NDIS lwf sample problem on win7 64 bit

NTDEV
1

I have problem: when I attach NDIS sample lwf filter to network adapter, it successfully attach, and logs are shown in DebugView, but network become disconnect, and when I try to un-install NDIS, then network window is hang.

Process I follow: (build machine win7, test machine win7(VM))
I build ndis lwf sample with wdk 8.1 with x64 configuration
I move inf and sys file to test VM (win7 64bit), where I install test certificate(create my self using makecert) and sign the cat file after creating it using inf2cat.
Return status of all commands are successful
Install filter manually using procedure describe at msdn sample code page, while windows running in Test mode.
(There is no signing problem, since windows didn’t give warning about “driver not digitally signed” during installation)

Do any have quick Idea, What might be problem ?

Thank you

2

The install almost certainly failed in some way.

I would recommend looking at setupapi logs in \Windows\Inf folder. Probably
a good idea to view operation with WinDbg during installation as well.

If you INF/INX file has FilterRunType as one of the Mandatory values, then
network connectivity will be broken if your filter has any install problem.
Change this to be an Optional filter.

Good luck!

Thomas F. Divine
http://www.pcausa.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@gmail.com
Sent: Saturday, June 6, 2015 4:14 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] NDIS lwf sample problem on win7 64 bit

I have problem: when I attach NDIS sample lwf filter to network adapter, it
successfully attach, and logs are shown in DebugView, but network become
disconnect, and when I try to un-install NDIS, then network window is hang.

Process I follow: (build machine win7, test machine win7(VM)) I build ndis
lwf sample with wdk 8.1 with x64 configuration I move inf and sys file to
test VM (win7 64bit), where I install test certificate(create my self using
makecert) and sign the cat file after creating it using inf2cat.
Return status of all commands are successful Install filter manually using
procedure describe at msdn sample code page, while windows running in Test
mode.
(There is no signing problem, since windows didn’t give warning about
“driver not digitally signed” during installation)

Do any have quick Idea, What might be problem ?

Thank you

NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

Thank you for your response.

The install operation is succeeded according to setupapi.dev log :
Here are some start and ending lines of setupapi logs for ndislwf:

>> [SetupCopyOEMInf - c:\users\administrator\downloads\driver\netlwf.inf]
>> Section start 2015/06/08 18:35:23.985
cmd: C:\Windows\Explorer.EXE
sto: {Import Driver Package: c:\users\administrator\downloads\driver\netlwf.inf} 18:35:24.016

… (omit middle logs)

sto: Filename = C:\Windows\System32\DriverStore\FileRepository\netlwf.inf_amd64_neutral_7f24d25d3bce7755\netlwf.inf
sto: Time = 1185 ms
sto: {Import Driver Package: exit(0x00000000)} 18:35:25.202
inf: Opened INF: ‘c:\users\administrator\downloads\driver\netlwf.inf’ ([strings])
inf: Driver Store location: C:\Windows\System32\DriverStore\FileRepository\netlwf.inf_amd64_neutral_7f24d25d3bce7755\netlwf.inf
inf: Published Inf Path: C:\Windows\INF\oem11.inf
inf: Opened INF: ‘c:\users\administrator\downloads\driver\netlwf.inf’ ([strings])
inf: Installing catalog netlwf.cat as: oem11.CAT
<<< Section end 2015/06/08 18:35:25.264
<<< [Exit status: SUCCESS]

I also change filterRunType from mandatory to optional, but still network connectivity becomes down after attaching NDIS lwf filter.

I insert a DbgPrint() in NdisSendBufferLists() function, which are also shown on DebugView after installing filter, but I think filter isn’t giving packet to lower miniport driver, and network connectivity seems to be broken.

Thank you

–
Muhammad Hassan

4

Thank you for your response.

