Hello guys!
I faced with strange problem, when try to unload my minifilter by using FltUnregisterFilter() :
- on WinXP with Symantec Endpoint Security (with SymEFASI minifilter) call FltUnregisterFilter() hang…
kd> !fltkd.filters DRIVER
FLT_FILTER: 89a10ab8 “SymEFASI” “260610”
FLT_OBJECT: 89a10ab8 [02000000] Filter
RundownRef : 0x00001b30 (3480)
PointerCount : 0x00000001
PrimaryLink : [8969e984-8958997c]
Frame : 89663000 “Frame 1”
Flags : [00000002] FilteringInitiated
DriverObject : 89a10f38
FilterLink : [8969e984-8958997c]
PreVolumeMount : 00000000 (null)
PostVolumeMount : 00000000 (null)
FilterUnload : 00000000 (null)
InstanceSetup : b9e57d84 symefasi+0xfcd84
InstanceQueryTeardown : b9e57ea0 symefasi+0xfcea0
InstanceTeardownStart : b9e57f1a symefasi+0xfcf1a
InstanceTeardownComplete : b9e57fd0 symefasi+0xfcfd0
ActiveOpens : (89a10b7c) mCount=5
Client Port List : (89a10ba8) mCount=0
VerifierExtension : 00000000
Operations : 89a10bd8
OldDriverUnload : 00000000 (null)
SupportedContexts : (89a10b48)
VolumeContexts : (89a10b48)
InstanceContexts : (89a10b4c)
ALLOCATE_CONTEXT_NODE: 89a10790 “SymEFASI” [01] LookasideList
Could not read field “NonPaged.L.Size” of FltMgr!_ALLOCATE_CONTEXT_LOOKASIDE from address: 89a10790
FileContexts : (89a10b50)
StreamContexts : (89a10b54)
ALLOCATE_CONTEXT_NODE: 89a10858 “SymEFASI” [01] LookasideList
Could not read field “NonPaged.L.Size” of FltMgr!_ALLOCATE_CONTEXT_LOOKASIDE from address: 89a10858
StreamHandleContexts : (89a10b58)
ALLOCATE_CONTEXT_NODE: 89a10920 “SymEFASI” [01] LookasideList
Could not read field “NonPaged.L.Size” of FltMgr!_ALLOCATE_CONTEXT_LOOKASIDE from address: 89a10920
TransactionContext : (89a10b5c)
ALLOCATE_CONTEXT_NODE: 89a109e8 “SymEFASI” [01] LookasideList
Could not read field “NonPaged.L.Size” of FltMgr!_ALLOCATE_CONTEXT_LOOKASIDE from address: 89a109e8
InstanceList : (89a10ae8)
FLT_INSTANCE: 89a0a4d8 “SymEFASI” “260610”
FLT_INSTANCE: 898a0db0 “SymEFASI” “260610”
FLT_INSTANCE: 894a3998 “SymEFASI” “260610”
FLT_INSTANCE: 878fab30 “SymEFASI” “260610”
Object usage/reference information unavailable: Mini-filter verifier not enabled for mini-filter.:
FLT_FILTER: 8969e978 “MyFilter” “260394”
FLT_OBJECT: 8969e978 [02000000] Filter
RundownRef : 0x00000012 (9)
PointerCount : 0x00000002
PrimaryLink : [8966305c-89a10ac4]
Frame : 89663000 “Frame 1”
Flags : [00000002] FilteringInitiated
DriverObject : 87de7188
FilterLink : [8966305c-89a10ac4]
PreVolumeMount : 00000000 (null)
PostVolumeMount : 00000000 (null)
FilterUnload : b4596ef0 MyFilter!FltUnload
InstanceSetup : b9ec2790 fltMgr!FltvInstanceSetup
InstanceQueryTeardown : b9ec27b4 fltMgr!FltvInstanceQueryTeardown
InstanceTeardownStart : b9ec27d2 fltMgr!FltvInstanceTeardownStart
InstanceTeardownComplete : b9ec27f0 fltMgr!FltvInstanceTeardownComplete
ActiveOpens : (8969ea3c) mCount=0
Client Port List : (8969ea68) mCount=0
VerifierExtension : 894a9438
Operations : 8969ea98
OldDriverUnload : b458f656 MyFilter!UnloadDriver
SupportedContexts : (8969ea08)
VolumeContexts : (8969ea08)
ALLOCATE_CONTEXT_NODE: 897908c8 “MyFilter” [01] LookasideList
Could not read field “NonPaged.L.Size” of FltMgr!_ALLOCATE_CONTEXT_LOOKASIDE from address: 897908c8
InstanceContexts : (8969ea0c)
FileContexts : (8969ea10)
StreamContexts : (8969ea14)
ALLOCATE_CONTEXT_NODE: 89790990 “MyFilter” [01] LookasideList
Could not read field “NonPaged.L.Size” of FltMgr!_ALLOCATE_CONTEXT_LOOKASIDE from address: 89790990
StreamHandleContexts : (8969ea18)
TransactionContext : (8969ea1c)
InstanceList : (8969e9a8)
FLT_INSTANCE: 89796588 “MyFilter Instance” “260394”
FLT_INSTANCE: 896a0a80 “MyFilter Instance” “260394”
FLT_INSTANCE: 87956888 “MyFilter Instance” “260394”
FLT_INSTANCE: 89482008 “MyFilter Instance” “260394”
Object usage/reference information:
Could not read offset of field “Count” from type FltMgr!_FLT_VERIFIER_EXTENSION
0: kd> !locks
**** DUMP OF ALL RESOURCE OBJECTS ****
KD: Scanning for held locks…
Resource @ 0x89a0e10c Exclusively owned
Threads: 89bb3da0-01<*>
KD: Scanning for held locks…
Resource @ 0x87477628 Shared 1 owning threads
Threads: 89bb5903-01<*> *** Actual Thread 89bb5900
15299 total locks, 2 locks currently held
0: kd> !locks -v 89a0e10c
Resource @ 0x89a0e10c Exclusively owned
Threads: 89bb3da0-01<*>
THREAD 89bb3da0 Cid 0004.0038 Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Non-Alertable
ba50bb44 SynchronizationEvent
IRP List:
89f58f68: (0006,0094) Flags: 40000000 Mdl: 00000000
Not impersonating
DeviceMap e1000198
Owning Process 0 Image:
Attached Process 89bb65f0 Image: System
Wait Start TickCount 15339 Ticks: 13177 (0:00:03:25.890)
Context Switch Count 7526
UserTime 00:00:00.000
KernelTime 00:00:04.093
Start Address nt!ExpWorkerThread (0x80538834)
Stack Init ba50c000 Current ba50bad0 Base ba50c000 Limit ba509000 Call 0
Priority 12 BasePriority 12 PriorityDecrement 0 DecrementCount 16
ChildEBP RetAddr
ba50bae8 8050393e nt!KiSwapContext+0x2f (FPO: [Uses EBP] [0,0,4])
ba50baf4 804fb0d8 nt!KiSwapThread+0x8a (FPO: [0,0,0])
ba50bb1c b9ec2c1b nt!KeWaitForSingleObject+0x1c2 (FPO: [Non-Fpo])
ba50bb5c b9eb4ff7 fltMgr!FltpExWaitForRundownProtectionReleaseCacheAware+0x83 (FPO: [Non-Fpo])
ba50bb68 b9ebaa24 fltMgr!FltpDrainPendingCallbacksForInstance+0x17 (FPO: [Non-Fpo])
ba50bb98 b9ec1816 fltMgr!FltpFreeInstance+0x74 (FPO: [Non-Fpo])
ba50bbbc b47ed60e fltMgr!FltUnregisterFilter+0x96 (FPO: [Non-Fpo])
ba50bbc8 b47f5f05 FgstUSTC!StopStorageFilter+0x46 (FPO: [0,0,4]) (CONV: stdcall) [f:\driverwork\securetower\securetower\endpointagent\storagecontroldriver\storagecontroldriver.c @ 1264]
ba50bbcc b9ebce00 FgstUSTC!SCD_FltUnload+0x15 (FPO: [1,0,0]) (CONV: stdcall) [f:\driverwork\securetower\securetower\endpointagent\storagecontroldriver\storagecontroldriver.c @ 346]
ba50bd64 b9ebcfcf fltMgr!FltpDoUnloadFilter+0xf8 (FPO: [Non-Fpo])
ba50bd7c 80538923 fltMgr!FltpUnloadFilterWorkerRoutine+0x15 (FPO: [Non-Fpo])
ba50bdac 805cffee nt!ExpWorkerThread+0xef (FPO: [Non-Fpo])
ba50bddc 8054620e nt!PspSystemThreadStartup+0x34 (FPO: [Non-Fpo])
00000000 00000000 nt!KiThreadStartup+0x16
----------------------------------------------------------------
I don’t have any ideas how to solve this problem(