IoGetDeviceObjectPointer Problem [supplement] !

Hi all,

To supplement the previous message.

The driver is created as a service with start type; “SERVICE_AUTO_START”.

Thanks

– Philip

You’re probably loading before rdr.sys (which is responsible for
creating the LanManager device object). You can test this by changing
your driver to demand load and then starting it manually after logging
in.

  • Nicholas Ryan

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Philip Hong
Sent: Wednesday, March 12, 2003 2:23 AM
To: File Systems Developers
Subject: [ntfsd] IoGetDeviceObjectPointer Problem [supplement] !

Hi all,

To supplement the previous message.

The driver is created as a service with start type;
“SERVICE_AUTO_START”.

Thanks

– Philip


You are currently subscribed to ntfsd as: xxxxx@nryan.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

To get around this in a filter (which was started at boot time) I wrote a
few years
back I created a background thread which would periodically try and attach
to a list
of device names i’d provided it with.

I’d noticed several virus products using the same method (some with a more
configurable
list via the registry).

hth

Rob Linegar
Software Engineer
Data Encryption Systems Limited

-----Original Message-----
From: Nicholas Ryan [mailto:xxxxx@nryan.com]
Sent: 13 March 2003 09:54
To: File Systems Developers
Subject: [ntfsd] RE: IoGetDeviceObjectPointer Problem [supplement] !

You’re probably loading before rdr.sys (which is responsible for
creating the LanManager device object). You can test this by changing
your driver to demand load and then starting it manually after logging
in.

  • Nicholas Ryan

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Philip Hong
Sent: Wednesday, March 12, 2003 2:23 AM
To: File Systems Developers
Subject: [ntfsd] IoGetDeviceObjectPointer Problem [supplement] !

Hi all,

To supplement the previous message.

The driver is created as a service with start type;
“SERVICE_AUTO_START”.

Thanks

– Philip


You are currently subscribed to ntfsd as: xxxxx@nryan.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


You are currently subscribed to ntfsd as: xxxxx@des.co.uk
To unsubscribe send a blank email to xxxxx@lists.osr.com

Another mechanism to use here is to filter \Device\Mup and watch for the
registration of UNC providers (most redirectors are UNC providers).

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@des.co.uk [mailto:xxxxx@des.co.uk]
Sent: Thursday, March 13, 2003 6:04 AM
To: File Systems Developers
Subject: [ntfsd] RE: IoGetDeviceObjectPointer Problem [supplement] !

To get around this in a filter (which was started at boot time) I wrote a
few years
back I created a background thread which would periodically try and attach
to a list
of device names i’d provided it with.

I’d noticed several virus products using the same method (some with a more
configurable
list via the registry).

hth

Rob Linegar
Software Engineer
Data Encryption Systems Limited

-----Original Message-----
From: Nicholas Ryan [mailto:xxxxx@nryan.com]
Sent: 13 March 2003 09:54
To: File Systems Developers
Subject: [ntfsd] RE: IoGetDeviceObjectPointer Problem [supplement] !

You’re probably loading before rdr.sys (which is responsible for
creating the LanManager device object). You can test this by changing
your driver to demand load and then starting it manually after logging
in.

  • Nicholas Ryan

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Philip Hong
Sent: Wednesday, March 12, 2003 2:23 AM
To: File Systems Developers
Subject: [ntfsd] IoGetDeviceObjectPointer Problem [supplement] !

Hi all,

To supplement the previous message.

The driver is created as a service with start type;
“SERVICE_AUTO_START”.

Thanks

– Philip


You are currently subscribed to ntfsd as: xxxxx@nryan.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


You are currently subscribed to ntfsd as: xxxxx@des.co.uk
To unsubscribe send a blank email to xxxxx@lists.osr.com


You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com