Filter driver unexpectedly replaces function driver

dan98 · February 2, 2026, 11:33am

I have a virtual ACPI device in BIOS with hardware id ACPI\VEN_TEST&DEV_1234

I create a function driver for it called SecondTouch from KMDF driver template in Visual Studio, its INF:

[Version]
Signature   = "$WINDOWS NT$"
Class       = System ; TODO: specify appropriate Class
ClassGuid   = {4d36e97d-e325-11ce-bfc1-08002be10318} ; TODO: specify appropriate ClassGuid
Provider    = %ManufacturerName%
CatalogFile = SecondTouch.cat
DriverVer   = ; TODO: set DriverVer in stampinf property pages
PnpLockdown = 1

[DestinationDirs]
DefaultDestDir = 13

[SourceDisksNames]
1 = %DiskName%,,,""

[SourceDisksFiles]
SecondTouch.sys  = 1,,

;*****************************************
; Install Section
;*****************************************

[Manufacturer]
%ManufacturerName% = Standard,NT$ARCH$.10.0...16299 ; %13% support introduced in build 16299

[Standard.NT$ARCH$.10.0...16299]
%SecondTouch.DeviceDesc% = SecondTouch_Device, ACPI\VEN_TEST&DEV_1234  ; TODO: edit hw-id

[SecondTouch_Device.NT]
CopyFiles = File_Copy

[File_Copy]
SecondTouch.sys

;-------------- Service installation
[SecondTouch_Device.NT.Services]
AddService = SecondTouch,%SPSVCINST_ASSOCSERVICE%, SecondTouch_Service_Inst

; -------------- SecondTouch driver install sections
[SecondTouch_Service_Inst]
DisplayName    = %SecondTouch.SVCDESC%
ServiceType    = 1               ; SERVICE_KERNEL_DRIVER
StartType      = 3               ; SERVICE_DEMAND_START
ErrorControl   = 1               ; SERVICE_ERROR_NORMAL
ServiceBinary  = %13%\SecondTouch.sys

[SecondTouch_Device.NT.Wdf]
KmdfService = SecondTouch, SecondTouch_wdfsect

[SecondTouch_wdfsect]
KmdfLibraryVersion = $KMDFVERSION$

[Strings]
SPSVCINST_ASSOCSERVICE = 0x00000002
ManufacturerName = "Co., Ltd." ;TODO: Replace with your manufacturer name
DiskName = "SecondTouch Installation Disk"
SecondTouch.DeviceDesc = "SecondTouch Device"
SecondTouch.SVCDESC = "SecondTouch Service"

A filter driver called ThirdTouch to modify the IOCTLs sent to the device.

I call the WdfFdoInitSetFilter(DeviceInit) in DeviceAdd routine to configure the driver as a filter driver.

Then modify the INF:

Add UpperFilters registry
Remove the SPSVCINST_ASSOCSERVICE=0x00000002 and add AddService = ,2 as guided by Microsoft * here

[Version]
Signature   = "$WINDOWS NT$"
Class       = System ; TODO: specify appropriate Class
ClassGuid   = {4d36e97d-e325-11ce-bfc1-08002be10318} ; TODO: specify appropriate ClassGuid
Provider    = %ManufacturerName%
CatalogFile = ThirdTouch.cat
DriverVer   = ; TODO: set DriverVer in stampinf property pages
PnpLockdown = 1

[DestinationDirs]
DefaultDestDir = 13

[SourceDisksNames]
1 = %DiskName%,,,""

[SourceDisksFiles]
ThirdTouch.sys  = 1,,

;*****************************************
; Install Section
;*****************************************

[Manufacturer]
%ManufacturerName% = Standard,NT$ARCH$.10.0...16299 ; %13% support introduced in build 16299

[Standard.NT$ARCH$.10.0...16299]
%ThirdTouch.DeviceDesc% = ThirdTouch_Device, ACPI\VEN_TEST&DEV_1234 ; TODO: edit hw-id

[ThirdTouch_Device.NT]
CopyFiles = File_Copy

[File_Copy]
ThirdTouch.sys

[ThirdTouch_Device.NT.HW]
AddReg = ThirdTouch_Device.HW.AddReg

[ThirdTouch_Device.HW.AddReg]
HKR,,"UpperFilters",0x00010008,"ThirdTouch"

;-------------- Service installation
[ThirdTouch_Device.NT.Services]
AddService = ThirdTouch,, ThirdTouch_Service_Inst
AddService = ,2

; -------------- ThirdTouch driver install sections
[ThirdTouch_Service_Inst]
DisplayName    = %ThirdTouch.SVCDESC%
ServiceType    = 1               ; SERVICE_KERNEL_DRIVER
StartType      = 3               ; SERVICE_DEMAND_START
ErrorControl   = 1               ; SERVICE_ERROR_NORMAL
ServiceBinary  = %13%\ThirdTouch.sys

[ThirdTouch_Device.NT.Wdf]
KmdfService = ThirdTouch, ThirdTouch_wdfsect

[ThirdTouch_wdfsect]
KmdfLibraryVersion = $KMDFVERSION$

[Strings]
ManufacturerName = "Co., Ltd." ;TODO: Replace with your manufacturer name
DiskName = "ThirdTouch Installation Disk"
ThirdTouch.DeviceDesc = "ThirdTouch Device"
ThirdTouch.SVCDESC = "ThirdTouch Service"

My installation order is SecondTouch (function driver) → ThirdTouch (filter driver).

