We’re working on a minifilter that we’re currently calling an “activity monitor” while we work on some of our initial path finding. In our INF file, we specify the class and class GUID to reflect this:
[Version]
Signature = “$Windows NT$”
Class = “ActivityMonitor”
ClassGuid = {b86dff51-a31e-4bac-b3cf-e8cfe75c9fc2}
Provider = %US%
DriverVer = 06/16/2008,1.0.0.0
CatalogFile = foo.cat
[Foo.Service]
DisplayName = %ServiceName%
Description = %ServiceDescription%
ServiceBinary = %12%%DriverName%.sys
Dependencies = FltMgr
ServiceType = 2
StartType = 3
ErrorControl = 1
LoadOrderGroup = “FSFilter Activity Monitor”
AddReg = Foo.AddRegistry
[Foo.AddRegistry]
HKR,“Instances”,“DefaultInstance”,0x00000000,%DefaultInstance%
HKR,"Instances"%Instance1.Name%,“Altitude”,0x00000000,%Instance1.Altitude%
HKR,"Instances"%Instance1.Name%,“Flags”,0x00010001,%Instance1.Flags%
DefaultInstance = “Foo - Top Instance”
Instance1.Name = “Foo - Top Instance”
Instance1.Altitude = “370000”
Instance1.Flags = 0x0
When we install our driver we find the expected entry under HKLM\SYSTEM\CurrentControlSet\Services:
DependOnService FltMgr
Description Test
DisplayName FOO
ErrorControl 1
Group FsFilter Activity Monitor
ImagePath system32\DRIVERS\foo.sys
Start 3
Tag 2
Type 2
However, the corresponding entry under HKLM\SYSTEM\CurrentControlSet\Enum\Root shows our class and class GUID as being a legacy driver:
Class LegacyDriver
ClassGUID {8ECC055D-047F-11D1-A537-0000F8753ED1}
ConfigFlags 0
DeviceDesc FOO
Legacy 1
Service FOO
Is this expected for file system minifilters, that they install with the legacy drivers under …\Enum\Root?
Thanks,
Tony Bock