Minifilter are using SERVICE_BOOT_START to use advantages of LoadOrderGroup AFAIK. And so I am using SERVICE_BOOT_START.
I know about InitSafeBootMode variable and that I can not load driver in safe mode in such way, but what if something other is wrong with my driver, like *.sys is corrupted or deleted, something is bad with signature, else. And now I have such problem on one env… very unplesent and system become not bootable… And no simple way to fix.
The OS has no need in most of minifilters to boot in the safe mode, so there should be some way to say to the OS: “not load minifilters in safe mode” or, at least, “not to load driver XXX in the safe mode”, but I see only requared for safe mode registry keys, and see no key to add ignored drivers in safe mode. Maybe you can help?
No way that I’m aware of. If someone (or something) is corrupting boot start driver images you’re pretty much out of luck.
-scott
OSR
@OSRDrivers
Try:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal
it lists some driver groups in it.
Ensure that your minifilter is NOT in one of these groups.
–
Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com
wrote in message news:xxxxx@ntfsd…
> Minifilter are using SERVICE_BOOT_START to use advantages of LoadOrderGroup AFAIK. And so I am using SERVICE_BOOT_START.
>
> I know about InitSafeBootMode variable and that I can not load driver in safe mode in such way, but what if something other is wrong with my driver, like *.sys is corrupted or deleted, something is bad with signature, else. And now I have such problem on one env… very unplesent and system become not bootable… And no simple way to fix.
>
> The OS has no need in most of minifilters to boot in the safe mode, so there should be some way to say to the OS: “not load minifilters in safe mode” or, at least, “not to load driver XXX in the safe mode”, but I see only requared for safe mode registry keys, and see no key to add ignored drivers in safe mode. Maybe you can help?
>
Maxim, I think that minifilter with SERVICE_BOOT_START and ServiceType=SERVICE_FILE_SYSTEM_DRIVER(that is common settings for minifilters AFAIK, so I think I can’t change it for the minifiltter that is working with file system IRPs) will be treated by OS as part of “Boot file system”… Sure, I can’t remove that group.
Looks like this thing can be made better in Windows.
Well you know you can make yourself the driver just do nothing if it is in
safe mode, just return STATUS_SUCCESS from DriverEntry.
There is an exported variable of type PULONG called InitSafeBootMode and
you could just not do anything if the value suggests you are in safe mode.
Read more here: https://support.microsoft.com/en-us/kb/837643
Regards,
Gabriel
Windows Kerndel Driver Consulting
www.kasardia.com
On Wed, Apr 20, 2016 at 10:36 AM, wrote:
> Maxim, I think that minifilter with SERVICE_BOOT_START and
> ServiceType=SERVICE_FILE_SYSTEM_DRIVER(that is common settings for
> minifilters AFAIK, so I think I can’t change it for the minifiltter that is
> working with file system IRPs) will be treated by OS as part of “Boot file
> system”… Sure, I can’t remove that group.
>
> Looks like this thing can be made better in Windows.
>
> —
> NTFSD is sponsored by OSR
>
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer>
>
–
Bercea. G.</http:>
>will be treated by OS as part of “Boot file system”
I’m not sure of it.
Try setting explicit Group value in your drivers’ registry.
–
Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com