FS Minifilter and Device filter in one driver

NTDEV
1

Hello,

I would like to implement FS minifilter and device filter in one driver. Then what will I get to IRP hooks in DriverObject->MajorFunction, only IRPs for device filter DO and control DO? Everything regarding FS will go through Minifilter callbacks? And what about DriverObject->DriverUnload hook versus PFLT_FILTER_UNLOAD_CALLBACK for minifilter, which one will be called when?

Thanks.

2

Why do you think that making a single driver with a rather strange model
where things can get easily confused is superior to a two driver model
with one of the many well known communication mechanisms (device
interface, IOCTL’s, IOCTL’s to set up shared memory region, kernel mode
DLL). Anyone who approaches this thing to support it after you will
have to learn all your weird tricks if you combine it.

Don Burn
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“xxxxx@centrum.cz” wrote in message
news:xxxxx@ntdev:

> Hello,
>
> I would like to implement FS minifilter and device filter in one driver. Then what will I get to IRP hooks in DriverObject->MajorFunction, only IRPs for device filter DO and control DO? Everything regarding FS will go through Minifilter callbacks? And what about DriverObject->DriverUnload hook versus PFLT_FILTER_UNLOAD_CALLBACK for minifilter, which one will be called when?
>
> Thanks.

3

I have user mode application which communicates with the driver. It sends custom IOCTLs to driver. If driver wants something it calls app through LPC channel. If I have 2 drivers I need to do much more additional stuff to handle both of them. I prefer to have both filters in one driver if possible. I know it works for FS legacy filter and device filter but don’t know for FS minifilter and device filter. Mainly I am confused with unload routines.

4

See one week old “2 DRIVER_OBJECTs implemented by one binary” thread in
NTFSD. There are some notes about common Unload routine.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@centrum.cz
Sent: Saturday, October 29, 2011 8:35 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] FS Minifilter and Device filter in one driver

I have user mode application which communicates with the driver. It sends
custom IOCTLs to driver. If driver wants something it calls app through LPC
channel. If I have 2 drivers I need to do much more additional stuff to
handle both of them. I prefer to have both filters in one driver if
possible. I know it works for FS legacy filter and device filter but don’t
know for FS minifilter and device filter. Mainly I am confused with unload
routines.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer