Hi all,
I’ve got a very small minifilter driver, which tests if a file exists or not
using IoCreateFileSpecifyDeviceObjectHint() in PreCreate handler. Strangely
InstanceTeardownStart() gets invoked but InstanceTeardownComplete() doesn’t
get invoked on DriverUnload, which obviously suggests a hang on minifilter
unload and of course the system goes nuts after this.
I’ve got PostCreate, PreCleanUp and PreWrite routines which I stole from DDK
scanner sample and they are nearly empty functions(I removed code from
scanner sample). So the code snippet below is pretty much the whole code
that I’ve got.
Does anyone have a clue?
The code snippet is as follows.
(BTW, I also noticed FltCreateFile suffers the same problem with passed
instance handle and without FILE_NON_DIRECTORY_FILE flag)
FLT_PREOP_CALLBACK_STATUS PreCreate (
IN OUT PFLT_CALLBACK_DATA Data,
IN PCFLT_RELATED_OBJECTS FltObjects,
OUT PVOID *CompletionContext
)
{
PFLT_FILE_NAME_INFORMATION nameInfo;
NTSTATUS status;
//
// Check if we are interested in this file.
//
status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED |
FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo);
if (!NT_SUCCESS( status )) {
return FLT_PREOP_SUCCESS_WITH_CALLBACK;
}
FltParseFileNameInformation( nameInfo );
PDEVICE_OBJECT pVolumeDev = NULL;
status = FltGetDeviceObject(FltObjects->Volume, &pVolumeDev);
if(NT_SUCCESS(status))
{
PDEVICE_OBJECT pBaseFsDev =
IoGetDeviceAttachmentBaseRef(pVolumeDev);
if(pBaseFsDev)
{
HANDLE hFile = NULL;
IO_STATUS_BLOCK iostatus;
OBJECT_ATTRIBUTES oa;
InitializeObjectAttributes(&oa, &nameInfo->Name,
OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, NULL);
status = IoCreateFileSpecifyDeviceObjectHint(
&hFile,
// File Handle
FILE_READ_DATA | SYNCHRONIZE, //
DesiredAccess
&oa,
// ObjectAttributes
&iostatus,
// IoStatusBlock
NULL,
// AllocationSize (OPTIONAL)
FILE_ATTRIBUTE_NORMAL, // FileAttributes
0,
// ShareAccess
FILE_OPEN,
// Disposition
FILE_SYNCHRONOUS_IO_NONALERT, // CreateOptions
NULL,
// EaBuffer (OPTIONAL)
0,
// EaLength
CreateFileTypeNone,
// CreateFileType
NULL,
// ExtraCreateParameters (OPTIONAL)
IO_IGNORE_SHARE_ACCESS_CHECK, // Options
pBaseFsDev
);
if(NT_SUCCESS(status) && hFile)
{
ZwClose(hFile);
}
ObDereferenceObject(pBaseFsDev); // release basefs device object
DbgPrint(“CREATE: %wZ VolumeDev 0x%x BaseFsDev 0x%x hFile 0x%x
(0x%x)\n”, &nameInfo->Name, pVolumeDev, pBaseFsDev, hFile, status);
}
ObDereferenceObject(pVolumeDev); // release volume device object }
}
FltReleaseFileNameInformation( nameInfo );
return FLT_PREOP_SUCCESS_WITH_CALLBACK;
}