Strange Mini-filter load error

Hi All,

I’m foxed by a strange problem. I’m using manual start for my mini-filter. It
loads fine the first time, using “net start x”. It also stops fine using “net
stop x”. But if I try to load it again using “net start x”, I get the error
ERROR_FILE_NOT_FOUND. After rebooting the machine it loads again without
problem.

During the second (failed) load, DriverEntry did not get invoked, leading me to
wonder what’s going on.

thanks,
Deepak

“Deepak Kumar” wrote in message news:xxxxx@ntfsd…
> Hi All,
>
> I’m foxed by a strange problem. I’m using manual start for my mini-filter.
> It
> loads fine the first time, using “net start x”. It also stops fine using
> “net
> stop x”. But if I try to load it again using “net start x”, I get the
> error
> ERROR_FILE_NOT_FOUND. After rebooting the machine it loads again without
> problem.
>
> During the second (failed) load, DriverEntry did not get invoked, leading
> me to
> wonder what’s going on.

Rather than wondering, try to find what your driver broke in the system
while it was running.
Or, what it forgot to undo before unloading.
–pa

Thanks for the suggestion. I love your helpful post.

If someone has experienced a similar problem before, I’d appreciate your
comments.

thanks,
Deepak


From: Pavel A.
To: Windows File Systems Devs Interest List
Sent: Tue, October 26, 2010 6:05:06 PM
Subject: Re:[ntfsd] Strange Mini-filter load error

“Deepak Kumar” wrote in message news:xxxxx@ntfsd…
> Hi All,
>
> I’m foxed by a strange problem. I’m using manual start for my mini-filter. It
> loads fine the first time, using “net start x”. It also stops fine using “net
> stop x”. But if I try to load it again using “net start x”, I get the error
> ERROR_FILE_NOT_FOUND. After rebooting the machine it loads again without
> problem.
>
> During the second (failed) load, DriverEntry did not get invoked, leading me
to
> wonder what’s going on.

Rather than wondering, try to find what your driver broke in the system while it
was running.
Or, what it forgot to undo before unloading.
–pa


NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit: http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Does your DriverEntry get called?

-scott

Scott Noone
Consulting Associate
OSR Open Systems Resources, Inc.
http://www.osronline.com

“Deepak Kumar” wrote in message news:xxxxx@ntfsd…
Thanks for the suggestion. I love your helpful post.

If someone has experienced a similar problem before, I’d appreciate your
comments.

thanks,
Deepak

From: Pavel A.
To: Windows File Systems Devs Interest List
Sent: Tue, October 26, 2010 6:05:06 PM
Subject: Re:[ntfsd] Strange Mini-filter load error

“Deepak Kumar” wrote in message news:xxxxx@ntfsd…
> Hi All,
>
> I’m foxed by a strange problem. I’m using manual start for my mini-filter.
> It
> loads fine the first time, using “net start x”. It also stops fine using
> “net
> stop x”. But if I try to load it again using “net start x”, I get the
> error
> ERROR_FILE_NOT_FOUND. After rebooting the machine it loads again without
> problem.
>
> During the second (failed) load, DriverEntry did not get invoked, leading
> me to
> wonder what’s going on.

Rather than wondering, try to find what your driver broke in the system
while it was running.
Or, what it forgot to undo before unloading.
–pa


NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

I’ve seen this happen when references get leaked. As a very quick way to
repro this problem with a sample minifilter, add an " ObReferenceObject(
DriverObject );" somewhere in the DriverEntry function for the passthrough
minifilter sample in the WDK (so that you leak a reference to the
DriverObject itself) and it will exhibit similar behavior.

Driver verifier might catch this, try running it that way.

Another way to verify that this is the problem is to get the address of your
DRIVER_OBJECT before you unload the driver, then unload it and in the
debugger see if that driver object went away (!drvobj and !object on the
address). You must do it by address because after unload the object will be
removed from the OB namespace and you can’t find it anymore…

Thanks,
Alex.

Hi Scott,

DriverEntry is not getting invoked at all!

thanks,
Deepak


From: Scott Noone
To: Windows File Systems Devs Interest List
Sent: Wed, October 27, 2010 7:19:01 AM
Subject: Re:[ntfsd] Strange Mini-filter load error

Does your DriverEntry get called?

-scott

Scott Noone
Consulting Associate
OSR Open Systems Resources, Inc.
http://www.osronline.com

“Deepak Kumar” wrote in message news:xxxxx@ntfsd…
Thanks for the suggestion. I love your helpful post.

