Detecting all Filter drivers in a system

NTFSD
1

Hi,

Is there any way to detect/list all “File system” filter drivers in a system?

Thanks,
Sreenidhi

Yahoo! Music Unlimited - Access over 1 million songs. Try it free.

2

For mini-filters (only), “fltmc” lists them very nicely.

Ken

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Sreenidhi Ramanuja
Iyangar
Sent: Friday, October 14, 2005 6:15 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Detecting all Filter drivers in a system

Hi,

Is there any way to detect/list all “File system” filter drivers in a
system?

Thanks,
Sreenidhi

Yahoo! Music Unlimited - Access over 1 million songs. Try it free.
http:om/unlimited/> — Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17 You are currently subscribed to
ntfsd as: xxxxx@comcast.net To unsubscribe send a blank email to
xxxxx@lists.osr.com</http:>

3

Starting from the FileSystem name you want (check it out using WinObj or
DeviceTree tool from OSR), walk through all the attached devices of those in
the FileSystem. For example, NTFS has the following devices in object name
space.

\FileSystem\Ntfs\ –> Driver Name
Device 1 –> These devices are function device objects and
unnamed.
Device 2
Device 3
…
\Ntfs –> This device is a control device and named.

Every filter driver should attach its devices to underlying drivers in the
file system stack. These can be observed in AttachedDevice field of the NTFS
devices. There could be multiple filter drivers. So keep walking
AttachedDevice till you find NULL. The filter driver name can be obtained
through DeviceObject->DriverObject->DriverName.

Refer to DeviceTree. It basically displays the above algorithm with more
information. For the whole list of ‘file systems’, do the above for all
drivers with \FileSystem\ prefix in object name space.

Sean

“Sreenidhi Ramanuja Iyangar” wrote in message
news:xxxxx@ntfsd…
Hi,

Is there any way to detect/list all “File system” filter drivers in a
system?

Thanks,
Sreenidhi

Yahoo! Music Unlimited - Access over 1 million songs. Try it free.

4

An API has been added to the system to do this. It is called:
IoEnumerateRegisteredFiltersList

This API will enumerate all filters which have called this API:
IoRegisterFsRegistrationChange

The downside of this API is that it is fairly new (it was added for
filter manager support) and is not universally available. It is current
released on:

Srv03 SP1
W2K SP4+URP
Longhorn

Note that this is not available in XP SP2.

Neal Christiansen
Microsoft File System Filter Group Lead
This posting is provided “AS IS” with no warranties, and confers no
Rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Sean Park
Sent: Sunday, October 16, 2005 5:56 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Detecting all Filter drivers in a system

Starting from the FileSystem name you want (check it out using WinObj or

DeviceTree tool from OSR), walk through all the attached devices of
those in
the FileSystem. For example, NTFS has the following devices in object
name
space.

\FileSystem\Ntfs\ –> Driver Name
Device 1 –> These devices are function device objects
and
unnamed.
Device 2
Device 3
…
\Ntfs –> This device is a control device and
named.

Every filter driver should attach its devices to underlying drivers in
the
file system stack. These can be observed in AttachedDevice field of the
NTFS
devices. There could be multiple filter drivers. So keep walking
AttachedDevice till you find NULL. The filter driver name can be
obtained
through DeviceObject->DriverObject->DriverName.

Refer to DeviceTree. It basically displays the above algorithm with more

information. For the whole list of ‘file systems’, do the above for all
drivers with \FileSystem\ prefix in object name space.

Sean

“Sreenidhi Ramanuja Iyangar” wrote in
message
news:xxxxx@ntfsd…
Hi,

Is there any way to detect/list all “File system” filter drivers in a
system?

Thanks,
Sreenidhi

Yahoo! Music Unlimited - Access over 1 million songs. Try it free.

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com