Filter Driver interaction for knowndll's

NTFSD
1

Hi

I have a bootstart filter driver which receives opens/creates for all
files, except the one’s in the KnownDll’s registry. Are KnownDll’s
handled differently? From what I understand KnownDll’s are loaded by
smms.exe and have named sections so that the further loads can just
use the named mappings? Why don’t I see the first open for any
knowndll in the filter driver? Does smss.exe perform any magic?

Thanks

2

AFAIK my filter receives those requests.
There is no magic Smss.exe can do.
Maybe you are loading your filter
too late (?)

L.