Hi,
I’m encountering an odd minifilter issue. It’s probably something
obvious but I’ve wasted the best part of a day on it already, so…
Basically I’ve got a small minifilter (doesn’t do much at the moment as
it’s mostly a shell) and built it, using a standard inf file, etc.
It’s installed… it just won’t start up. There are no debug traces and
I don’t think DriverEntry is even being called…
When I start the driver all I get is:
[SC] StartService FAILED 317:
The system cannot find message text for message number 0x
The filter is there in system32\drivers, the inf has setup the path
correctly (hardcoding it or using sc change doesn’t seem to change
this)… it’s just not loading, and I’m scratching my head because this
is the easy bit… I haven’t even written the driver yet!
The only odd bit is this windows x64 but that’s not really a problem as
I’ve written drivers on that before with no issues…
Tony
Sorry for asking the obvious, but…are you sure you built a 64 bit driver?
Anything in the system log?
Is FltMgr.sys loaded?
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Tony Hoyle
Sent: Wednesday, October 04, 2006 9:07 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Odd minifilter issue
Hi,
I’m encountering an odd minifilter issue. It’s probably something
obvious but I’ve wasted the best part of a day on it already, so…
Basically I’ve got a small minifilter (doesn’t do much at the moment as
it’s mostly a shell) and built it, using a standard inf file, etc.
It’s installed… it just won’t start up. There are no debug traces and
I don’t think DriverEntry is even being called…
When I start the driver all I get is:
[SC] StartService FAILED 317:
The system cannot find message text for message number 0x
The filter is there in system32\drivers, the inf has setup the path
correctly (hardcoding it or using sc change doesn’t seem to change
this)… it’s just not loading, and I’m scratching my head because this
is the easy bit… I haven’t even written the driver yet!
The only odd bit is this windows x64 but that’s not really a problem as
I’ve written drivers on that before with no issues…
Tony
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@privtek.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
Dan Kyler wrote:
Sorry for asking the obvious, but…are you sure you built a 64 bit driver?
Yep.
Anything in the system log?
No.
Is FltMgr.sys loaded?
Yes.
I built another driver I had just to be sure and it works fine.
The code is just nullfilter with a FltCreateCommunicationPort call (just
copy/paste from other stuff) & a bit of housekeeping
(ExAllocatePoolWithTag/ExFreePoolWithTaq). I’ve put DbgPrint statements
right at the start of DriverEntry and it’s just not getting there.
Completely stumped…
There used to be a program with the DDK that would analyse the sys file
imports and tell you of any problems/incompatibilities with various OS’s
but I can’t find that any more… it might show up something wrong with
the generate binary.
Tony
Are you using SC START to load the driver? Try using FLTMC LOAD instead.
At the very least, it might give you a better error message.
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Tony Hoyle
Sent: Thursday, October 05, 2006 8:07 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] Odd minifilter issue
Dan Kyler wrote:
Sorry for asking the obvious, but…are you sure you built a 64 bit
driver?
Yep.
Anything in the system log?
No.
Is FltMgr.sys loaded?
Yes.
I built another driver I had just to be sure and it works fine.
The code is just nullfilter with a FltCreateCommunicationPort call (just
copy/paste from other stuff) & a bit of housekeeping
(ExAllocatePoolWithTag/ExFreePoolWithTaq). I’ve put DbgPrint statements
right at the start of DriverEntry and it’s just not getting there.
Completely stumped…
There used to be a program with the DDK that would analyse the sys file
imports and tell you of any problems/incompatibilities with various OS’s
but I can’t find that any more… it might show up something wrong with
the generate binary.
Tony
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@privtek.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
Dan Kyler wrote:
Sorry for asking the obvious, but…are you sure you built a 64 bit driver?
Anything in the system log?
OK I switched to a different debug viewer since none of my normal ones
seemed to be working.
With this one (DebugView) I get the DriverEntry entered then a bizarre
error message:
Inuse!DriverEntry - starting
Inuse!DriverEntry - FltRegisterFilter failed - c01c0011
c01c0011 is (apparently) STATUS_OBJECT_NAME_COLLISION
“The Name member of the Registration structure did not contain a unique
name for the minifilter. Filter names must be unique. This is an error
code.”
Well the registration structure doesn’t even *have* a name member, and I
can’t see anywhere to set one. The documentation is rather useless in
this case…
Is there a way to list the loaded minifilters? sq query doesn’t list
them unless you know their name…
Tony
from a command prompt:-
fltmc filters
That lists all the currently registered filters
Ben
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Tony Hoyle
Sent: 05 October 2006 16:13
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] Odd minifilter issue
Dan Kyler wrote:
Sorry for asking the obvious, but…are you sure you built a 64 bit
driver?
Anything in the system log?
OK I switched to a different debug viewer since none of my normal ones
seemed to be working.
With this one (DebugView) I get the DriverEntry entered then a bizarre
error message:
Inuse!DriverEntry - starting
Inuse!DriverEntry - FltRegisterFilter failed - c01c0011
c01c0011 is (apparently) STATUS_OBJECT_NAME_COLLISION
“The Name member of the Registration structure did not contain a unique
name for the minifilter. Filter names must be unique. This is an error
code.”
