IoAttachDevice Failed : Checkpoint VPN

NTDEV
1

Hi,

My machine: Windows XP SP2.
Tools used: TdiMon, TdiScope, devicetree (ddk), checkpoin smartclient VPN
application and my TDI filter driver

I installed CheckPoint SmartClient R56 on my machine. Then I tried to load
my TDI filter driver. It failed. It could not attach to TCP.

IoAttachDevice returned 0xC0000009 (no such device)…
My driver works if CheckPoint is uninstalled.

I investigated and found that one CheckPoint-smartclient driver is already
attached to TCP (and other devices in tcpip.sys) named as “scap”.

THe first impression was that checkpoint driver is not allowing any TDI
filter to attach to TCP. I dont understand why?

Then I started TdiMon and TdiScope. They both worked fine with Checkpoint
driver installed. But I can’t see any extra devices that TDImon and TdiScope
created to attach to TCP device. I could see only the control devices.

My questions:

  1. Why is IoAttachDevice failing. Is it because of CheckPoint driver? Can a
    filter driver control further attaching of another filter driver to the same
    device?

  2. How TdiMon and TDIScope works? Are they hooking TCP dispatch routines
    instead of attaching to TCP using IoAttachDevice.

Thanks in advance
Vijender

2

“Vijender” wrote in message news:xxxxx@ntdev…
> Hi,
>
> My machine: Windows XP SP2.
> Tools used: TdiMon, TdiScope, devicetree (ddk), checkpoin smartclient VPN
> application and my TDI filter driver
>
> I installed CheckPoint SmartClient R56 on my machine. Then I tried to load
> my TDI filter driver. It failed. It could not attach to TCP.
>
> IoAttachDevice returned 0xC0000009 (no such device)…
> My driver works if CheckPoint is uninstalled.
>

Consider using IoAttachDeviceToDeviceStack.

Thomas F. Divine, DDK MVP
http://www.pcausa.com

> I investigated and found that one CheckPoint-smartclient driver is already
> attached to TCP (and other devices in tcpip.sys) named as “scap”.
>
> THe first impression was that checkpoint driver is not allowing any TDI
> filter to attach to TCP. I dont understand why?
>
> Then I started TdiMon and TdiScope. They both worked fine with Checkpoint
> driver installed. But I can’t see any extra devices that TDImon and
> TdiScope
> created to attach to TCP device. I could see only the control devices.
>
> My questions:
>
> 1. Why is IoAttachDevice failing. Is it because of CheckPoint driver? Can
> a
> filter driver control further attaching of another filter driver to the
> same
> device?
>
> 2. How TdiMon and TDIScope works? Are they hooking TCP dispatch routines
> instead of attaching to TCP using IoAttachDevice.
>
>
> Thanks in advance
> Vijender
>
>

3

Nobody ever promised that 2 TDI filters will be able to work together. They
are completely undocumented and unsupported. Use them at your own risk. Interop
issues are nearly inevitable.

Data-processing TDI filters are just plain bad idea (though you can have
CREATE-only filter to associate port numbers with processes). Period. Use NDIS
IM instead.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Vijender”
To: “Windows System Software Devs Interest List”
Sent: Saturday, April 02, 2005 4:13 AM
Subject: [ntdev] IoAttachDevice Failed : Checkpoint VPN

> Hi,
>
> My machine: Windows XP SP2.
> Tools used: TdiMon, TdiScope, devicetree (ddk), checkpoin smartclient VPN
> application and my TDI filter driver
>
> I installed CheckPoint SmartClient R56 on my machine. Then I tried to load
> my TDI filter driver. It failed. It could not attach to TCP.
>
> IoAttachDevice returned 0xC0000009 (no such device)…
> My driver works if CheckPoint is uninstalled.
>
> I investigated and found that one CheckPoint-smartclient driver is already
> attached to TCP (and other devices in tcpip.sys) named as “scap”.
>
> THe first impression was that checkpoint driver is not allowing any TDI
> filter to attach to TCP. I dont understand why?
>
> Then I started TdiMon and TdiScope. They both worked fine with Checkpoint
> driver installed. But I can’t see any extra devices that TDImon and TdiScope
> created to attach to TCP device. I could see only the control devices.
>
> My questions:
>
> 1. Why is IoAttachDevice failing. Is it because of CheckPoint driver? Can a
> filter driver control further attaching of another filter driver to the same
> device?
>
> 2. How TdiMon and TDIScope works? Are they hooking TCP dispatch routines
> instead of attaching to TCP using IoAttachDevice.
>
>
> Thanks in advance
> Vijender
>
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com