Callbacks in FLT_REGISTRATION not getting called

NTFSD
1

Hello,
I am trying to make my first file system filter, it will not do anything useful for now just output some information (eg. when a file\dir is created).
I did this:
FltRegisterFilter(pDriverObject, &MY_FilterRegistration, &gFilterPointer); FltStartFiltering(gFilterPointer);

CONST FLT_OPERATION_REGISTRATION MY_Callbacks = {

{IRP_MJ_CREATE, 0, NULL, PostCreate},
{IRP_MJ_OPERATION_END}
};

CONST FLT_REGISTRATION MY_FilterRegistration = {

sizeof( FLT_REGISTRATION ), // Size
FLT_REGISTRATION_VERSION, // Version
0,
NULL, // ContextRegistration

MY_Callbacks, // OperationRegistration

MY_Unload, // FilterUnloadCallback

MY_InstanceSetup, // InstanceSetupCallback
NULL, // InstanceQueryTeardownCallback
NULL, // InstanceTeardownStartCallback
MY_InstanceTeardownComplete, // InstanceTeardownCompleteCallback

NULL, // GenerateFileNameCallback
NULL, // NormalizeNameComponentCallback
NULL // NormalizeContextCleanupCallback

};

But none of the callbacks gets actually called. Well, MY_Unload does work. :\

I have zipped the source (3KB), in case anyone wants to take a peak, and put it here http://bit.ly/8Dz5a9 - it is a direct link.

2

Are you aware of the minispy example in the DDK?

Have you tried using fltmc to have the filter manager send you volumes to mount? Without anything mounted, none of your other callbacks will ever get called.

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Wednesday, December 23, 2009 3:51 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Callbacks in FLT_REGISTRATION not getting called

Hello,
I am trying to make my first file system filter, it will not do anything useful for now just output some information (eg. when a file\dir is created).
I did this:
FltRegisterFilter(pDriverObject, &MY_FilterRegistration, &gFilterPointer); FltStartFiltering(gFilterPointer);

CONST FLT_OPERATION_REGISTRATION MY_Callbacks = {

{IRP_MJ_CREATE, 0, NULL, PostCreate},
{IRP_MJ_OPERATION_END}
};

CONST FLT_REGISTRATION MY_FilterRegistration = {

sizeof( FLT_REGISTRATION ), // Size
FLT_REGISTRATION_VERSION, // Version
0,
NULL, // ContextRegistration

MY_Callbacks, // OperationRegistration

MY_Unload, // FilterUnloadCallback

MY_InstanceSetup, // InstanceSetupCallback
NULL, // InstanceQueryTeardownCallback
NULL, // InstanceTeardownStartCallback
MY_InstanceTeardownComplete, // InstanceTeardownCompleteCallback

NULL, // GenerateFileNameCallback
NULL, // NormalizeNameComponentCallback
NULL // NormalizeContextCleanupCallback

};

But none of the callbacks gets actually called. Well, MY_Unload does work. :\

I have zipped the source (3KB), in case anyone wants to take a peak, and put it here http://bit.ly/8Dz5a9 - it is a direct link.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

No virus found in this incoming message.
Checked by AVG - www.avg.com
Version: 8.5.427 / Virus Database: 270.14.116/2579 - Release Date: 12/21/09 07:36:00

3

C:\>fltmc volumes
Dos Name Volume Name

\Device\HGFS
\Device\WebDavRedirector
\Device\LanmanRedirector
C: \Device\HarddiskVolume1

C:\>fltmc

Filter Name Num Instances Frame

FsFilter 0 0

C:\>fltmc attach FsFilter c:

Attach failed with error: 0x801f0008
The filter is not ready for attachment to volumes because it has not finished
initializing (FltStartFiltering has not been called).

Now I am even more confused, since I do call FltStartFiltering. I used some code from the minispy sample.

4

This is embarrassing, the cause of the problem was a misplaced “!”