If someone has experienced a similar problem before, I’d appreciate your
comments.

thanks,
Deepak

From: Pavel A.
To: Windows File Systems Devs Interest List
Sent: Tue, October 26, 2010 6:05:06 PM
Subject: Re:[ntfsd] Strange Mini-filter load error

“Deepak Kumar” wrote in message news:xxxxx@ntfsd…
> Hi All,
>
> I’m foxed by a strange problem. I’m using manual start for my mini-filter. It
> loads fine the first time, using “net start x”. It also stops fine using “net
> stop x”. But if I try to load it again using “net start x”, I get the error
> ERROR_FILE_NOT_FOUND. After rebooting the machine it loads again without
> problem.
>
> During the second (failed) load, DriverEntry did not get invoked, leading me
to
> wonder what’s going on.

Rather than wondering, try to find what your driver broke in the system while it
was running.
Or, what it forgot to undo before unloading.
–pa


NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit: http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer


NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit: http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Hi Alex,

Thank you very much for helping, I think this might well be the case… I’ll try
it out and let you know the result.

thanks,
Deepak


From: Alex Carp
To: Windows File Systems Devs Interest List
Sent: Wed, October 27, 2010 9:25:15 AM
Subject: RE: [ntfsd] Strange Mini-filter load error

I’ve seen this happen when references get leaked. As a very quick way to
repro this problem with a sample minifilter, add an " ObReferenceObject(
DriverObject );" somewhere in the DriverEntry function for the passthrough
minifilter sample in the WDK (so that you leak a reference to the
DriverObject itself) and it will exhibit similar behavior.

Driver verifier might catch this, try running it that way.

Another way to verify that this is the problem is to get the address of your
DRIVER_OBJECT before you unload the driver, then unload it and in the
debugger see if that driver object went away (!drvobj and !object on the
address). You must do it by address because after unload the object will be
removed from the OB namespace and you can’t find it anymore…

Thanks,
Alex.


NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Check the registry (in case the path has changed) and then I’d look at Alex’s suggestion (which seems more likely but will take slightly longer to do…)
“Deepak Kumar” wrote in message news:xxxxx@ntfsd…
Hi Scott,

DriverEntry is not getting invoked at all!

thanks,
Deepak

------------------------------------------------------------------------------
From: Scott Noone
To: Windows File Systems Devs Interest List
Sent: Wed, October 27, 2010 7:19:01 AM
Subject: Re:[ntfsd] Strange Mini-filter load error

Does your DriverEntry get called?

-scott

Scott Noone
Consulting Associate
OSR Open Systems Resources, Inc.
http://www.osronline.com

“Deepak Kumar” wrote in message news:xxxxx@ntfsd…
Thanks for the suggestion. I love your helpful post.

If someone has experienced a similar problem before, I’d appreciate your comments.

thanks,
Deepak

From: Pavel A.
To: Windows File Systems Devs Interest List
Sent: Tue, October 26, 2010 6:05:06 PM
Subject: Re:[ntfsd] Strange Mini-filter load error

“Deepak Kumar” wrote in message news:xxxxx@ntfsd…
> Hi All,
>
> I’m foxed by a strange problem. I’m using manual start for my mini-filter. It
> loads fine the first time, using “net start x”. It also stops fine using “net
> stop x”. But if I try to load it again using “net start x”, I get the error
> ERROR_FILE_NOT_FOUND. After rebooting the machine it loads again without
> problem.
>
> During the second (failed) load, DriverEntry did not get invoked, leading me to
> wonder what’s going on.

Rather than wondering, try to find what your driver broke in the system while it was running.
Or, what it forgot to undo before unloading.
--pa


NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit: http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer


NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit: http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Hi Alex,

It turned out that I wasn’t destroying a control device and its symbolic link
while unloading the driver. Fixed that and it works fine now.

Thank you very much for your help!

– DK


From: Deepak Kumar
To: Windows File Systems Devs Interest List
Sent: Wed, October 27, 2010 9:07:21 PM
Subject: Re: [ntfsd] Strange Mini-filter load error

Hi Alex,

Thank you very much for helping, I think this might well be the case… I’ll try
it out and let you know the result.

thanks,
Deepak

________________________________
From: Alex Carp
To: Windows File Systems Devs Interest List
Sent: Wed, October 27, 2010 9:25:15 AM
Subject: RE: [ntfsd] Strange Mini-filter load error

I’ve seen this happen when references get leaked. As a very quick way to
repro this problem with a sample minifilter, add an " ObReferenceObject(
DriverObject );" somewhere in the DriverEntry function for the passthrough
minifilter sample in the WDK (so that you leak a reference to the
DriverObject itself) and it will exhibit similar behavior.

Driver verifier might catch this, try running it that way.

Another way to verify that this is the problem is to get the address of your
DRIVER_OBJECT before you unload the driver, then unload it and in the
debugger see if that driver object went away (!drvobj and !object on the
address). You must do it by address because after unload the object will be
removed from the OB namespace and you can’t find it anymore…

Thanks,
Alex.


NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer