Hello,
I have just created an empty miniFilter with Visual Studio 2019.
I have copied MyFsFilter.cat MyFsFilter.inf MyFsFilter.sys to a target machine and successfully registered it by the mean of OSR Driver Loader.
When i try to start it with OSR Driver Loader I will see in DebugView that DriverEntry invoked. But FltRegisterFilter fails with
Status 2 “File not found”.
How can i find what is missing ?
NTSTATUS
DriverEntry (
In PDRIVER_OBJECT DriverObject,
In PUNICODE_STRING RegistryPath
)
{
NTSTATUS status;
UNREFERENCED_PARAMETER( RegistryPath );
PT_DBG_PRINT( PTDBG_TRACE_ROUTINES,
("MyFsFilter!DriverEntry: try FltRegisterFilter\n") ); **/// OK I see this in DebugView**
status = FltRegisterFilter( DriverObject,
&FilterRegistration,
&gFilterHandle ); **/// not OK 2 file not found error**
//FLT_ASSERT( NT_SUCCESS( status ) );
if (NT_SUCCESS( status )) {
PT_DBG_PRINT(PTDBG_TRACE_ROUTINES,
("MyFsFilter!DriverEntry: try FltStartFiltering\n"));
status = FltStartFiltering( gFilterHandle );
if (!NT_SUCCESS( status )) {
FltUnregisterFilter( gFilterHandle );
}
}
return status;
}
Sincerely
Dmitry Rybakov
PS the same issue with SC.exe. SC.exe successfully creates a registration but SC.exe fails to start that service.
PPS
I tried Sysinternal PROCMON.exe to monitor file access but it does not peek into driver internals.