FltMgr initialized notification

NTFSD
1

Hello,

I have one filter driver which implements disk device filter and FS minifilter. When PC boots my DriverEntry is called and I can not call FltRegisterFilter since FltMgr is not initialized yet in this very soon phase of booting. I get error code STATUS_FLT_NOT_INITIALIZED. Is there any notification from FltMgr when it is initialized and ready to register FS filters? For now I create worker thread from DriverEntry which periodically tries to register with FltMgr as a workaround.

Thanks.

2

As far as i know there isn’t any notification from FltMgr that it’s loaded. Other that trying to register from a different thread you could try a reinitialize routine (IoRegisterDriverReinitialization()). I’ve never tried it but as far as i can tell it should work.

Thanks,
Alex.

3

>from a different thread you could try a reinitialize routine (IoRegisterDriverReinitialization()).

Isn’t this very routine used by FltMgr to create next frames after the legacy filter is loaded?

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

4

No, I’ve just looked at this recently and frame0 gets created right from
DriverEntry.

Thanks,
Alex.

5

Yes, that IoRegisterDriverReinitialization works fine, thanks.