Dynamic Load/Unload device driver.

Hi all,

my project is based on SFILTER sample.
basically, reboot after installation, SFILTER sample works well,

when I use SCM APIs(using install application-it based on INSTDRV sample),
SFILTER installed and loaded succesfully. but it dosen’t works.

How can I load/unload SFILTER sample dynamically? (without reboot.)

sorry for novice question. and poor English.

Thanks
terra


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Hi Terra,

may be you have to understand how sfilter sample works.
sfilter is a file system filter driver, it loads before any file system
driver and waits until “a file system has either registered or
unregistered itself as an active file system.”

//
// Register this driver for watching file systems coming and going.
//
status = IoRegisterFsRegistrationChange( DriverObject, SfFsNotification );

So, when you load your sfilter after reboot process, it will not filter
previously loaded file systems…
May be to do dinamicaly load/unload you have to hook/unhook drives ( see
how it works in FileMon sample code )

Kristian


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Terra,

As Kristian pointed out, the sfilter sample was originally designed to
only be loaded at boot time. The reason for this is that there is no
documented way to enumerate volumes and file systems that were mounted /
loaded before sfilter was loaded.

The updated sfilter sample in the WindowXP IFSKit is designed so that it
can be loaded at any time. The problem is, to do this it uses new APIs
that only exist in WindowsXP.

This probably does not help you now (since you are probably doing this
on Windows 2000 or NT 4) but the problem has been solved for the future.

One other note, file system filters can not be safely unloaded.

Neal Christiansen

-----Original Message-----
From: xxxxx@softonnet.com [mailto:xxxxx@softonnet.com]
Sent: Tuesday, May 15, 2001 5:00 PM
To: File Systems Developers
Subject: [ntfsd] Dynamic Load/Unload device driver.

Hi all,

my project is based on SFILTER sample.
basically, reboot after installation, SFILTER sample works well,

when I use SCM APIs(using install application-it based on INSTDRV
sample),
SFILTER installed and loaded succesfully. but it dosen’t works.

How can I load/unload SFILTER sample dynamically? (without reboot.)

sorry for novice question. and poor English.

Thanks
terra


You are currently subscribed to ntfsd as: xxxxx@Exchange.Microsoft.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Neal , What is this new API if I may know ? A prototype would be also
appreciated.
Thank you , Dan

----- Original Message -----
From: “Neal Christiansen”
To: “File Systems Developers”
Sent: Wednesday, June 13, 2001 11:07 AM
Subject: [ntfsd] RE: Dynamic Load/Unload device driver.

Terra,

As Kristian pointed out, the sfilter sample was originally designed to
only be loaded at boot time. The reason for this is that there is no
documented way to enumerate volumes and file systems that were mounted /
loaded before sfilter was loaded.

The updated sfilter sample in the WindowXP IFSKit is designed so that it
can be loaded at any time. The problem is, to do this it uses new APIs
that only exist in WindowsXP.

This probably does not help you now (since you are probably doing this
on Windows 2000 or NT 4) but the problem has been solved for the future.

One other note, file system filters can not be safely unloaded.

Neal Christiansen

-----Original Message-----
From: xxxxx@softonnet.com [mailto:xxxxx@softonnet.com]
Sent: Tuesday, May 15, 2001 5:00 PM
To: File Systems Developers
Subject: [ntfsd] Dynamic Load/Unload device driver.

Hi all,

my project is based on SFILTER sample.
basically, reboot after installation, SFILTER sample works well,

when I use SCM APIs(using install application-it based on INSTDRV
sample),
SFILTER installed and loaded succesfully. but it dosen’t works.

How can I load/unload SFILTER sample dynamically? (without reboot.)

sorry for novice question. and poor English.

Thanks
terra


You are currently subscribed to ntfsd as: xxxxx@Exchange.Microsoft.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: danp@jb.rdsor.ro
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

The following changes have been made to WindowsXP to support this:
* The existing API IoRegisterFsRegistrationChange has been
modified so that it issues callbacks for existing volumes when this is
called. Before WindowsXP there was no safe way to find file systems
that were loaded before your driver was loaded.
* The new API IoEnumerateDeviceObjectList will return all existing
device objects given a driver object. Before WindowsXP there was no
safe way to do this.
* The new API IoGetDiskDeviceObject will return the associated
storage stack device object given a file system device object. Before
WindowsXP there was no way to obtain this information unless you saw the
actual mount operation.

I am sorry but I can not give you the function prototypes. They are
available, along with documentation and updated version of sfilter and
filespy that use them, in the WindowsXP version of the IFSKit.

