confusion about contexts in minifilter

NTFSD
1

I have registered for a callback as shown below, expecting NvCtxInstanceSetup() to be called each time a device is mounted. That is once for the C drive, once for the D drive, etc. And maybe each time the CDROM sees a new CD.

When the minifilter is loaded, via user mode FilterLoad() I see it call for my C drive, but that is it! WHY does it not call about D,etc.

The whole discussion about Context/Instance is confusing, but in the Filter Manager Concepts article in MSDN it says that Attachment of a driver at an altitude is an INSTANCE. I think that is what I am trying for.

If I have confused things, how do I untwist this?

Thanks
Larry

CONST FLT_REGISTRATION FilterRegistration = {

sizeof(FLT_REGISTRATION), // Size
FLT_REGISTRATION_VERSION, // Version
0, // Flags

NvContextRegistration, // Context
Callbacks, // Operation callbacks

NvFsFilterUnload, // FilterUnload

NvCtxInstanceSetup, // InstanceSetup
NvCtxInstanceQueryTeardown , // InstanceQueryTeardown
NvCtxInstanceTeardownStart, // InstanceTeardownStart
NvCtxInstanceTeardownComplete, // InstanceTeardownComplete

NULL, // GenerateFileName
NULL, // GenerateDestinationFileName
NULL // NormalizeNameComponent

#if NVFSMON_LONGHORN

,
SpyKtmNotificationCallback // KTM notification callback

#endif // NVFSMON_LONGHORN

};

2

I might further say that I launch the minifilter with a call to FilterLoad() in user mode app.
I have also discovered that once this happens, If I explicity make use fltmc attach mymini d:
then I get what I think is the expected behavior and so I do see a call.

I guess then my question boils into why did Filterload() cause an attachment to only 1 drive volume. I guess I would now have to say it maybe should have enum’ed all the vols and that would have made sense, or it should have attached to none, and I guess that would have made sense too.

Larry

3

In your inf file, is Instance.Flags set too 0x0?

xxxxx@sbcglobal.net wrote:

I might further say that I launch the minifilter with a call to FilterLoad() in user mode app.
I have also discovered that once this happens, If I explicity make use fltmc attach mymini d:
then I get what I think is the expected behavior and so I do see a call.

I guess then my question boils into why did Filterload() cause an attachment to only 1 drive volume. I guess I would now have to say it maybe should have enum’ed all the vols and that would have made sense, or it should have attached to none, and I guess that would have made sense too.

Larry

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: matt-martin@tx.rr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

There is no inf file. The driver was “installed” by just setting value in … Currentcontrolset\services…\my driver.
Larry

5

You can configure your filter for either automatic or manual attachment
using the inf file, and probably the registry too. Check out the help topic
on creating an inf file.

/Daniel

wrote in message news:xxxxx@ntfsd…
> There is no inf file. The driver was “installed” by just setting value in
> … Currentcontrolset\services…\my driver.
> Larry
>