Re[2]: Anomalous behavior with filtering and an auto-mount

> If I let the system see the

volume and auto-mount it as Windows is coming up, the calls from the
client work fine but are never seen by the mini-filters create callback
routines, and my state machine fails.

What’s the pattern of those create requests which
are unseen by your minifilter ? Are they occasionally
missed or you just don’t see a single create request ?

If you can reproduce a request which will miss your minifilter,
maybe you will be able to trace through fltmgr.sys and see
why it never arrives to your code.

(but you probably know this, sorry for not giving better advice)

L.

I can reproduce this anytime I want, but there is a heck of a lot to trace
in assember, and unfortunately multi-threaded so tracing through fltmgr is
a PITA. I have a KdPrint at the beginning of the PreCreate callback and
another in the code that issues the ZwCreateFile for the client just before
the call (this print is always seen). If I mount the drive explicily I
see the local and client creates with the PreCreate KdPrint. With
automount, I see the local creates with the PreCreate KdPrint, but for the
client creates I see the print from before the Zw but no subsequent create
through PreCreate.


Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
http://www.windrvr.com
Remove StopSpam from the email to reply

“Ladislav Zezula” wrote in message news:xxxxx@ntfsd…
>> If I let the system see the
>> volume and auto-mount it as Windows is coming up, the calls from the
>> client work fine but are never seen by the mini-filters create callback
>> routines, and my state machine fails.
>
>
> What’s the pattern of those create requests which
> are unseen by your minifilter ? Are they occasionally
> missed or you just don’t see a single create request ?
>
> If you can reproduce a request which will miss your minifilter,
> maybe you will be able to trace through fltmgr.sys and see
> why it never arrives to your code.
>
> (but you probably know this, sorry for not giving better advice)
>
> L.
>
>
>