Linking differences between Windows client and server

NTDEV
1

Are there any such differences? suddenly a minifilter I’m working on won’t load on win server (tried 2016, 2019), and I get the message “The specified procedure could not be found.”. However the same driver loads just fine on various client versions of win 10 (tried LTSC 2021, 20H2). I also see the same thing happening on testsigned builds and MS attestation signed ones. I initially was using WDK 10.0.22621.382, and also tried 10.0.22621.2428.
I see that often this error indicates a missing dependency, and running https://github.com/lucasg/Dependencies does show that fltmgr.sys and ksecdd.sys are missing. In .vcxproj I’m linking to both of the static libs however: $(DDK_LIB_PATH)fltmgr.lib;$(DDK_LIB_PATH)ksecdd.lib

Given all that, I’ve got two questions for any benevolent WDK whisperers out there: what does it mean that dependencies claims it can’t find some libraries? and if that’s an issue, why would the driver run on client versions, and not server versions?
Appreciate any advice or tips anyone has to offer, thanks.

2

Are you using ExAllocateFromLookasideListEx?

Check the CAUTION notice on its documentation.

https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-exallocatefromlookasidelistex#:~:text=Caution,Driver%20Settings->General.

Regards,

1 Like
3

ok, I finally figured out what my problem was, and it wasn’t really related to client vs. server.
it was due to replacing usage of ExAllocatePoolWithTag with ExAllocatePool2, since MSVC raises a warning that the former is deprecated… doing so caused the driver to fail to load on win 10 versions earlier than 2004. reverting that change fixed things. in the long term I guess I need to follow the guidance here https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/updating-deprecated-exallocatepool-calls