third party filter driver for a specific HidClass device

new_kernel_dev999

Is it possible to do so? I would like to inspect and potentially modify certain behaviors of this third party filter driver.

I was looking at this discussion https://community.osr.com/discussion/287194/wdf-attaching-to-device-stack and I saw a comment by Tim Roberts:

Plus, it's trivially easy to install a filter driver in the supported manner, which makes you a full participant in the IRP stack and lets you do everything KMDF can do. A device filter doesn't need an INF. Just copy the file into place, create the service, and tweak the registry.

Seems like a solution to my problem but I don't know how to go about the details.

Mark_Roddy

So the only tricky bit is 'above a specific third party filter driver'. You have to determine if this filter is also installed, and you have to make sure your filter is 'above' it in the list of filters in the registry.

Tim_Roberts

In the Enum registry key for your device, there will be values for UpperFilters and LowerFilters. This is a REG_MULTI_SZ value that includes the list of the service names of the filter drivers for this device. Once you have a service created, you can add your service name to this list.

new_kernel_dev999

@Tim_Roberts said:
In the Enum registry key for your device, there will be values for UpperFilters and LowerFilters. This is a REG_MULTI_SZ value that includes the list of the service names of the filter drivers for this device. Once you have a service created, you can add your service name to this list.

Thank you so much, it works perfectly.