Neal Christiansen

-----Original Message-----
From: danp [mailto:danp@jb.rdsor.ro]
Sent: Wednesday, June 13, 2001 02:55 AM
To: File Systems Developers
Subject: [ntfsd] RE: Dynamic Load/Unload device driver.

Neal , What is this new API if I may know ? A prototype would be also
appreciated.
Thank you , Dan

----- Original Message -----
From: “Neal Christiansen”
To: “File Systems Developers”
Sent: Wednesday, June 13, 2001 11:07 AM
Subject: [ntfsd] RE: Dynamic Load/Unload device driver.

Terra,

As Kristian pointed out, the sfilter sample was originally designed to
only be loaded at boot time. The reason for this is that there is no
documented way to enumerate volumes and file systems that were mounted /
loaded before sfilter was loaded.

The updated sfilter sample in the WindowXP IFSKit is designed so that it
can be loaded at any time. The problem is, to do this it uses new APIs
that only exist in WindowsXP.

This probably does not help you now (since you are probably doing this
on Windows 2000 or NT 4) but the problem has been solved for the future.

One other note, file system filters can not be safely unloaded.

Neal Christiansen

-----Original Message-----
From: xxxxx@softonnet.com [mailto:xxxxx@softonnet.com]
Sent: Tuesday, May 15, 2001 5:00 PM
To: File Systems Developers
Subject: [ntfsd] Dynamic Load/Unload device driver.

Hi all,

my project is based on SFILTER sample.
basically, reboot after installation, SFILTER sample works well,

when I use SCM APIs(using install application-it based on INSTDRV
sample),
SFILTER installed and loaded succesfully. but it dosen’t works.

How can I load/unload SFILTER sample dynamically? (without reboot.)

sorry for novice question. and poor English.

Thanks
terra


You are currently subscribed to ntfsd as: xxxxx@Exchange.Microsoft.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: danp@jb.rdsor.ro
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: xxxxx@Windows.Microsoft.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

RE: [ntfsd] RE: Dynamic Load/Unload device driver.>> The new API IoEnumerateDeviceObjectList will return all existing device objects >> given a driver object. Before WindowsXP there was no safe way to do this.

As far as I know , the Io manager keeps the create device objects into a linked list. Get the device object from the driver object , then walk the linked list , and store the result. I would doit at a raised irql , Id say, DPC level is enough. Then reference each one , if you are paranoid. So , what makes this technique unsafe ? I really doubt that XP implementation makes anything else then walking this list.

> The new API IoGetDiskDeviceObject will return the associated storage stack device >> object given a file system device object. Before WindowsXP there was no way to >>obtain this information unless you saw the actual mount operation.

Vpb->RealDevice ? And a pointer to a VPB can be obtained in with several tricks. Aquire the Vpb spinlock while playing with it. check VPB_MOUNTED . Then retrieve & reference the retrieved device object to be safe. Dont you agree?

> I am sorry but I can not give you the function prototypes

I do undertsand the situation.

Regards , Dan

----- Original Message -----
From: Neal Christiansen
To: File Systems Developers
Sent: Thursday, June 14, 2001 8:28 PM
Subject: [ntfsd] RE: Dynamic Load/Unload device driver.

The following changes have been made to WindowsXP to support this:

? The existing API IoRegisterFsRegistrationChange has been modified so that it issues callbacks for existing volumes when this is called. Before WindowsXP there was no safe way to find file systems that were loaded before your driver was loaded.

? The new API IoEnumerateDeviceObjectList will return all existing device objects given a driver object. Before WindowsXP there was no safe way to do this.

? The new API IoGetDiskDeviceObject will return the associated storage stack device object given a file system device object. Before WindowsXP there was no way to obtain this information unless you saw the actual mount operation.

I am sorry but I can not give you the function prototypes. They are available, along with documentation and updated version of sfilter and filespy that use them, in the WindowsXP version of the IFSKit.

Neal Christiansen

-----Original Message-----

From: danp [mailto:danp@jb.rdsor.ro]

Sent: Wednesday, June 13, 2001 02:55 AM

To: File Systems Developers

Subject: [ntfsd] RE: Dynamic Load/Unload device driver.

Neal , What is this new API if I may know ? A prototype would be also

appreciated.

Thank you , Dan

----- Original Message -----

From: “Neal Christiansen”

To: “File Systems Developers”

Sent: Wednesday, June 13, 2001 11:07 AM

Subject: [ntfsd] RE: Dynamic Load/Unload device driver.

Terra,

As Kristian pointed out, the sfilter sample was originally designed to

only be loaded at boot time. The reason for this is that there is no

documented way to enumerate volumes and file systems that were mounted /

loaded before sfilter was loaded.

