Installing and communicating Minifilter Driver

NTFSD
1

Hi!

I writing my first File System Minifilter Driver and I want to build it as same as other filter drivers that we are using.

  1. can I install the minifilter using Service Control Manager or that I have to use INF file?
    I know that MSDN recommended using INF but I want to keep the installation process I used in my other drivers for convenience.

  2. I want to communicate with user mode application using DeviceIoControl.
    Is it Possible to initial Device Object with IoCreateDevice? does it make any conflict with FltRegisterFilter? if it does, can I register callback routines in some other way?

Thanks!
SapGr.

2

The filter manager requires additional registry entries beyond what are installed by SCM. Having said that, you can create the base registry key with SCM and then programmatically add the other keys and values needed for filter manager (we did that in our driver loader program, for example).

This works. There is no conflict with filter manager, as it does not “take over” any dispatch entry points of your driver.

Tony
OSR

3

> 2) I want to communicate with user mode application using DeviceIoControl.

Is it Possible to initial Device Object with IoCreateDevice? does it make any conflict with
FltRegisterFilter? if it does, can I register callback routines in some other way?

Minifilter can coexist with any kmode driver in the same binary, so that the other functionality is just plain unaware on minifilter existence.

The only conflict point is the Unload routine, but this conflict is trivially solved.

–
Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

4

For an example of a minifilter that also has a DEVICE_OBJECT, there’s a
sample in the WDK, CDO (
https://github.com/Microsoft/Windows-driver-samples/tree/master/filesys/miniFilter/cdo
).

Thanks,
Alex

On Sun, Nov 15, 2015 at 9:45 PM, Maxim S. Shatskih
wrote:

> > 2) I want to communicate with user mode application using
> DeviceIoControl.
> > Is it Possible to initial Device Object with IoCreateDevice? does it
> make any conflict with
> >FltRegisterFilter? if it does, can I register callback routines in some
> other way?
>
> Minifilter can coexist with any kmode driver in the same binary, so that
> the other functionality is just plain unaware on minifilter existence.
>
> The only conflict point is the Unload routine, but this conflict is
> trivially solved.
>
> –
> Maxim S. Shatskih
> Microsoft MVP on File System And Storage
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

5

Hi!

Thanks for giving me some directions!

I tried to Install the Driver using SC.exe (which probably uses SCM and CreateService)
I created kernel service and before I started the service I created Registry values that the
Service Controller did not created as Tony suggested. I used Minispy sample to realize what keys and values the INF creates and SCM does not.

so one thing is that when I created Enum key under the service key a DWORD value was created automatically:
HKLM\SYSTEM\CurrentControlSet\services\MyDriver\Enum\INITSTARTFAILED

the value of INITSTARTFAILED is set to 0x00000001

after adding the values I started the service calling SC Start command.

FltRegisterFilter failed with status STATUS_OBJECT_NAME_NOT_FOUND which mean according to MSDN that “The filter service key is not found in the registry” or “The filter instance is not registered”

Do you know what is the meaning of INITSTARTFAILED? I could not find any MSDN documentation.

Is there any Sample of SCM Minifilter Installation?

Thanks!
SapGr.