Windows驱动程序：PreOperationCallback不叫

我正在尝试使用Microsoft示例（PassThough，minispy ...）创建基本的微过滤器驱动程序，但未调用MfPreOperationCallback。我尝试了不同的上下文（即使我不确定如何理解它是如何工作的......）。我试图直通例子，它工作得很好，这是非常相似，我的代码...Windows驱动程序：PreOperationCallback不叫

这是我的inf文件和我的代码：

; 
; KmdfMiniFilter.inf 
; 

[Version] 
Signature = "$WINDOWS NT$" 
Class  = "ActivityMonitor" 
ClassGuid = {b86dff51-a31e-4bac-b3cf-e8cfe75c9fc2} 
Provider = %ProviderString% 
DriverVer = 02/09/2017,1.0.0.0 
CatalogFile = KmdfMiniFilter.cat 

[DestinationDirs] 
DefaultDestDir = 12 
KmdfMiniFilter.DriverFiles = 12 

[DefaultInstall] 
OptionDesc = %ServiceDescription% 
CopyFiles = KmdfMiniFilter.DriverFiles 

[DefaultInstall.Services] 
AddService = %ServiceName%,,KmdfMiniFilter.Service 

[DefaultUninstall] 
DelFiles = KmdfMiniFilter.DriverFiles 

[DefaultUninstall.Services] 
DelService = %ServiceName%,0x200 

[KmdfMiniFilter.Service] 
DisplayName = %ServiceName% 
Description = %ServiceDescription% 
ServiceBinary = %12%\%DriverName%.sys 
Dependencies = "FltMgr" 
ServiceType = 2 ; SERVICE_FILE_SYSTEM_DRIVER 
StartType  = 3 ; SERVICE_DEMAND_START 
ErrorControl = 1 ; SERVICE_ERROR_NORMAL 
LoadOrderGroup = "FSFilter Activity Monitor" 
AddReg   = KmdfMiniFilter.AddRegistry 

[KmdfMiniFilter.AddRegistry] 
HKR,,"DebugFlags",0x00010001 ,0x0 
HKR,,"SupportedFeatures",0x00010001,0x3 
HKR,"Instances","DefaultInstance",0x00000000,%DefaultInstance% 
HKR,"Instances\"%Instance1.Name%,"Altitude",0x00000000,%Instance1.Altitude% 
HKR,"Instances\"%Instance1.Name%,"Flags",0x00010001,%Instance1.Flags% 

[KmdfMiniFilter.DriverFiles] 
%DriverName%.sys 

[SourceDisksFiles] 
KmdfMiniFilter.sys = 1,, 

[SourceDisksNames] 
1 = %DiskId1%,,, 

[Strings] 
ProviderString  = "GUIDONO" 
ServiceDescription = "KmdfMiniFilter mini-filter driver" 
ServiceName  = "KmdfMiniFilter" 
DriverName   = "KmdfMiniFilter" 
DiskId1   = "File Change Monitoring Device Installation Disk" 

DefaultInstance = "KmdfMiniFilter Instance" 
Instance1.Name  = "KmdfMiniFilter Middle Instance" 
Instance1.Altitude = "370000" 
Instance1.Flags = 0x1 ; Suppress automatic attachments

Registration.c

/** 
    Filter registration information 
*/ 

#pragma once 

#include <fltKernel.h> 

#include "MiniFilter.h" 

// Callbacks : list of FLT_OPERATION_REGISTRATION structures, one for each type of I/O for which the minifilter 
//    registers preoperation and postoperation callback routines. 
//    The last element must be IRP_MJ_OPERATION_END 


CONST FLT_OPERATION_REGISTRATION Callbacks[] = 
{ 
    { 
     IRP_MJ_CREATE, 
     0, 
     MfPreOperationCallback, 
     MfPostOperationCallback 
    }, 
    { IRP_MJ_OPERATION_END } 
}; 


// Defines the minifilter context structure 

typedef struct _MINIFILTER_TRANSACTION_CONTEXT { 
    ULONG Flags; 
    ULONG Count; 
} MINIFILTER_TRANSACTION_CONTEXT, *PMINIFILTER_CONTEXT; 

// Contexts : a context structure is used to register context types 
const FLT_CONTEXT_REGISTRATION Contexts[] = 
{ 
    { 
     FLT_TRANSACTION_CONTEXT,     // Context type 
     0,           // Flags 
     MfDeleteTxfContext,       // ContextCleanupCallback 
     sizeof(MINIFILTER_TRANSACTION_CONTEXT),  // Size 
     'ypsM'          // PoolTag 
    }, 

    { 
     FLT_CONTEXT_END 
    } 
}; 