Well the registration structure doesn’t even *have* a name member, and I
can’t see anywhere to set one. The documentation is rather useless in
this case…
Is there a way to list the loaded minifilters? sq query doesn’t list
them unless you know their name…
Tony
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@des.co.uk
To unsubscribe send a blank email to xxxxx@lists.osr.com
Use “fltmc filters” to list the current mini-filters loaded. Is it possible that this represents an altitude collision? You should be using your MS-assigned altitiude (assuming you have one - I’m still waiting for the one I requested over a year ago…)
Tony
Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com
Ben Curley wrote:
from a command prompt:-
fltmc filters
That lists all the currently registered filters
That said the filter was loaded, so I tried to unload it… and the
machine bluescreened. After the reboot everything worked fine.
It looks like filter manager got itself into a wierd state and couldn’t
get out of it.
Tony
xxxxx@osr.com wrote:
Use “fltmc filters” to list the current mini-filters loaded. Is it
possible that this represents an altitude collision? You should be
using your MS-assigned altitiude (assuming you have one - I’m still
waiting for the one I requested over a year ago…)
I wasn’t aware that that you had to have one… I’ve written a few
minifilters before and just left the altitude at the one in the example
source code.
Tony
Tony Hoyle wrote:
xxxxx@osr.com wrote:
> Use “fltmc filters” to list the current mini-filters loaded. Is it
> possible that this represents an altitude collision? You should be
> using your MS-assigned altitiude (assuming you have one - I’m still
> waiting for the one I requested over a year ago…)
>
I wasn’t aware that that you had to have one… I’ve written a few
minifilters before and just left the altitude at the one in the example
source code.
Sigh. Tried to fill in the form… WTF is it with the 50 character
limit on the *address*?? I mean, it’s the company address… it isn’t
going to get any shorter.
Same with the notes - I was going to describe briefly what it did but
try to do that in ~8 words.
Someone really needs to look at that.
Tony
> Sigh. Tried to fill in the form… WTF is it with the 50 character limit on the
*address*?? I mean, it’s the company address… it isn’t going to get any shorter.
Are there really addresses so long? Still funny 
Same with the notes - I was going to describe briefly what it did but try to do
that in ~8 words.
This would be sufficient, you need to tell them where the filter should load.
I.e. encryption driver, audit driver…
–
King regards, Dejan
http://www.alfasp.com
File system audit, security and encryption kits.
Dejan Maksimovic wrote:
Are there really addresses so long? Still funny
Just because ‘1 Microsoft Way, Redmond, Washington, USA’ just about
fits doesn’t mean anyone else does (I assume they tested with that and
rounded up). My home address unabbreviated is 91 characters and
abbreviated to the point of insanity I can get it down to 74.
> Same with the notes - I was going to describe briefly what it did but try to do
> that in ~8 words.
This would be sufficient, you need to tell them where the filter should load.
I.e. encryption driver, audit driver…
It doesn’t fit neatly into those categories… it’s just a helper for the
userspace program and I don’t know what level it should go at… above
anything that couldn’t handle a STATUS_REPARSE on open - except there’s
nowhere to write that requirement, so I’ll have to cross my fingers and
hope.
I tried to register another driver and I could just about say ‘should go
somewhere near the top’ but couldn’t explain why because there weren’t
enough characters (it sets SL_CASE_SENSITIVE for a small set of
directories used by the application, so must be above anything that
might be affected by that).
Tony
> Just because ‘1 Microsoft Way, Redmond, Washington, USA’ just about
fits doesn’t mean anyone else does (I assume they tested with that and
rounded up). My home address unabbreviated is 91 characters and
abbreviated to the point of insanity I can get it down to 74.
Been a long time since I requested one, I thought it was the street address only.
I tried to register another driver and I could just about say ‘should go somewhere near
the top’ but couldn’t explain why because there weren’t enough characters (it sets
SL_CASE_SENSITIVE for a small set of directories used by the application, so must be
above anything that might be affected by that).
File name filter would describe it perfectly.
–
King regards, Dejan
http://www.alfasp.com
File system audit, security and encryption kits.
Dejan Maksimovic wrote:
>I tried to register another driver and I could just about say ‘should go somewhere near
>the top’ but couldn’t explain why because there weren’t enough characters (it sets
>SL_CASE_SENSITIVE for a small set of directories used by the application, so must be
>above anything that might be affected by that).
File name filter would describe it perfectly.
That’s a new term to me… certainly makes sense to call it that.
Although aren’t we limited to the categories listed here?
http://www.microsoft.com/whdc/driver/filterdrv/alt-range.mspx
‘Open File’ looks promising but apparently that’s something to do with
backup.
There’s also the small wrinkle that it has to work in Win2000 (with
rollup 1) and most of those categories didn’t exist on that… although
producing two .inf files isn’t a major hardship.
Tony