The updated sfilter sample in the WindowXP IFSKit is designed so that it

can be loaded at any time. The problem is, to do this it uses new APIs

that only exist in WindowsXP.

This probably does not help you now (since you are probably doing this

on Windows 2000 or NT 4) but the problem has been solved for the future.

One other note, file system filters can not be safely unloaded.

Neal Christiansen

-----Original Message-----

From: xxxxx@softonnet.com [mailto:xxxxx@softonnet.com]

Sent: Tuesday, May 15, 2001 5:00 PM

To: File Systems Developers

Subject: [ntfsd] Dynamic Load/Unload device driver.

Hi all,

my project is based on SFILTER sample.

basically, reboot after installation, SFILTER sample works well,

when I use SCM APIs(using install application-it based on INSTDRV

sample),

SFILTER installed and loaded succesfully. but it dosen’t works.

How can I load/unload SFILTER sample dynamically? (without reboot.)

sorry for novice question. and poor English.

Thanks

terra



You are currently subscribed to ntfsd as: xxxxx@Exchange.Microsoft.com

To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com



You are currently subscribed to ntfsd as: danp@jb.rdsor.ro

To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com



You are currently subscribed to ntfsd as: xxxxx@Windows.Microsoft.com

To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: danp@jb.rdsor.ro
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

RE: [ntfsd] RE: Dynamic Load/Unload device driver. And just for clarification. I do agree that what I said before about walking the device object list code is somehow a broken design for SMP , since I cannot acquire the synch object which protects it. However , othear means can be employed to make it safe , me thinks , like a combination of native API and Ob manager API.

----- Original Message -----
From: Neal Christiansen
To: File Systems Developers
Sent: Thursday, June 14, 2001 8:28 PM
Subject: [ntfsd] RE: Dynamic Load/Unload device driver.

The following changes have been made to WindowsXP to support this:

? The existing API IoRegisterFsRegistrationChange has been modified so that it issues callbacks for existing volumes when this is called. Before WindowsXP there was no safe way to find file systems that were loaded before your driver was loaded.

? The new API IoEnumerateDeviceObjectList will return all existing device objects given a driver object. Before WindowsXP there was no safe way to do this.

? The new API IoGetDiskDeviceObject will return the associated storage stack device object given a file system device object. Before WindowsXP there was no way to obtain this information unless you saw the actual mount operation.

I am sorry but I can not give you the function prototypes. They are available, along with documentation and updated version of sfilter and filespy that use them, in the WindowsXP version of the IFSKit.

Neal Christiansen

-----Original Message-----

From: danp [mailto:danp@jb.rdsor.ro]

Sent: Wednesday, June 13, 2001 02:55 AM

To: File Systems Developers

Subject: [ntfsd] RE: Dynamic Load/Unload device driver.

Neal , What is this new API if I may know ? A prototype would be also

appreciated.

Thank you , Dan

----- Original Message -----

From: “Neal Christiansen”

To: “File Systems Developers”

Sent: Wednesday, June 13, 2001 11:07 AM

Subject: [ntfsd] RE: Dynamic Load/Unload device driver.

Terra,

As Kristian pointed out, the sfilter sample was originally designed to

only be loaded at boot time. The reason for this is that there is no

documented way to enumerate volumes and file systems that were mounted /

loaded before sfilter was loaded.

The updated sfilter sample in the WindowXP IFSKit is designed so that it

can be loaded at any time. The problem is, to do this it uses new APIs

that only exist in WindowsXP.

This probably does not help you now (since you are probably doing this

on Windows 2000 or NT 4) but the problem has been solved for the future.

One other note, file system filters can not be safely unloaded.

Neal Christiansen

-----Original Message-----

From: xxxxx@softonnet.com [mailto:xxxxx@softonnet.com]

Sent: Tuesday, May 15, 2001 5:00 PM

To: File Systems Developers

Subject: [ntfsd] Dynamic Load/Unload device driver.

Hi all,

my project is based on SFILTER sample.

basically, reboot after installation, SFILTER sample works well,

when I use SCM APIs(using install application-it based on INSTDRV

sample),

SFILTER installed and loaded succesfully. but it dosen’t works.

How can I load/unload SFILTER sample dynamically? (without reboot.)

sorry for novice question. and poor English.

Thanks

terra



You are currently subscribed to ntfsd as: xxxxx@Exchange.Microsoft.com

To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com



You are currently subscribed to ntfsd as: danp@jb.rdsor.ro

To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com



You are currently subscribed to ntfsd as: xxxxx@Windows.Microsoft.com

To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: danp@jb.rdsor.ro
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com