RE: [ntfsd] RE: [ntfsd] FilterAttach returns error code 0x80070002

Hi Alex,

it seems I should always read the documentation of the kernel equivalent then. :wink: Because the documentation of FilterAttach states: “lpInstanceName [in, optional]: Pointer to a null-terminated wide-character string containing the instance name for the new instance. This parameter is optional and can be NULL. If this parameter is NULL, the new instance receives the minifilter’s default instance name as described in the Remarks section for FltAttachVolume”. From that description it was not clear to me that the instance name cannot be chosen arbitrarily.

Thanks,
Jens

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Alex Carp
Sent: Tuesday, February 11, 2014 2:46 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] RE: [ntfsd] FilterAttach returns error code 0x80070002

Hi Jens

I’m not sure it’s that strange :). The documentation states that the function will fail with?ERROR_FILE_NOT_FOUND?If?lpInstanceName?is non-NULL,?lpInstanceName?does not match a registered filter instance name in the registry.
So did you give the instance a name in the registry ? Is that name “C:” ?

Thanks,
Alex.

On Mon, Feb 10, 2014 at 10:16 AM, Jens Mittag wrote:
Hi Alex,

ahhhh, thanks a lot. Without passing an instance name it works perfectly, thought it is strange that it doesn’t work with a name.

Jens

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Alex Carp
Sent: Monday, February 10, 2014 7:09 PM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] FilterAttach returns error code 0x80070002

Can you try calling it like so:
? status = FilterAttach(L"myminifilter",
? ? argv[2],
? ? NULL, ?// <- not argv[2]…
? ? NULL,
? ? NULL);

Thanks,
Alex.

On Mon, Feb 10, 2014 at 7:09 AM, Jens Mittag wrote:
Hi,

I am working on a minifilter and it works without problems so far when I let it auto-attach to all volumes after successfully loading it. I have disabled the auto-attach behavior now and instead want to attach my minifilter from an own user space control daemon that is calling FilterAttach(). However, every time I get an error code of 0x80070002 as a result.

Here is the relevant code:

? HRESULT status;
? TCHAR lpDosName[100];

? status = FilterGetDosName(argv[2], lpDosName, 100);
? if (status == S_OK)
? {
? ? printf(“Received the following dos name for volume ‘%ls’: %ls\n”, argv[2], lpDosName);
? }
? else
? {
? ? printf(“Operation failed with error 0x%08lx\n”, status);
? }

? status = FilterAttach(L"myminifilter",
? ? argv[2],
? ? argv[2],
? ? NULL,
? ? NULL);

The filter is successfully loaded using the OpenSCManager() and OpenService() approach, and the application is executed in a terminal running as administrator. fltmc shows that the filter is loaded and has 0 instances.

When I run my application with “C:” as argv[2] then, I get the following output:

? Received the following dos name for volume ‘C:’: C:
? Error code: 0x80070002

However, when I attach the filter to “C:” using fltmc everything works fine… What is my mistake? Insufficient access rights? According to the Microsoft Error Code tool 0x80070002 refers to an object or file not found error, which is strange because FilterGetDosName(…) can handle the input “C:”. I also tried other inputs for argv[2], but no success.

In case it matters: my target platform is Win 8.1 32-bit in a virtual machine.

Thanks for your help
?Jens


NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

— NTFSD is sponsored by OSR OSR is hiring!! Info at http://www.osr.com/careers For our schedule of debugging and file system seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer


NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

— NTFSD is sponsored by OSR OSR is hiring!! Info at http://www.osr.com/careers For our schedule of debugging and file system seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer