Hi,
I’m debugging my IFS filter driver now, it was basically based on the
FileSpy and SFilter samples in IFS kit, firstly I manually load the driver
and it works as expected. But after change to boot driver, it will crash.
Following is my finding and can anyone shed some light on it?
By the way, my harddrive has 3 partitions, 1st one is FAT, 2nd and 3rd
volumes are all FAT32, the WinXP was booted from the 2nd volume(FAT32),
should this be a problem?
…
in DriverEntry(), use IoRegisterFsRegistrationChange() register the callback
function FSNotification(). Once a file system was loaded, the
FSNotification() will call IoEnumerateDeviceObjectList() to attach to all
mounted devices. While booting, these recognizers were attached:
…
TRC] AttachToFileSystemDevice() attach(\Fat)
TRC] AttachToFileSystemDevice() attach(\FatCdrom) AttachToMountedDevice()
attach \Device\HarddiskVolume2)
TRC] AttachToFileSystemDevice() attach(\FileSystem\CdfsRecognizer)
TRC] AttachToFileSystemDevice() attach(\FileSystem\UdfsCdRomRecognizer)
TRC] AttachToFileSystemDevice() attach(\FileSystem\UdfsDiskRecognizer)
TRC] AttachToFileSystemDevice() attach(\FileSystem\FatDiskRecognizer)
TRC] AttachToFileSystemDevice() attach(\FileSystem\NtfsRecognizer)
…
Then there’s an error STATUS_UNRECOGNIZED_VOLUME reported on mounting the
volume3(FAT32)and it’s asking for the FS driver.
…
TRC] FsControlMountVolumeComplete() no recognizer
in(\Device\HarddiskVolume3)
TRC] FsControlMountVolumeComplete() Mount volume failure
for(\Device\HarddiskVolume3), STATUS_FS_DRIVER_REQUIRED
…
Got IRP_MN_LOAD_FILE_SYSTEM and load the filesystem, but the status is
STATUS_IMAGE_ALREADY_LOADED,
so the deviceObject “FatDiskRecognizer” will be deleted here. (Refer to
SFilter and FilsSpy)
…
TRC] FsControlLoadFileSystem() Loading File System, Detaching from
(\FileSystem\FatDiskRecognizer)
…
At this moment, the callback function FSNotification() was called to detach
this deviceObject, then do the IoDeleteDevice() again. ******************
Crash here! because the “FatDiskRecognizer” was already deleted.
…
TRC] DetachFromFileSystemDevice() detaching from file system
(\FileSystem\FatDiskRecognizer)(DISK_FILE_SYSTEM)
TRC] FsControlLoadFileSystemComplete() Detaching from recognizer
(\FileSystem\FatDiskRecognizer), status=c000010e
******************************* CRASH
If I don’t delete the device twice, then it will pass. But the error
STATUS_UNRECOGNIZED_VOLUME will be the next:
TRC] FsControlMountVolumeComplete() no recognizer
in(\Device\HarddiskVolume3)
TRC] FsControlMountVolumeComplete() no recognizer
in(\Device\HarddiskVolume3)
TRC] AttachToMountedDevice() attach(\Device\HarddiskVolume3)
TRC] FsControlMountVolumeComplete() no recognizer
in(\Device\HarddiskVolume1)
TRC] FsControlMountVolumeComplete() no recognizer
in(\Device\HarddiskVolume1)
TRC] AttachToMountedDevice() attach(\Device\HarddiskVolume1)
TRC] FsControlMountVolumeComplete() no recognizer in(\Device\CdRom0)
…
Finally, it won’t work because the volumes were not attached at all. I was
confused here, the SFilter and FileSpy should not have this kind of the
“double delete” problems, and in what condition the driver can not mount the
volume and cause my filter doesn’t have a chance to attach? was I wrong
somewhere?
thanks in advance,
AFei