The install operation is succeeded according to setupapi.dev log :
Here are some start and ending lines of setupapi logs for ndislwf:

>> [SetupCopyOEMInf - c:\users\administrator\downloads\driver\netlwf.inf]
>> Section start 2015/06/08 18:35:23.985
cmd: C:\Windows\Explorer.EXE
sto: {Import Driver Package:
c:\users\administrator\downloads\driver\netlwf.inf} 18:35:24.016

… (omit middle logs)

sto: Filename =
C:\Windows\System32\DriverStore\FileRepository\netlwf.inf_amd64_neutral_7f24d25d3bce7755\netlwf.inf
sto: Time = 1185 ms
sto: {Import Driver Package: exit(0x00000000)} 18:35:25.202
inf: Opened INF: ‘c:\users\administrator\downloads\driver\netlwf.inf’
([strings])
inf: Driver Store location:
C:\Windows\System32\DriverStore\FileRepository\netlwf.inf_amd64_neutral_7f24d25d3bce7755\netlwf.inf
inf: Published Inf Path: C:\Windows\INF\oem11.inf
inf: Opened INF: ‘c:\users\administrator\downloads\driver\netlwf.inf’
([strings])
inf: Installing catalog netlwf.cat as: oem11.CAT
<<< Section end 2015/06/08 18:35:25.264
<<< [Exit status: SUCCESS]

I also change filterRunType from mandatory to optional, but still network
connectivity becomes down after attaching NDIS lwf filter.

I insert a DbgPrint() in NdisSendBufferLists() function, which are also
shown on DebugView after installing filter, but I think filter isn’t giving
packet to lower miniport driver, and network connectivity seems to be
broken.

Thank you

–
Muhammad Hassan

On Sun, Jun 7, 2015 at 4:01 AM, Thomas F. Divine wrote:

> The install almost certainly failed in some way.
>
> I would recommend looking at setupapi logs in \Windows\Inf folder. Probably
> a good idea to view operation with WinDbg during installation as well.
>
> If you INF/INX file has FilterRunType as one of the Mandatory values, then
> network connectivity will be broken if your filter has any install problem.
> Change this to be an Optional filter.
>
> Good luck!
>
>
> Thomas F. Divine
> http://www.pcausa.com
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of
> xxxxx@gmail.com
> Sent: Saturday, June 6, 2015 4:14 PM
> To: Windows System Software Devs Interest List
> Subject: [ntdev] NDIS lwf sample problem on win7 64 bit
>
> I have problem: when I attach NDIS sample lwf filter to network adapter, it
> successfully attach, and logs are shown in DebugView, but network become
> disconnect, and when I try to un-install NDIS, then network window is hang.
>
>
> Process I follow: (build machine win7, test machine win7(VM)) I build ndis
> lwf sample with wdk 8.1 with x64 configuration I move inf and sys file to
> test VM (win7 64bit), where I install test certificate(create my self using
> makecert) and sign the cat file after creating it using inf2cat.
> Return status of all commands are successful Install filter manually using
> procedure describe at msdn sample code page, while windows running in Test
> mode.
> (There is no signing problem, since windows didn’t give warning about
> “driver not digitally signed” during installation)
>
> Do any have quick Idea, What might be problem ?
>
> Thank you
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

5

Sorry. I am fresh out of ideas…

If WinDbg shows your send and received handlers being called and you still have no connectivity – then I’m stumped.

Thomas F. Divine

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of muhammad hassan
Sent: Monday, June 8, 2015 9:38 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] NDIS lwf sample problem on win7 64 bit

Thank you for your response.