// This defines what we want to filter with FltMgr 

CONST FLT_REGISTRATION FilterRegistration = 
{ 
    sizeof(FLT_REGISTRATION),    // Size 
    FLT_REGISTRATION_VERSION,    // Version 
    0, // Flags 
    Contexts,        // Contexts 
    Callbacks,        // Callbacks 
    MfUnload,        // FilterUnload 
    MfInstanceSetup,         // InstanceSetup 
    MfInstanceQueryTeardown,      // InstanceQueryTeardown 
    MfInstanceTeardownStart,         // InstanceTeardownStart 
    MfInstanceTeardownComplete,         // InstanceTeardownComplete 
    NULL,         // GenerateFileName 
    NULL,         // GenerateDestinationFileName 
    NULL,         // NormalizeNameComponent 
};

Driver.c

#include <ntifs.h> 
#include <wdf.h> 

#include "RegistrationData.h" 
#include "MiniFilter.h" 

// Global data 
MINIFILTER_DATA MfData; 

DRIVER_INITIALIZE DriverEntry; 

NTSTATUS DriverEntry(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath) 
{ 
    UNREFERENCED_PARAMETER(RegistryPath); 
    //DbgSetDebugFilterState(DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, TRUE); 

    NTSTATUS status; 

    MfData.Driver = DriverObject; 

    // Registering the minifilter driver 
    status = FltRegisterFilter(DriverObject, &FilterRegistration, &MfData.Filter); 

    KdPrint(("MINIFILTER INIT\n")); 

    if (!NT_SUCCESS(status)) { 
     KdPrint(("MINIFILTER ERROR : FltRegisterFilter failed. Code 0x%x\n", status)); 
     return STATUS_UNSUCCESSFUL; 
    } 

    status = FltStartFiltering(MfData.Filter); 

    if (!NT_SUCCESS(status)) { 
     KdPrint(("MINIFILTER ERROR : FltStartFiltering faild. Code 0x%x\n", status)); 
     FltUnregisterFilter(MfData.Filter); 
     return STATUS_UNSUCCESSFUL; 
    } 

    KdPrint(("MINIFILTER is Filtering!\n")); 

    return status; 
} 

NTSTATUS MfUnload(_In_ FLT_FILTER_UNLOAD_FLAGS Flags) 
{ 
    UNREFERENCED_PARAMETER(Flags); 

    PAGED_CODE(); 

    KdPrint(("MINIFILTER UNLOAD\n")); 

    FltUnregisterFilter(MfData.Filter); 

    return STATUS_SUCCESS; 
} 

NTSTATUS MfQueryTearDown(_In_ PCFLT_RELATED_OBJECTS FltObjects, _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags) 
{ 
    UNREFERENCED_PARAMETER(FltObjects); 
    UNREFERENCED_PARAMETER(Flags); 

    PAGED_CODE(); 

    return STATUS_SUCCESS; 
}

MiniFilter.h

#pragma once 

#include <fltKernel.h> 

typedef struct MINIFILTER_DATA { 
    PDRIVER_OBJECT Driver; 
    PFLT_FILTER Filter; 
} MINIFILTER_DATA; 

FLT_PREOP_CALLBACK_STATUS MfPreOperationCallback(
    _Inout_ PFLT_CALLBACK_DATA Data, 
    _In_ PCFLT_RELATED_OBJECTS FltObjects, 
    _Flt_CompletionContext_Outptr_ PVOID *CompletionContext 
); 

FLT_POSTOP_CALLBACK_STATUS MfPostOperationCallback(
    _Inout_ PFLT_CALLBACK_DATA Data, 
    _In_ PCFLT_RELATED_OBJECTS FltObjects, 
    _In_ PVOID CompletionContext, 
    _In_ FLT_POST_OPERATION_FLAGS Flags 
); 

NTSTATUS MfInstanceSetup(
    _In_ PCFLT_RELATED_OBJECTS FltObjects, 
    _In_ FLT_INSTANCE_SETUP_FLAGS Flags, 
    _In_ DEVICE_TYPE VolumeDeviceType, 
    _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType 
); 

NTSTATUS MfInstanceQueryTeardown (
    _In_ PCFLT_RELATED_OBJECTS FltObjects, 
    _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags 
); 

VOID MfInstanceTeardownStart (
    _In_ PCFLT_RELATED_OBJECTS FltObjects, 
    _In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags 
); 

VOID MfInstanceTeardownComplete (
    _In_ PCFLT_RELATED_OBJECTS FltObjects, 
    _In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags 
); 

VOID MfDeleteTxfContext(
    _Inout_ PFLT_CONTEXT Context, 
    _In_ FLT_CONTEXT_TYPE ContextType 
); 

NTSTATUS MfUnload(
    _In_ FLT_FILTER_UNLOAD_FLAGS Flags 
); 

NTSTATUS MfQueryTearDown(
    _In_ PCFLT_RELATED_OBJECTS FltObjects, 
    _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags 
); 

NTSTATUS MfInstanceQueryTeardown(
    _In_ PCFLT_RELATED_OBJECTS FltObjects, 
    _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags 
);

MiniFilter.c

#include "MiniFilter.h" 

