Installing a minifilter via INF

Johnny · September 24, 2010, 12:43pm

G’day!

So many posts regarding this, yet I have a somewhat unique problem.

I have a signed x86 build of a minifilter, with .inf and .cat files.
So when I right click on the .inf and install the driver, everything works as expected.

Now the issue.
I wrote a custom script in installshield running the well known InstallHinfSection
rundll32.exe setupapi,InstallHinfSection DefaultInstall 128 $TARGETDIR$\i386\driver.inf

The script runs with no errors in Installshield.
Also looking at the setup.api.log files the logs (sequences) look the same and report no errors.

Yet when I try to start the minifilter, I get error 1058.
" The service cannot be started, either because it is disabled or because it has no enabled devices associated with it."

When the driver is in this state, right clicking the .inf file and Installing it does nothing to resolve the issue. I manually have to Unregister the driver (using Osrloader) then do the right-click install. Once that is done the driver can start.

Any ideas ?

Johnny · September 24, 2010, 12:48pm

BTW - The Os’s tested
XP, Vista, Server 2008, Windows 7

Alex_Carp · September 24, 2010, 12:59pm

What does the registry key look like when you install by right-click vs.
when you run your script ?

Thanks,
Alex.

Johnny · September 24, 2010, 2:50pm

Registry entries when working

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\minifilter]
“Description”=“minifilter mini-filter driver”
“DependOnService”=“FltMgr”
“Group”=“FSFilter Content Screener”
“ImagePath”=“system32\DRIVERS\minifilter.sys”
“DisplayName”=“minifilter”
“Tag”=dword:0000000b
“ErrorControl”=dword:00000001
“Start”=dword:00000003
“Type”=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\minifilter\Enum]
“NextInstance”=dword:00000001
“Count”=dword:00000001
“0”=“Root\LEGACY_minifilter\0000”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\minifilter\Instances]
“DefaultInstance”=“minifilter Instance”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\minifilter\Instances\minifilter Instance]
“Flags”=dword:00000000
“Altitude”=“262100”

When it is disabled

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\minifilter]
“Description”=“minifilter mini-filter driver”
“DependOnService”=“FltMgr”
“Group”=“FSFilter Content Screener”
“ImagePath”=“system32\DRIVERS\psepfilter.sys”
“DisplayName”=“minifilter”
“Tag”=dword:00000004
“ErrorControl”=dword:00000001
“Start”=dword:00000003
“Type”=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\minifilter\Enum]
“NextInstance”=dword:00000001
“Count”=dword:00000001
“0”=“Root\LEGACY_minifilter\0000”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\minifilter\Instances]
“DefaultInstance”=“minifilter Instance”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\minifilter\Instances\minifilter Instance]
“Flags”=dword:00000000
“Altitude”=“262100”

mm1 · September 24, 2010, 2:53pm

I haven’t been following this read closely, but just to be sure, you’re
aware that you’re using two different images:

“ImagePath”=“system32\DRIVERS\minifilter.sys”

v.

“ImagePath”=“system32\DRIVERS\psepfilter.sys”

m

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@msn.com
Sent: Friday, September 24, 2010 2:53 PM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Installing a minifilter via INF

Registry entries when working

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\minifilter]
“Description”=“minifilter mini-filter driver”
“DependOnService”=“FltMgr”
“Group”=“FSFilter Content Screener”
“ImagePath”=“system32\DRIVERS\minifilter.sys”
“DisplayName”=“minifilter”
“Tag”=dword:0000000b
“ErrorControl”=dword:00000001
“Start”=dword:00000003
“Type”=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\minifilter\Enum]
“NextInstance”=dword:00000001
“Count”=dword:00000001
“0”=“Root\LEGACY_minifilter\0000”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\minifilter\Instances]
“DefaultInstance”=“minifilter Instance”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\minifilter\Instances\m
inifilter Instance]
“Flags”=dword:00000000
“Altitude”=“262100”

When it is disabled

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\minifilter]
“Description”=“minifilter mini-filter driver”
“DependOnService”=“FltMgr”
“Group”=“FSFilter Content Screener”
“ImagePath”=“system32\DRIVERS\psepfilter.sys”
“DisplayName”=“minifilter”
“Tag”=dword:00000004
“ErrorControl”=dword:00000001
“Start”=dword:00000003
“Type”=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\minifilter\Enum]
“NextInstance”=dword:00000001
“Count”=dword:00000001
“0”=“Root\LEGACY_minifilter\0000”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\minifilter\Instances]
“DefaultInstance”=“minifilter Instance”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\minifilter\Instances\m
inifilter Instance]
“Flags”=dword:00000000
“Altitude”=“262100”

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Johnny · September 24, 2010, 4:04pm

Yes, that was a type on my part.
They are supposed to be the same name.

I did find something in the registry that is missing when the driver is disabled.
It is the HKLM\System\ControlSet\Enum\Root\LEGACY_MINIFILTER key

I’m assuming this to be a big part of the problem?
Any ideas on why running it via the script would leave out these entries ?

mm1 · September 24, 2010, 4:20pm

That’s populated by the PNP Manager.

This is not really my thing, but it sounds like you’ve done a lot of hacking
around/manual intervention. Are you sure that what you’ve posted so far is
correct?

mm

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@msn.com
Sent: Friday, September 24, 2010 4:06 PM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Installing a minifilter via INF

Yes, that was a type on my part.
They are supposed to be the same name.

I did find something in the registry that is missing when the driver is
disabled.
It is the HKLM\System\ControlSet\Enum\Root\LEGACY_MINIFILTER key

I’m assuming this to be a big part of the problem?
Any ideas on why running it via the script would leave out these entries ?

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Johnny · September 24, 2010, 4:51pm

Thanks all for your responses.

Yes, what i posted so far is correct.
And yes, i have done a lot of hacking around on my dev machine, BUT these test machines are void of my ‘hacking’ and are consistently producing the results described.
XP, Vista, 7, 2008 - all are behaving this way.

Alex_Carp · September 24, 2010, 5:06pm

Hmm… they look fine… one thing to try is to capture the key when using the
right-click method, then install using the script and then restore the key
and see If it changes anything.

Do you have more than one minifilter or is it just this one ?

Thanks,
Alex.