Try filtering \Device\HarddiskVolume%d volume stack and not the disk stack.
–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
wrote in message news:xxxxx@ntdev…
> Edouard A. said:
> > Methinks a piece of the puzzle is missing… My crystal ball says “Signed
drivers may write to the disk!”. You can check it in signing the driver with a
certificate present in your root certs store (makecert, signtool).
>
>
> I just verified that release signing the driver does not workaround the
STATUS_ACCESS_DENIED response to an IRP_MJ_WRITE initiated by my disk filter
driver. (The driver does pass the x64 kernel mode code signing checks.) I also
rebuilt the driver with both DDK 3790 and WDK 6000 with no change in the
problem, so it’s not a DDK issue.
>
>