MiniFilter Inf AddRegistry DebugFlags SupportedFeatures ?

NTFSD
1

Looking at the Windows sample, PassThru in this case, you have inf registry section as:

[MiniFilter.AddRegistry]
HKR,“DebugFlags”,0x00010001 ,0x0
HKR,“SupportedFeatures”,0x00010001,0x3
HKR,“Instances”,“DefaultInstance”,0x00000000,%DefaultInstance%
HKR,"Instances"%Instance1.Name%,“Altitude”,0x00000000,%Instance1.Altitude%
HKR,"Instances"%Instance1.Name%,“Flags”,0x00010001,%Instance1.Flags%

But, what exactly are bit the values for DebugFlags, SupportedFeatures, and the “Flags” in the Instance ? I couldn’t find anything searching online ?

2

Flags

See the document "Loading and Unloading Minifilters":

What controls which instances are created

Flags contains OR-able bit values:

* 0x01 - when set suppress automatic attachment
* 0x02 - when set suppress manual attachment

SupportedFeatures

Offloaded Data Transfers

File System Filter Opt-In Model and Impact to Applications
Filter Manager, starting with Windows 8, allows a filter to
specify offload capability as a supported feature. File system
filters attached to a volume can collectively determine if a
certain offloaded operation is supported or not; if it is not,
the operation fails with an appropriate error code.

A filter must indicate that it supports FSCTL_OFFLOAD_READ and
FSCTL_OFFLOAD_WRITE through a registry DWORD value named
SupportedFeatures, located in the driver service definition in
the registry at HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services<filter driver name>. This value contains bitfields
where the bits determine which functionality is opted-in,
and should be set during filter installation.

Currently, the defined bits are:

Flag Meaning

SUPPORTED_FS_FEATURES_OFFLOAD_READ 0x00000001
Filter supports FSCTL_OFFLOAD_READ

SUPPORTED_FS_FEATURES_OFFLOAD_WRITE 0x00000002
Filter supports FSCTL_OFFLOAD_WRITE

3

Other values described here:

Windows 10 RS1-2-3-4 and the lack of documentation
http://www.osronline.com/cf.cfm?PageURL=showlists.cfm?list=NTDEV
:slight_smile: