FltAttachVolume issue

NTFSD
1

HI All,

I am facing a issue in using FltAttachVolume.
I have to Stop write operation in USB Driver.

On InstanceSetup i m able to identify USB volume using FltDeviceIoControlFile &IOCTL_STORAGE_QUERY_PROPERTY.
Afterwards
I tried to attach the minifilter driver to USB Driver using below code base:

if (pStorageDescriptor->BusType == BusTypeUsb)
{
	// there is a check for volume name 
	PFLT_INSTANCE volume = NULL;
    status = FltAttachVolume(MiniFilterData.Filter, FltObjects->Volume, NULL, &volume);
	if (!NT_SUCCESS(status)){
		DEBUGTRACE("FltAttachVolume failed with status = 0x%x\n", status);
	}
	//release code
}

But i am getting FltAttachVolume failed with status = 0xc01c0012 ( STATUS_FLT_INSTANCE_NAME_COLLISION)

i am not able to figure out, what is the problem.
I tried check using cmd :
FLTMC filters
but i see num instance count for my minifilter driver is 0.

Any input will be appreciable.

2

Try changing the name in the registry. Filter instance names are device wide, not device & filter wide.

1 Like
3

Are you trying to call FltAttachVolume from inside InstanceSetup? That wouldn't make sense...

1 Like
4

Just return either STATUS_SUCCESS to attach, or STATUS_FLT_DO_NOT_ATTACH to not attach. You do not need to call FltAttachVolume in your instanceSetup callback.

1 Like
5

Thanks for response Scott,

yes i m trying to call FltAttachVolume inside InstanceSetup.
Basically, I m trying to block write operation in USB Drive/volume.

I was trying to check for USB volume in InstanceSetup and then FltAttachVolume driver to USB volume.

Can u share a better approach.
I m a new folks.

regards

6

perform your check for usb and if successful return STATUS_SUCCESS otherwise return STATUS_FLT_DO_NOT_ATTACH . The filter manager will attach your instance based on the return value.

1 Like
7

Thanks Rod, Scott and Mark, for your valuable suggestion. It works.
regards