I notice that the filter driver replaced completely the function driver.

It seems my configuration for filter driver is wrong and Windows still sees it as a function driver then replace my old function driver in the end.

How can I fix this issue?

Calin_Iaru · February 2, 2026, 2:52pm

The filter driver has to include the SecondTouch service section. For reference, see the itecir.inf decoration in DriverStore\FileRepository.

[itecir_SIO2_Device.NT.Services]
AddService = itecir,%SPSVCINST_ASSOCSERVICE%, itecir_SIO2_Service_Inst
AddService = ITECIRfilter,, ITECIRfilter_Service_Inst

dan98 · February 2, 2026, 3:22pm

@Calin_Iaru Thank you for the response, I cannot find itecir.inf in my computer’s FileRepository.
Can you modify directly to my code?

Calin_Iaru · February 2, 2026, 3:56pm

[ThirdTouch_Device.NT.Services]
AddService = SecondTouch,%SPSVCINST_ASSOCSERVICE%, SecondTouch_Service_Inst
AddService = ThirdTouch,, ThirdTouch_Service_Inst

[SecondTouch_Service_Inst]
DisplayName    = %SecondTouch.SVCDESC%
ServiceType    = 1               ; SERVICE_KERNEL_DRIVER
StartType      = 3               ; SERVICE_DEMAND_START
ErrorControl   = 1               ; SERVICE_ERROR_NORMAL
ServiceBinary  = %13%\SecondTouch.sys

[ThirdTouch_Service_Inst]
DisplayName    = %ThirdTouch.SVCDESC%
ServiceType    = 1               ; SERVICE_KERNEL_DRIVER
StartType      = 3               ; SERVICE_DEMAND_START
ErrorControl   = 1               ; SERVICE_ERROR_NORMAL
ServiceBinary  = %13%\ThirdTouch.sys

Use infverif.exe as a 2nd pass.

dan98 · February 3, 2026, 6:14am

Hi @Calin_Iaru , ThirdTouch driver package is not carrying the SecondTouch.sys so it cannot add SecondTouch service. They are 2 separate packages

Calin_Iaru · February 3, 2026, 1:46pm

A simpler approach is to include SecondTouch section from ThirdTouch. Inside ThirdTouch.inf

[ThirdTouch_Device.NT]
Include = SecondTouch.inf ; NEW
Needs = SecondTouch_Device.NT ; NEW
CopyFiles = File_Copy

[ThirdTouch_Device.NT.Services]
Include = SecondTouch.inf
Needs = SecondTouch_Device.NT.Services
AddService = ThirdTouch,, ThirdTouch_Service_Inst

Zac_Lockard · February 3, 2026, 7:07pm

You can’t reference a non-inbox driver via Include/Needs directives.

@dan98 Make the thirdtouch driver an extension driver. The secondtouch driver gets the device working using secondtouch, then the extension adds thirdtouch as a filter.

Calin_Iaru · February 3, 2026, 8:28pm

Good to know Zac Lockard, thank you.

Tim_Roberts · February 3, 2026, 8:48pm

Do you have an installer application? You don’t actually NEED and INF to install a device filter. Just copy the driver binary into place and modify the UpperFilters or LowerFilters key in the registry.

dan98 · February 4, 2026, 4:55am

@Zac_Lockard @Tim_Roberts Thank you for the suggestion Zac and Tim.
I will combine your suggestions as following:

Make the ThirdTouch an extension driver
Add UpperFilters key to registry inside

At step 2, my understanding is to add the pair of key UpperFilters and value ThirdTouch (same as my service name) to the registry of my ACPI device ACPI\VEN_TEST&DEV_1234

How can I find the registry of my device?

Zac_Lockard · February 4, 2026, 6:35pm

You’re already doing it with [ThirdTouch_Device.HW.AddReg]

dan98 · February 5, 2026, 4:26am

I tried to use AddReg directive but VS threw the warning that it’s not recommended to use AddReg in extension driver

[ThirdTouch_Device.NT.HW]
AddReg = ThirdTouch_Device.HW.AddReg

[ThirdTouch_Device.HW.AddReg]
HKR,,"UpperFilters",0x00010000,"ThirdTouch"

So I changed to AddFilter directive, which is supported from OS build 18362

[ThirdTouch_Device.NT.Filters]
AddFilter = ThirdTouch,, UpperFilter_Inst

[UpperFilter_Inst]
FilterPosition = Upper

ThirdTouch now can be installed as an extension driver of SecondTouch device and also receives any IOCTLs sent to the device.

@Zac_Lockard @Calin_Iaru @Tim_Roberts Thank you for all the support and guidance.