Passthrough Minifilter Sample

NTDEV
1

Hi,

I’m working on a simple driver that will receive callbacks when certain file I/O is performed. To get started, I built and ran the passthrough minifilter sample, and installed it in a virtual machine.

Everything seems to be fine, but when I run WinDBG with kernel monitoring enabled, I’m not seeing any printouts for callbacks being called. The sample is setup to print out whenever a callback is called, but I’m not seeing anything.

Can someone explain what I might be doing wrong?

Thanks!

2

Sorry, I meant to say DebugView, not WinDBG, as the tool I’m using to monitor driver debug output.

3

Which OS are you using? For Vista and above, we have to open a ‘switch’ to get debug output from drivers. Google ‘windbg vista’ to get more help.

Thanks
Wayne

-----Original Message-----
From: xxxxx@msn.com [mailto:xxxxx@msn.com]
Sent: Thursday, April 01, 2010 1:46 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Passthrough Minifilter Sample

Hi,

I’m working on a simple driver that will receive callbacks when certain file I/O is performed. To get started, I built and ran the passthrough minifilter sample, and installed it in a virtual machine.

Everything seems to be fine, but when I run WinDBG with kernel monitoring enabled, I’m not seeing any printouts for callbacks being called. The sample is setup to print out whenever a callback is called, but I’m not seeing anything.

Can someone explain what I might be doing wrong?

Thanks!

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

4

Thanks for the suggestion. I’m using Win7 64bit, and I should have mentioned that I did enable debug output for drivers. I verified that I can see debug output in my DriverEntry call, so it’s definitely an issue with the callback itself not being called.

Given that, does anyone have any idea why the passthrough isn’t getting its callback called?
I verified that the driver IS installed via the INF and loaded by the Filter Manager, so all seems fine there.

5

a) use a debugger instead of debugview.
b) how exactly is your code trying to debug print?

Event tracing is also available and bypasses the whole debug print mechanism
and reliance on debuggers, however it comes with its own double wide trailer
of baggage so I personally never use it.

Mark Roddy

On Fri, Apr 2, 2010 at 3:03 AM, wrote:

> Thanks for the suggestion. I’m using Win7 64bit, and I should have
> mentioned that I did enable debug output for drivers. I verified that I can
> see debug output in my DriverEntry call, so it’s definitely an issue with
> the callback itself not being called.
>
> Given that, does anyone have any idea why the passthrough isn’t getting its
> callback called?
> I verified that the driver IS installed via the INF and loaded by the
> Filter Manager, so all seems fine there.
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

6

Thanks for the suggestion Mark.

I setup remote kernel debugging and discovered that my callbacks are being called, so I’m not sure why my print outs weren’t being called. Either way, I guess I should have done that before even posting here, I just made a bad assumption :-\

Thanks for all the help guys!