Re[2]: file system driver can't stop when

NTFSD
1

Are you registering as a file system? How many references are there on
your device object you use to register?

Pete

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com http:</http:>
866.263.9295

------ Original Message ------
From: xxxxx@sina.com
To: “Windows File Systems Devs Interest List”
Sent: 2/29/2016 6:14:51 PM
Subject: RE:[ntfsd] file system driver can’t stop when

>thanks everybody.
>my fs driver is not a filter driver,and i use !devstack to view
>device,and there are no references/handles to be keeped,also i use
>irpfind,!stacks to view everything about my fs driver,but the result is
>the same,nothing is related.
>
>As Maxim said, it related to SEC_IMAGE and ImageFileMap,it is
>correct.when mouse hover the PE file,fast io’s callback
>AcquireFileForNtCreateSection and ReleaseFileForNtCreateSection will be
>called.
>
>
>—
>NTFSD is sponsored by OSR
>
>
>MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>software drivers!
>Details at http:
>
>To unsubscribe, visit the List Server section of OSR Online at
>http:</http:></http:>

2

thank Pete.

i haven’t registered a file system,i only reference the disk device and volume device.

if i don’t call ioregisterfilesystem to register my fs,will troubles go with my fs?

btw,my english is not very good,please forgiving me.thanks:)

3

> i haven’t registered a file system,i only reference the disk device and volume device.

Then who invokes your mount path?

–
Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

4

@Maxim,you mean who calls my fs when mouse hover the file? it is Explorer.exe.

my code skeleton as follow:
IoCreateDevice(diskDev…)
IocreateDevice(volDev…);
diskDev->Vpb->DeviceObject = volDev
diskDev->Vpb->RealDevice = volDev
diskDev->Vpb->Flags |= VPB_MOUNTED;
diskDev->Vpb->VolumeLabelLength =xxx
ObReferenceObject(diskDev);
ObReferenceObject(volDev);

thanks Maxim

5

who can help me,Please.