Hello.
I have a minifilter that inherits some code from a legecy driver.
I have declared my own IRP_MJ routines, as shown in the CDO example from MS.
This way I can use the private interface I used formerly in a legacy driver without changing code.
It works.
Currently I am using the Unload member on FLT_REGISTRATION structure to declare an unload routine.
Now I was trying to declare my own Unload routine to clean up things I use in my old driver but have observed that the original MiniFilter Unload routine is not called if I do that.
My unload routine is called but the one declared for the minifilter is not.
My question is: should I keep the minifilter unload routine alone or is it possible to have two unload routines in a minifilter?
I have no problem at calling my old Unload routine from the minifilter unload but was curious to know what happens when Unload Driver is called for a minifilter.
Inaki.
I?aki Castillo
Programmer
xxxxx@pandasecurity.com mailto:xxxxx
PANDA SECURITY. One step ahead.
Buenos Aires, 12
48001. Bilbao. SPAIN
Phone: +34 94 425 11 00
Fax: + 34 94 424 46 97
www.pandasecurity.com blocked::http:</blocked::http:>
PANDA SOFTWARE is now PANDA SECURITY!
This e-mail contains confidential information owned by Panda Software. Any such copy, or use, or distribution or disclosure of its contents is strictly forbidden. Please notify us immediately at our phone number (+34 94 425 11 00) or at our e-mail address xxxxx@pandasecurity.com blocked::mailto:xxxxx if you receive this e-mail and are not its consignee, and then delete this message from your system without copying it, distributing it, or disclosing its contents.
P Before printing this message, please make sure it is really necessary.</blocked::mailto:xxxxx></mailto:xxxxx>
In a minifilter, you don’t really own the Dispatch vector or the unload routine. In my experience you can overload the IRP_MJ functions so long as you don’t want to use the communication package.
As for the unload entry point - based on no more than gut instinct I’d leave that alone.
It looks as though the filter manager is putting its own address in there and may well (now or in the future) “do stuff” either before or after calling your FLT_REGISTRATION unload entry point (automatic detach under the correct circumstance would be one thing it might do).
When I’ve needed to keep support for both legacy (gotta keep those pre SP4 W2K sites running!) and FltMgr, I’ve had a lot of success in just building two separate drivers, with one module taking into account the differences between the two modules.
Rod
Consulting Partner
Steading System Software LLP
“I?aki Castillo” wrote in message news:xxxxx@ntfsd…
Hello.
I have a minifilter that inherits some code from a legecy driver.
I have declared my own IRP_MJ routines, as shown in the CDO example from MS.
This way I can use the private interface I used formerly in a legacy driver without changing code.
It works.
Currently I am using the Unload member on FLT_REGISTRATION structure to declare an unload routine.
Now I was trying to declare my own Unload routine to clean up things I use in my old driver but have observed that the original MiniFilter Unload routine is not called if I do that.
My unload routine is called but the one declared for the minifilter is not.
My question is: should I keep the minifilter unload routine alone or is it possible to have two unload routines in a minifilter?
I have no problem at calling my old Unload routine from the minifilter unload but was curious to know what happens when Unload Driver is called for a minifilter.
Inaki.
I?aki Castillo
Programmer
xxxxx@pandasecurity.com
PANDA SECURITY. One step ahead.
Buenos Aires, 12
48001. Bilbao. SPAIN
Phone: +34 94 425 11 00
Fax: + 34 94 424 46 97
www.pandasecurity.com
PANDA SOFTWARE is now PANDA SECURITY!
This e-mail contains confidential information owned by Panda Software. Any such copy, or use, or distribution or disclosure of its contents is strictly forbidden. Please notify us immediately at our phone number (+34 94 425 11 00) or at our e-mail address xxxxx@pandasecurity.com if you receive this e-mail and are not its consignee, and then delete this message from your system without copying it, distributing it, or disclosing its contents.
P Before printing this message, please make sure it is really necessary.
Rod.Thanks for you answer.
I have checked that minifilter standard communications still work when I overload the IRP_MJ functions.
Which kind of problems have you found with communications ?
Inaki.
De: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] En nombre de Rod Widdowson
Enviado el: viernes, 21 de septiembre de 2007 16:46
Para: Windows File Systems Devs Interest List
Asunto: Re:[ntfsd] MiniFilter Unload Routine
In a minifilter, you don’t really own the Dispatch vector or the unload routine. In my experience you can overload the IRP_MJ functions so long as you don’t want to use the communication package.
As for the unload entry point - based on no more than gut instinct I’d leave that alone.
It looks as though the filter manager is putting its own address in there and may well (now or in the future) “do stuff” either before or after calling your FLT_REGISTRATION unload entry point (automatic detach under the correct circumstance would be one thing it might do).
When I’ve needed to keep support for both legacy (gotta keep those pre SP4 W2K sites running!) and FltMgr, I’ve had a lot of success in just building two separate drivers, with one module taking into account the differences between the two modules.
Rod
Consulting Partner
Steading System Software LLP
“I?aki Castillo” wrote in message news:xxxxx@ntfsd…
Hello.
I have a minifilter that inherits some code from a legecy driver.
I have declared my own IRP_MJ routines, as shown in the CDO example from MS.
This way I can use the private interface I used formerly in a legacy driver without changing code.
It works.
Currently I am using the Unload member on FLT_REGISTRATION structure to declare an unload routine.
Now I was trying to declare my own Unload routine to clean up things I use in my old driver but have observed that the original MiniFilter Unload routine is not called if I do that.
My unload routine is called but the one declared for the minifilter is not.
My question is: should I keep the minifilter unload routine alone or is it possible to have two unload routines in a minifilter?
I have no problem at calling my old Unload routine from the minifilter unload but was curious to know what happens when Unload Driver is called for a minifilter.
Inaki.
I?aki Castillo
Programmer
xxxxx@pandasecurity.com mailto:xxxxx
PANDA SECURITY. One step ahead.
Buenos Aires, 12
48001. Bilbao. SPAIN
Phone: +34 94 425 11 00
Fax: + 34 94 424 46 97
www.pandasecurity.com blocked::http:</blocked::http:>
PANDA SOFTWARE is now PANDA SECURITY!
This e-mail contains confidential information owned by Panda Software. Any such copy, or use, or distribution or disclosure of its contents is strictly forbidden. Please notify us immediately at our phone number (+34 94 425 11 00) or at our e-mail address xxxxx@pandasecurity.com blocked::mailto:xxxxx if you receive this e-mail and are not its consignee, and then delete this message from your system without copying it, distributing it, or disclosing its contents.
P Before printing this message, please make sure it is really necessary.
—
NTFSD is sponsored by OSR
For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars
You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com</blocked::mailto:xxxxx></mailto:xxxxx>
Inaki,
Which kind of problems have you found with communications ?
I hadn’t had problems (I’ve not had call to use them yet) - this was anecdotal from someone sometime ago…
Rod