Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


FltRegisterFilter returns 2 "File not found"

Dim_RyDim_Ry Member Posts: 2

Hello,

I have just created an empty miniFilter with Visual Studio 2019.
I have copied MyFsFilter.cat MyFsFilter.inf MyFsFilter.sys to a target machine and successfully registered it by the mean of OSR Driver Loader.

When i try to start it with OSR Driver Loader I will see in DebugView that DriverEntry invoked. But FltRegisterFilter fails with
Status 2 "File not found".

How can i find what is missing ?

NTSTATUS
DriverEntry (
In PDRIVER_OBJECT DriverObject,
In PUNICODE_STRING RegistryPath
)

{
NTSTATUS status;

UNREFERENCED_PARAMETER( RegistryPath );

PT_DBG_PRINT( PTDBG_TRACE_ROUTINES,
              ("MyFsFilter!DriverEntry: try FltRegisterFilter\n") ); **/// OK I see this in DebugView**

status = FltRegisterFilter( DriverObject,
                            &FilterRegistration,
                            &gFilterHandle ); **/// not OK 2 file not found error**

//FLT_ASSERT( NT_SUCCESS( status ) );

if (NT_SUCCESS( status )) {

            PT_DBG_PRINT(PTDBG_TRACE_ROUTINES,
                    ("MyFsFilter!DriverEntry: try FltStartFiltering\n"));

    status = FltStartFiltering( gFilterHandle );

    if (!NT_SUCCESS( status )) {

        FltUnregisterFilter( gFilterHandle );
    }
}

return status;

}

Sincerely
Dmitry Rybakov

PS the same issue with SC.exe. SC.exe successfully creates a registration but SC.exe fails to start that service.

PPS
I tried Sysinternal PROCMON.exe to monitor file access but it does not peek into driver internals.

Comments

  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,135

    The usual reason is that you haven't configured the registry correctly for filter manager. Procmon will show you that happening (filter on the registry key)

  • Dim_RyDim_Ry Member Posts: 2

    @rod_widdowson said:
    The usual reason is that you haven't configured the registry correctly for filter manager. Procmon will show you that happening (filter on the registry key)

    Thank you for support,
    I have correctly installed minifilter using .inf file and started it successfully.

    The point was in [DefaultInstall] section. New version of Visual Studio reqiures architecture decoration. But after i deleted arch. decoration and installed .inf the service started.

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 15 Jun 2020 LIVE ONLINE
Writing WDF Drivers 22 June 2020 LIVE ONLINE
Internals & Software Drivers 28 Sept 2020 Dulles, VA