The install operation is succeeded according to setupapi.dev log :

Here are some start and ending lines of setupapi logs for ndislwf:

>> [SetupCopyOEMInf - c:\users\administrator\downloads\driver\netlwf.inf]

>> Section start 2015/06/08 18:35:23.985

cmd: C:\Windows\Explorer.EXE

sto: {Import Driver Package: c:\users\administrator\downloads\driver\netlwf.inf} 18:35:24.016

… (omit middle logs)

sto: Filename = C:\Windows\System32\DriverStore\FileRepository\netlwf.inf_amd64_neutral_7f24d25d3bce7755\netlwf.inf

sto: Time = 1185 ms

sto: {Import Driver Package: exit(0x00000000)} 18:35:25.202

inf: Opened INF: ‘c:\users\administrator\downloads\driver\netlwf.inf’ ([strings])

inf: Driver Store location: C:\Windows\System32\DriverStore\FileRepository\netlwf.inf_amd64_neutral_7f24d25d3bce7755\netlwf.inf

inf: Published Inf Path: C:\Windows\INF\oem11.inf

inf: Opened INF: ‘c:\users\administrator\downloads\driver\netlwf.inf’ ([strings])

inf: Installing catalog netlwf.cat http: as: oem11.CAT

<<< Section end 2015/06/08 18:35:25.264

<<< [Exit status: SUCCESS]

I also change filterRunType from mandatory to optional, but still network connectivity becomes down after attaching NDIS lwf filter.

I insert a DbgPrint() in NdisSendBufferLists() function, which are also shown on DebugView after installing filter, but I think filter isn’t giving packet to lower miniport driver, and network connectivity seems to be broken.

Thank you

–

Muhammad Hassan

On Sun, Jun 7, 2015 at 4:01 AM, Thomas F. Divine > wrote:

The install almost certainly failed in some way.

I would recommend looking at setupapi logs in \Windows\Inf folder. Probably
a good idea to view operation with WinDbg during installation as well.

If you INF/INX file has FilterRunType as one of the Mandatory values, then
network connectivity will be broken if your filter has any install problem.
Change this to be an Optional filter.

Good luck!

Thomas F. Divine
http://www.pcausa.com

-----Original Message-----
From: xxxxx@lists.osr.com mailto:xxxxx
[mailto:xxxxx@lists.osr.com mailto:xxxxx] On Behalf Of
xxxxx@gmail.com mailto:xxxxx
Sent: Saturday, June 6, 2015 4:14 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] NDIS lwf sample problem on win7 64 bit

I have problem: when I attach NDIS sample lwf filter to network adapter, it
successfully attach, and logs are shown in DebugView, but network become
disconnect, and when I try to un-install NDIS, then network window is hang.

Process I follow: (build machine win7, test machine win7(VM)) I build ndis
lwf sample with wdk 8.1 with x64 configuration I move inf and sys file to
test VM (win7 64bit), where I install test certificate(create my self using
makecert) and sign the cat file after creating it using inf2cat.
Return status of all commands are successful Install filter manually using
procedure describe at msdn sample code page, while windows running in Test
mode.
(There is no signing problem, since windows didn’t give warning about
“driver not digitally signed” during installation)

Do any have quick Idea, What might be problem ?

Thank you

—
NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

— NTDEV is sponsored by OSR Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev OSR is HIRING!! See http://www.osr.com/careers For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></http:>

6

I have problem: when I attach NDIS sample lwf filter to network adapter, it
successfully attach, and logs are shown in DebugView, but network become
disconnect, and when I try to un-install NDIS, then network window is hang.

!ndiskd is your friend here as is !stacks 2 ndis!
The ‘hang’ sounds like INetCfg has (as part of uninstalling your LWF) requested NDIS pause the stack and detach your LWF. If (as an example) your LWF has not managed NBLs correctly, this operation will block waiting forever.
And if this is the case, this tends to be strong evidence that the NBL handling is wrong and as a result expecting bound protocols to work correctly (and thus achieve some measure of ‘connected’) is a bit premature.
If you can reproduce this (and it seems you can) then I suggest you start by using !ndisdk.filters and !ndiskd.miniports to get some idea of state of the ‘stack’ your LWF is bound into. And then go look at threads that are currently blocked in NDIS and see if you find one that is blocked waiting for a pause/unbind to complete. !ndiskd.netreport -v will create a very informative document with this information all cataloged and organized.
Good Luck,Dave Cattley