Writing a minifilter, running XPsp2
Calling FltAttachVolume() inside kernel after a port callback request I
send from usermode via port from created from
FltCreateCommunicationPort().
Call to FltAttachVolume() using a named, non-default InstanceName.
Separate altitudes for each instance name as well as a default altitude
and name as defined in my .inf file.
Attempting multiple instances (2-3) per volume.
WITH Norton AV 10.1.4.4000 installed,
no problem attaching multiple named instances to a single volume by
specifing a PUNICODE_STRING containing a matching instance name from the
.inf file for the third parameter to FltAttachVolume().
WITHOUT Norton AV 10.1.4.4000 installed,
FltAttachVolume() fails with 0xc00000bb (STATUS_NOT_SUPPORTED) when
attempting to provide a Non-NULL instance name in PUNICODE_STRING, but
works properly when supplying NULL for PUNICODE_STRING InstanceName.(3rd
parameter).
I need multiple instances, and obviously, I can’t require NortonAV as a
prereq.,
How do I approach/solve/tackle this strange problem?
-Joe