Re: Legacy FSFD loading but not filtering on 2008 x64

Peter,

Sorry - missed your reply. Yes, I am using IoRegisterFsRegistrationChange.
Good point about whether it succeeds or not. I’ll add a log entry in there.
If it doesn’t succceed, what could be a likely cause?

Thanks.

“Peter Scott” wrote in message
news:xxxxx@ntfsd…
> Neil Weicher wrote:
>> Ok, here is some more information.
>>
>> I added some code to create event log entries on the dispatch and
>> completion
>> of IRP_MJ_FILE_SYSTEM_CONTROL for minor codes: IRP_MN_MOUNT_VOLUME and
>> IRP_MN_LOAD_FILE_SYSTEM.
>>
>> I do not see any entries on the problem system 2008 x64, although I do
>> see
>> them on all other 2008 x64 systems I’ve tried it on.
>>
>> Any idea where to look next?
>
> Are you calling IoRegisterFsRegistrationChange(Ex) to register your legacy
> filter for file system load changes? Are you sure it succeeds and if it
> does, do you get callbacks in that callback routine?
>
> Or do you manually attach to the file system CDO’s?
>
> Pete
>
>>
>> Thanks.
>>
>> ------------------------
>>
>> “Neil Weicher” wrote in message news:xxxxx@ntfsd…
>>> Very strange situation. On one specific Windows 2008 x64 machine, my
>>> legacy
>>> FSFD is definitely loading but is not filtering any devices. When I run
>>> DeviceTree 2.21 it shows the driver loaded but not attached to any
>>> devices.
>>>
>>> Interestingly, DeviceTree Wlh/Amd64 loads, but WNet/Amd64 gives me an
>>> error
>>> saying that “Administrator must run it”, even though I have
>>> administrative
>>> rights on the machine.
>>>
>>> The driver is definitely properly signed (it does load).
>>>
>>> Is there some strange new permissions thing going on in Window 2008 x64
>>> that
>>> blocks legacy FSFDs from filtering?
>>>
>>>
>>>
>>>
>>>
>>>
>>
>>
>>
>>
>> —
>> NTFSD is sponsored by OSR
>>
>> For our schedule of debugging and file system seminars
>> (including our new fs mini-filter seminar) visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>
> –
> Kernel Drivers
> Windows File System and Device Driver Consulting
> www.KernelDrivers.com
> 866.263.9295
>

On 3/16/2010 1:29 PM, Neil Weicher wrote:

Peter,

Sorry - missed your reply. Yes, I am using IoRegisterFsRegistrationChange.
Good point about whether it succeeds or not. I’ll add a log entry in there.
If it doesn’t succceed, what could be a likely cause?

Not sure what would cause the failure of this call other than resource
depletion or something along those lines.

It would be interesting to know if it does succeed, if your callbacks
are getting invoked.

Pete

Thanks.

“Peter Scott” wrote in message
> news:xxxxx@ntfsd…
>> Neil Weicher wrote:
>>> Ok, here is some more information.
>>>
>>> I added some code to create event log entries on the dispatch and
>>> completion
>>> of IRP_MJ_FILE_SYSTEM_CONTROL for minor codes: IRP_MN_MOUNT_VOLUME and
>>> IRP_MN_LOAD_FILE_SYSTEM.
>>>
>>> I do not see any entries on the problem system 2008 x64, although I do
>>> see
>>> them on all other 2008 x64 systems I’ve tried it on.
>>>
>>> Any idea where to look next?
>>
>> Are you calling IoRegisterFsRegistrationChange(Ex) to register your legacy
>> filter for file system load changes? Are you sure it succeeds and if it
>> does, do you get callbacks in that callback routine?
>>
>> Or do you manually attach to the file system CDO’s?
>>
>> Pete
>>
>>>
>>> Thanks.
>>>
>>> ------------------------
>>>
>>> “Neil Weicher” wrote in message news:xxxxx@ntfsd…
>>>> Very strange situation. On one specific Windows 2008 x64 machine, my
>>>> legacy
>>>> FSFD is definitely loading but is not filtering any devices. When I run
>>>> DeviceTree 2.21 it shows the driver loaded but not attached to any
>>>> devices.
>>>>
>>>> Interestingly, DeviceTree Wlh/Amd64 loads, but WNet/Amd64 gives me an
>>>> error
>>>> saying that “Administrator must run it”, even though I have
>>>> administrative
>>>> rights on the machine.
>>>>
>>>> The driver is definitely properly signed (it does load).
>>>>
>>>> Is there some strange new permissions thing going on in Window 2008 x64
>>>> that
>>>> blocks legacy FSFDs from filtering?
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>
>>>
>>>
>>>
>>> —
>>> NTFSD is sponsored by OSR
>>>
>>> For our schedule of debugging and file system seminars
>>> (including our new fs mini-filter seminar) visit:
>>> http://www.osr.com/seminars
>>>
>>> To unsubscribe, visit the List Server section of OSR Online at
>>> http://www.osronline.com/page.cfm?name=ListServer
>>
>> –
>> Kernel Drivers
>> Windows File System and Device Driver Consulting
>> www.KernelDrivers.com
>> 866.263.9295
>>
>
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer


Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295