Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

Attach/detach on format?

Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 435

Seems like a straight question and something that should not even be queried..
But I have two minifilters that create multiple instances when a volume they are attached to is formatted. Even if they aren't attached to the volume, it still creates 2 instances after the format.

The minifilter is an autoattach MF, attaching to all local volumes. I have tried checking if we are already attached by comparing FltObjects->Volume to the list of volumes we are attached to, but the volume is not present in the list, after format (as I'd expect).

What am I missing?

Comments

  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,450

    You end up with two instances on the new volume? Or is it that your old instance doesn't go away and is still attached to the dismounted/dead file system?

    The former would be spectacularly weird. The latter happens if there are still references to the old file system instance (either from you or from applications with handles open).

    -scott
    OSR

  • Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 435
    via Email
    I get the old ones PLUS 2 per format per volume.
    So if it is attached, that is 1 before format, 3 after 5 after 2 formats.
  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,195

    I am sorry to even mention this since I know you know all this but sometimes one forgets.

    You have implemented all the stuff in the MN_DISMOUNT and MJ_PNP paths to call FltDetach()?

  • Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 435
    via Email
    No, those two are not implemented callbacks at all.
    Any docs that describe what needs to be done in this case?

    One of the filters is so simple.
  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,195

    I am pretty sure that at least one of the samples does this and I always borrow that code. In your case I'm guessing that its the MN_DISMOUNT that needs to be done, but PNP is good hygiene too,

  • Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 435
    via Email
    Only the metadata manager sample handles this, and yeah, it mentions the
    instance will be visible to instance listing APIs.
    I know the instance is not an issue per-se, as it is for an old volume
    object, so there aren't any double/triple callbacks.

    This still does not explain why 2 new instances are made per volume?

    Thanks, I will implement this.

    Kind regards, Dejan Maksimovic.
    FS Lead: http://www.alfasp.com
  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,195

    This still does not explain why 2 new instances are made per volume?

    I'd guess that format process issues two successful MN_DISMOUNTs (one before and one after?)

  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,195

    @Dejan_Maksimovic : For My Info - can you let us know if this works?

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Developing Minifilters 24 May 2021 Live, Online
Writing WDF Drivers 14 June 2021 Live, Online
Internals & Software Drivers 27 September 2021 Live, Online
Kernel Debugging 15 November 2021 Live, Online