Win2K Driver re-loading problem...

OSR_Community_User · September 11, 2005, 6:54am

Hi,

I am writing an upper layer function driver, this driver should be compatible with WinXP and with Win2K ( No service pack ), the driver is created as exclusive and is loaded and unloaded dynamically by a custom user-mode app ( the app loads it upon startup and unloads it during termination ), running the driver on WinXP works smoothly BUT running it on Win2K ( No SP ) result problems:

On first run every thing works fine, BUT, on the second run, driver startup ( StartService ) fails with “The system cannot find the specified file” although the file wasn’t deleted or changed and it’s corresponding registry entry is valid: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services%My Driver Name%

ImagePath = ??\C:\SETSDriver.sys

I have also tried using NuMegas DriverMonitor to load and re-load my driver and go the same results, first run succeeds, the second fail….

What may cause this problem?

Why does it works fine with WinXP while it fail with Win2K? What WinXP does differently then Win2k [???]

Any help pointer or remark would be appreciated.

Naddav.

Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

OSR_Community_User · September 11, 2005, 7:52am

nadav,

Newbie here, so be warned I don’t know what I’m talking about…

First, I thought a FSD could not be unloaded at runtime, at least the IFS say’s you shouldn’t (even though they show one way in the filespy.sys).

Given the driver is on disk, and the registry is OK, I think you should look at the drivers unload routine. In usermode, what does QueryServiceStatusEx return?

Just thinking that the cache manager still has a handle on it, and when you try to reopen it fastio routines are getting a broken copy or something due to a dirty unload…

Not that my two cents mean anything though…

Good luck, I’ll continue monitoring this list and continue to try and learn something… I would like myself to know what the problem was…

Matt
----- Original Message -----
From: Nadav
To: Windows File Systems Devs Interest List
Sent: Sunday, September 11, 2005 5:53 AM
Subject: [ntfsd] Win2K Driver re-loading problem…

Hi,

I am writing an upper layer function driver, this driver should be compatible with WinXP and with Win2K ( No service pack ), the driver is created as exclusive and is loaded and unloaded dynamically by a custom user-mode app ( the app loads it upon startup and unloads it during termination ), running the driver on WinXP works smoothly BUT running it on Win2K ( No SP ) result problems:

On first run every thing works fine, BUT, on the second run, driver startup ( StartService ) fails with “The system cannot find the specified file” although the file wasn’t deleted or changed and it’s corresponding registry entry is valid: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services%My Driver Name%

ImagePath = ??\C:\SETSDriver.sys

I have also tried using NuMegas DriverMonitor to load and re-load my driver and go the same results, first run succeeds, the second fail…

What may cause this problem?

Why does it works fine with WinXP while it fail with Win2K? What WinXP does differently then Win2k [???]

Any help pointer or remark would be appreciated.

Naddav.

Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com — Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You are currently subscribed to ntfsd as: xxxxx@comcast.net To unsubscribe send a blank email to xxxxx@lists.osr.com

OSR_Community_User · September 11, 2005, 9:57am

Hi Matt,

Thanks for your response, Well, you thought right, FSFD cannot be unloaded at runtime, my unloadable driver, is not an FSFD, rather, it is a function driver that internally connect to a fixed FSFD and route it’s FileIO operations to user-mode, when I update my software I update the function driver ( rather then updating the fixed FSFD driver ), taking that in mind, the Win2K re-loading problem is with the function driver ( not the FSFD ) AND, the unload callback of that driver is being call when my app terminate, the problem is that after the function driver was successfuly unloaded it cannot be loaded again, StartService kepp returning “The system cannot find the specified file” although the file is there and the reg entries are OK…

Naddav.

Matt Martin wrote:
nadav,

Newbie here, so be warned I don’t know what I’m talking about…

First, I thought a FSD could not be unloaded at runtime, at least the IFS say’s you shouldn’t (even though they show one way in the filespy.sys).

Given the driver is on disk, and the registry is OK, I think you should look at the drivers unload routine. In usermode, what does QueryServiceStatusEx return?

