Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

›
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

Uninstalling PCIe Filter Driver

Calin_IaruCalin_Iaru Member - All Emails Posts: 164
in NTDEV

Hi,
I encounter an issue with DifxApi inside Windows Installer on XML. After uninstalling the .msi file, if the system is rebooted, the OS will attempt to load the filter driver. It will never call EvtDriverDeviceAdd(), only DriverEntry(). The issue here is that the file is missing, which results in a corrupt image: a new reboot cycle, attempt to repair, startup errors are not found, sfc.exe /scannow has no effect. This happens on Windows 10. It is unknown if the issue is present on previous Windows versions.
As a test, running "storage\filters\addfilter" WDK sample with "/remove CustomPCIeFilter" shows the following:

  • the 1st reboot calls DriverEntry()
  • the 2nd reboot does not search for a filter driver
    Since AddFilter sample and DifxApi have the same outcome, this indicates that the issue is common. Perhaps a flag inside SetupApi can tune this.
    It is possible that the INF file is "weird", although I used the guidelines from the samples. Is there a way to prevent the OS from loading the filter driver on the 1st reboot?
    Thank you,
    Calin
· Share on Facebook

Comments

  • Doron_HolanDoron_Holan Member - All Emails Posts: 10,448
    What is the start type of the service in the INF? If it is not 3, you could have a stale service entry that is configured to auto load the driver no matter if it is configured on a device or not.
    d
    · Share on Facebook
  • Calin_IaruCalin_Iaru Member - All Emails Posts: 164

    Hi Doron,
    I have tried with both "3" = SERVICE_DEMAND_START and "0" = SERVICE_BOOT_START. There is no difference in behavior. Based on \INF\SetupApi.dev.log, the StartType is changed to the type of the service below. For PCI.INF, the StartType = 0.
    Regards,
    Calin

    · Share on Facebook
  • Calin_IaruCalin_Iaru Member - All Emails Posts: 164
    edited November 2019

    Using "sc.exe delete PCIeFilterName" works. I am adding DeleteService() API into the setup program. Thanks!

    · Share on Facebook
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Register

Quick Links

Upcoming OSR Seminars
Writing WDF Drivers 21 Oct 2019 OSR Seminar Space & ONLINE
Internals & Software Drivers 18 Nov 2019 Dulles, VA
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 27 Apr 2020 OSR Seminar Space & ONLINE

Categories