Filter Manager based FsFilters

NTFSD
1

Hi all,

I am new to FS filters, please excuse my ignorance.

Is there a way to determine, seeing the code of a file system filter Driver,
whether it is filter manager based of legacy?

thanks

ap

2

Why do you want to determine this looking at the code?

But yes, look for Fltxxx calls and if you find them (more specifically
atleast FltRegisterFilter), it’s a minifilter.

Regards,

Ayush Gupta

AI Consulting

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of A P
Sent: Wednesday, January 13, 2010 1:28 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Filter Manager based FsFilters

Hi all,

I am new to FS filters, please excuse my ignorance.

Is there a way to determine, seeing the code of a file system filter Driver,
whether it is filter manager based of legacy?

thanks

ap

— NTFSD is sponsored by OSR For our schedule of debugging and file system
seminars (including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars To unsubscribe, visit the List Server section of
OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

thanks for the prompt answer. well, when i see the device property in Devie
tree from osr, I see that it attaches itself to Filtermanager device, but I
*do not* see the FltRegisterFilter call as you say, what is teh conclusion?

thanks in advance

ap

On Wed, Jan 13, 2010 at 1:42 PM, Ayush Gupta wrote:

> Why do you want to determine this looking at the code?
>
> But yes, look for Fltxxx calls and if you find them (more specifically
> atleast FltRegisterFilter), it?s a minifilter.
>
>
>
> Regards,
>
> Ayush Gupta
>
> AI Consulting
>
>
>
> From: xxxxx@lists.osr.com [mailto:
> xxxxx@lists.osr.com] *On Behalf Of *A P
> Sent: Wednesday, January 13, 2010 1:28 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] Filter Manager based FsFilters
>
>
>
> Hi all,
>
>
>
> I am new to FS filters, please excuse my ignorance.
>
>
>
> Is there a way to determine, seeing the code of a file system filter
> Driver, whether it is filter manager based of legacy?
>
>
>
> thanks
>
>
>
> ap
>
> — NTFSD is sponsored by OSR For our schedule of debugging and file system
> seminars (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars To unsubscribe, visit the List Server section
> of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

4

If it is *attaching* to filter manager, and it is in the device stack, then
obviously it is a legacy filter.

Regards,

Ayush Gupta

AI Consulting

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of A P
Sent: Wednesday, January 13, 2010 1:48 PM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] Filter Manager based FsFilters

thanks for the prompt answer. well, when i see the device property in Devie
tree from osr, I see that it attaches itself to Filtermanager device, but I
*do not* see the FltRegisterFilter call as you say, what is teh conclusion?

thanks in advance

ap

On Wed, Jan 13, 2010 at 1:42 PM, Ayush Gupta wrote:

Why do you want to determine this looking at the code?

But yes, look for Fltxxx calls and if you find them (more specifically
atleast FltRegisterFilter), it’s a minifilter.

Regards,

Ayush Gupta

AI Consulting

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of A P
Sent: Wednesday, January 13, 2010 1:28 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Filter Manager based FsFilters

Hi all,

I am new to FS filters, please excuse my ignorance.

Is there a way to determine, seeing the code of a file system filter Driver,
whether it is filter manager based of legacy?

thanks

ap

— NTFSD is sponsored by OSR For our schedule of debugging and file system
seminars (including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars To unsubscribe, visit the List Server section of
OSR Online at http://www.osronline.com/page.cfm?name=ListServer

—
NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

— NTFSD is sponsored by OSR For our schedule of debugging and file system
seminars (including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars To unsubscribe, visit the List Server section of
OSR Online at http://www.osronline.com/page.cfm?name=ListServer

5

If you’re trying to figure out which minifilters are loaded on a system try
“fltmc.exe filters” instead of DeviceTree. The problem is that multiple
minifilters may be in each FltMgr instance and DeviceTree does not show this
level of detail.

-scott

–
Scott Noone
Consulting Associate
OSR Open Systems Resources, Inc.
http://www.osronline.com

“A P” wrote in message news:xxxxx@ntfsd…
thanks for the prompt answer. well, when i see the device property in Devie
tree from osr, I see that it attaches itself to Filtermanager device, but I
do not see the FltRegisterFilter call as you say, what is teh conclusion?

thanks in advance

ap

On Wed, Jan 13, 2010 at 1:42 PM, Ayush Gupta wrote:

Why do you want to determine this looking at the code?
But yes, look for Fltxxx calls and if you find them (more specifically
atleast FltRegisterFilter), it’s a minifilter.

Regards,
Ayush Gupta
AI Consulting

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of A P
Sent: Wednesday, January 13, 2010 1:28 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Filter Manager based FsFilters

Hi all,

I am new to FS filters, please excuse my ignorance.

Is there a way to determine, seeing the code of a file system filter Driver,
whether it is filter manager based of legacy?

thanks

ap
— NTFSD is sponsored by OSR For our schedule of debugging and file system
seminars (including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars To unsubscribe, visit the List Server section of
OSR Online at http://www.osronline.com/page.cfm?name=ListServer

—
NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer