fltmgr.sys PDB and - fltkd extension not working ...

NTFSD
1

I am developing a minifilter ob XP SP2 (all updates have been installed till today)…
Trying to use fltkd extension wit WinDBG to look at minifilter objects fails as follows …

kd> !fltkd.filters

*** Extension DLL(5457 Free) does not match target system(2600 Free)

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: fltmgr!_GLOBALS ***
*** ***
*************************************************************************

Could not read offset of field “FrameList.rList” from type fltmgr!_GLOBALS

I have reloaded fltmgr.sys (noisy) … with no problem …

kd> !sym noisy
noisy mode - symbol prompts on
kd> .reload fltmgr.sys

running !fltkd.filters yields to following …

kd> !fltkd.filters

*** Extension DLL(5457 Free) does not match target system(2600 Free)

DBGHELP: fltmgr - public symbols
H:\symbols\fltMgr.pdb\A0E464C759184DA99B0713E07A5EAFB71\fltMgr.pdb
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: fltmgr!_GLOBALS ***
*** ***
*************************************************************************

Could not read offset of field “FrameList.rList” from type fltmgr!_GLOBALS

Any idea what i need to do ?

Thank’s

Oron.

2

!fltkd appears to have been broken (or rather the symbols it needs have been
missing from the export fltmgr) for some time. On vista I have been seeing
the a mismatch on symbols when looking at fltmgr!_FLT_VERIFIER_OBJECT (when
looking for leaked references).

I just gave up trying to use it… Sorry

3

So is there any way to check the “reference count” of various FLT_ objects? I’m trying to unload a minifilter driver I have developed and it refuses to unload guess because of “in use objects” …
As I recall fltkd was able to display such information.

4

The easiest way to debug this issue is on Vista with the driver verifier
enabled on your minifilter. The Vista minifilters verifier code tracks
referenced objects and when you unload will tell which objects are
holding up the unload.

Neal Christiansen
Microsoft NTFS Development Lead
This posting is provided “AS IS” with no warranties, and confers no
Rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@netvision.net.il
Sent: Thursday, January 11, 2007 12:05 AM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] fltmgr.sys PDB and - fltkd extension not working …

So is there any way to check the “reference count” of various FLT_
objects? I’m trying to unload a minifilter driver I have developed and
it refuses to unload guess because of “in use objects” …
As I recall fltkd was able to display such information.

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com