FLT_PREOP_CALLBACK_STATUS MfPreOperationCallback(
    _Inout_ PFLT_CALLBACK_DATA Data, 
    _In_ PCFLT_RELATED_OBJECTS FltObjects, 
    _Flt_CompletionContext_Outptr_ PVOID *CompletionContext 
) 
{ 
    UNREFERENCED_PARAMETER(Data); 
    UNREFERENCED_PARAMETER(FltObjects); 
    UNREFERENCED_PARAMETER(CompletionContext); 

    KdPrint(("MINIFILTER PreOperationCallback\n")); 

    return FLT_PREOP_SUCCESS_WITH_CALLBACK; 
} 

FLT_POSTOP_CALLBACK_STATUS MfPostOperationCallback(
    _Inout_ PFLT_CALLBACK_DATA Data, 
    _In_ PCFLT_RELATED_OBJECTS FltObjects, 
    _In_ PVOID CompletionContext, 
    _In_ FLT_POST_OPERATION_FLAGS Flags 
) 
{ 
    UNREFERENCED_PARAMETER(Data); 
    UNREFERENCED_PARAMETER(FltObjects); 
    UNREFERENCED_PARAMETER(CompletionContext); 
    UNREFERENCED_PARAMETER(Flags); 

    KdPrint(("MINIFILTER PostOperationCallback\n")); 

    return FLT_POSTOP_FINISHED_PROCESSING; 
} 



VOID MfDeleteTxfContext(
    _Inout_ PFLT_CONTEXT Context, 
    _In_ FLT_CONTEXT_TYPE ContextType 
) 
{ 
    UNREFERENCED_PARAMETER(Context); 
    UNREFERENCED_PARAMETER(ContextType); 

    KdPrint(("MINIFILTER DeleteTxfContext\n")); 
} 

NTSTATUS 
MfInstanceSetup (
    _In_ PCFLT_RELATED_OBJECTS FltObjects, 
    _In_ FLT_INSTANCE_SETUP_FLAGS Flags, 
    _In_ DEVICE_TYPE VolumeDeviceType, 
    _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType 
    ) 
{ 
    UNREFERENCED_PARAMETER(FltObjects); 
    UNREFERENCED_PARAMETER(Flags); 
    UNREFERENCED_PARAMETER(VolumeDeviceType); 
    UNREFERENCED_PARAMETER(VolumeFilesystemType); 

    PAGED_CODE(); 

    KdPrint(("PassThrough!PtInstanceSetup: Entered\n")); 

    return STATUS_SUCCESS; 
} 


NTSTATUS 
MfInstanceQueryTeardown (
    _In_ PCFLT_RELATED_OBJECTS FltObjects, 
    _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags 
    ) 
{ 
    UNREFERENCED_PARAMETER(FltObjects); 
    UNREFERENCED_PARAMETER(Flags); 

    PAGED_CODE(); 

    KdPrint(("PassThrough!PtInstanceQueryTeardown: Entered\n")); 

    return STATUS_SUCCESS; 
} 


VOID 
MfInstanceTeardownStart (
    _In_ PCFLT_RELATED_OBJECTS FltObjects, 
    _In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags 
    ) 
{ 
    UNREFERENCED_PARAMETER(FltObjects); 
    UNREFERENCED_PARAMETER(Flags); 

    PAGED_CODE(); 

    KdPrint(("PassThrough!PtInstanceTeardownStart: Entered\n")); 
} 


VOID 
MfInstanceTeardownComplete (
    _In_ PCFLT_RELATED_OBJECTS FltObjects, 
    _In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags 
    ) 
{ 
    UNREFERENCED_PARAMETER(FltObjects); 
    UNREFERENCED_PARAMETER(Flags); 

    PAGED_CODE(); 

    KdPrint(("PassThrough!PtInstanceTeardownComplete: Entered\n")); 
}

有谁看到这是怎么回事？

来源

2017-02-24 guidono

你的驱动加载？ FltRegisterFilter可以吗？哪里错误？ '有人看到发生了什么事 - 但你呢？你看到了吗？试着看？ – RbMm

我没有错误，是的，我的过滤器被加载，我没有得到一个关于startfiltering函数的错误代码，所以我想它正在过滤......但是kdprint没有在我的预操作函数中调用，所以我想这个函数回调没有被调用...（我通过创建一个文件来测试我的驱动程序，PassThrough示例对此事件作出反应，但不是我的过滤器！） – guidono

MfInstanceSetup被调用？什么Windows版本？ – RbMm

我解决了我的问题：我在我的inf文件中有错误的标志。好的一个是0x0标志，以便将微滤器自动连接到不同的卷上。

Instance1.Flags = 0x1 ; Suppress automatic attachments

到

Instance1.Flags = 0x0 ; Automatic attachments

来源

2017-02-25 11:01:20 guidono

Windows驱动程序：PreOperationCallback不叫

回答

相关问题