attaching file system driver to volume

NTFSD
1

Hi there,

I am writing my first file system driver from scratch.

So far, the filter only has a DriverEntry, Passthrough and a ‘control’
routine that responds to IRP_MJ_FILE_SYSTEM_CONTROL.
While the filter is installed correctly, and I can see it running and loaded
using osrloader, I do only see the debug output of the DriverEntry routine,
but it seems like the callback for IRP_MJ_FILE_SYSTEM_CONTROL, nor the
default passthrough routine, are never called since I cannot see the debug
output.

I believe that it has to do with the .inf file that I am using, wich is a
modification of SFilter sample .inf file. I would like to know how to write
a simple .inf file for installing an activity monitor filter that attaches
to mounted volumes as they are mounted (wich is the loadordergroup,
starttype, etc).

Bests.

2

Sergi,

If you see your driver running, and can see the output from the Driver
Entry routine, your driver is loaded and running. INF files would not
affect this. You said your basing this off the SFilter example, perhaps
you should look at the rest of the SFilter example. Take a look at the
SFilter entry and then look at SfFsNotification routine. The
SfFsNotification routine will connect you to all attached FS’s.

Sounds like your IRP FS control codes are being fired into no where. If
your not attached to any devices, why would the IO manager pass an IRP
to your driver?

Maybe I’m wrong, I’m learning myself.

Good Luck

3

> debug output of the DriverEntry routine, but it seems like the callback for

IRP_MJ_FILE_SYSTEM_CONTROL, nor the default passthrough routine,
are never called since I cannot see the debug output.

Sorry for stupid question - did you write any test app which sends
an IOCTL request ?
If you write such “blank driver”, it is usually not attached
to any volume and thus it does not receive any I/O requests
except for app-sent IOCTL requests.

If you want to see the output from pass though routine too,
you must however attach your driver to any FSD driver.

L.

4

Hi there,

It is working now. As Ladislav pointed out, I wasn’t calling
IoRegisterFsRegistrationChange.

More newbie questions, coming soon :wink:

On 10/3/05, Ladislav Zezula wrote:
>
> > debug output of the DriverEntry routine, but it seems like the callback
> for
> > IRP_MJ_FILE_SYSTEM_CONTROL, nor the default passthrough routine,
> > are never called since I cannot see the debug output.
> Sorry for stupid question - did you write any test app which sends
> an IOCTL request ?
> If you write such “blank driver”, it is usually not attached
> to any volume and thus it does not receive any I/O requests
> except for app-sent IOCTL requests.
> If you want to see the output from pass though routine too,
> you must however attach your driver to any FSD driver.
> L.
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
>
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>