Just thinking that the cache manager still has a handle on it, and when you try to reopen it fastio routines are getting a broken copy or something due to a dirty unload…

Not that my two cents mean anything though…

Good luck, I’ll continue monitoring this list and continue to try and learn something… I would like myself to know what the problem was…

Matt
----- Original Message -----
From: Nadav
To: Windows File Systems Devs Interest List
Sent: Sunday, September 11, 2005 5:53 AM
Subject: [ntfsd] Win2K Driver re-loading problem…

Hi,

I am writing an upper layer function driver, this driver should be compatible with WinXP and with Win2K ( No service pack ), the driver is created as exclusive and is loaded and unloaded dynamically by a custom user-mode app ( the app loads it upon startup and unloads it during termination ), running the driver on WinXP works smoothly BUT running it on Win2K ( No SP ) result problems:

On first run every thing works fine, BUT, on the second run, driver startup ( StartService ) fails with “The system cannot find the specified file” although the file wasn’t deleted or changed and it’s corresponding registry entry is valid: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services%My Driver Name%

ImagePath = ??\C:\SETSDriver.sys

I have also tried using NuMegas DriverMonitor to load and re-load my driver and go the same results, first run succeeds, the second fail….

What may cause this problem?

Why does it works fine with WinXP while it fail with Win2K? What WinXP does differently then Win2k [???]

Any help pointer or remark would be appreciated.

Naddav.

Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com — Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You are currently subscribed to ntfsd as: xxxxx@comcast.net To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

OSR_Community_User · September 11, 2005, 1:07pm

Well, as I have experimented with (re)loading drivers, it seemed to me
always as problem to make it work. The only thing that worked was
installing the driver; any other attempts to stop, remove or reinstall the driver
sooner or later failed.

L.

OSR_Community_User · September 12, 2005, 1:41am

Well, the driver I am dealing with is NOT a FSFD, ( internally, it communicate with a FSFD ), On WinXP there is no problem to load, unload and then load again the driver, on Win2K first loading and unloading is OK, the next re-loading is the problematic one… Also, using SoftIce to view the loaded modules ( After the driver was successfuly unloaded on Win2k ) show the driver module although it’s Unload callback was already called, I guess that ‘someone’ is holding a reference to the modules FILE_OBJECT…

Is there any way of finding out ‘who’ is holding this reference? any handle table I can browse? any tool or methodology I should use?

Any help would be appreciated…

Naddav.

Ladislav Zezula wrote:
Well, as I have experimented with (re)loading drivers, it seemed to me
always as problem to make it work. The only thing that worked was
installing the driver; any other attempts to stop, remove or reinstall the driver
sooner or later failed.

L.

—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

OSR_Community_User · September 12, 2005, 2:01am

Problem resolved, I had a name mismatch while deleting the symbolic-link of the driver during driver unload ( lower-case letter instade of an upper case letter ), this apparently caused the module to stay referenced…

Nadav wrote:Well, the driver I am dealing with is NOT a FSFD, ( internally, it communicate with a FSFD ), On WinXP there is no problem to load, unload and then load again the driver, on Win2K first loading and unloading is OK, the next re-loading is the problematic one… Also, using SoftIce to view the loaded modules ( After the driver was successfuly unloaded on Win2k ) show the driver module although it’s Unload callback was already called, I guess that ‘someone’ is holding a reference to the modules FILE_OBJECT…

Is there any way of finding out ‘who’ is holding this reference? any handle table I can browse? any tool or methodology I should use?

Any help would be appreciated…

Naddav.

Ladislav Zezula wrote:
Well, as I have experimented with (re)loading drivers, it seemed to me
always as problem to make it work. The only thing that worked was
installing the driver; any other attempts to stop, remove or reinstall the driver
sooner or later failed.

L.

—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com — Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You are currently subscribed to ntfsd as: xxxxx@yahoo.com To unsubscribe send a blank email to xxxxx@lists.osr.com

Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com