Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home› NTDEV
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Uninstalling PCIe Filter Driver

Calin_IaruCalin_Iaru Member - All Emails Posts: 166
in NTDEV

Hi,
I encounter an issue with DifxApi inside Windows Installer on XML. After uninstalling the .msi file, if the system is rebooted, the OS will attempt to load the filter driver. It will never call EvtDriverDeviceAdd(), only DriverEntry(). The issue here is that the file is missing, which results in a corrupt image: a new reboot cycle, attempt to repair, startup errors are not found, sfc.exe /scannow has no effect. This happens on Windows 10. It is unknown if the issue is present on previous Windows versions.
As a test, running "storage\filters\addfilter" WDK sample with "/remove CustomPCIeFilter" shows the following:

  • the 1st reboot calls DriverEntry()
  • the 2nd reboot does not search for a filter driver
    Since AddFilter sample and DifxApi have the same outcome, this indicates that the issue is common. Perhaps a flag inside SetupApi can tune this.
    It is possible that the INF file is "weird", although I used the guidelines from the samples. Is there a way to prevent the OS from loading the filter driver on the 1st reboot?
    Thank you,
    Calin
· Share on Facebook

Comments

  • Doron_HolanDoron_Holan Member - All Emails Posts: 10,503
    What is the start type of the service in the INF? If it is not 3, you could have a stale service entry that is configured to auto load the driver no matter if it is configured on a device or not.
    d
    · Share on Facebook
  • Calin_IaruCalin_Iaru Member - All Emails Posts: 166

    Hi Doron,
    I have tried with both "3" = SERVICE_DEMAND_START and "0" = SERVICE_BOOT_START. There is no difference in behavior. Based on \INF\SetupApi.dev.log, the StartType is changed to the type of the service below. For PCI.INF, the StartType = 0.
    Regards,
    Calin

    · Share on Facebook
  • Calin_IaruCalin_Iaru Member - All Emails Posts: 166
    edited November 2019

    Using "sc.exe delete PCIeFilterName" works. I am adding DeleteService() API into the setup program. Thanks!

    · Share on Facebook
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Register
Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 15 Jun 2020 LIVE ONLINE
Writing WDF Drivers 22 June 2020 LIVE ONLINE
Internals & Software Drivers 28 Sept 2020 Dulles, VA

Categories