Driver Problems? Questions? Issues?
Put OSR's experience to work for you! Contact us for assistance with:
  • Creating the right design for your requirements
  • Reviewing your existing driver code
  • Analyzing driver reliability/performance issues
  • Custom training mixed with consulting and focused directly on your specific areas of interest/concern.
Check us out. OSR, the Windows driver experts.

On-Access, Transparent, Per-File Data Encryption:

OSR's File Encryption Solution Framework (FESF) provides all the infrastructure you need to build a transparent file encryption product REALLY FAST.

Super flexible policy determination and customization, all done in user-mode. Extensive starter/sample code provided.

Proven, robust, flexible. In use in multiple commercial products.

Currently available on Windows. FESF for Linux will ship in 2018.

For more info: https://www.osr.com/fesf

Go Back   OSR Online Lists > ntfsd
Welcome, Guest
You must login to post to this list
  Message 1 of 3  
15 Mar 17 09:11
Or Ami
xxxxxx@hotmail.com
Join Date: 15 Mar 2017
Posts To This List: 1
FilterUnloadCallback

Hi, Citing from MS page "A minifilter driver's FilterUnloadCallback routine is called when the minifilter driver is unloaded. This routine closes any open communication server ports, calls FltUnregisterFilter, and performs any needed cleanup. Registering this routine is optional. However, if the minifilter driver does not register a FilterUnloadCallback routine, the minifilter driver cannot be unloaded" Link: https://msdn.microsoft.com/en-us/windows/hardware/drivers/ifs/loading-and-unloadi ng How can one unload a mini filter driver if it does not support the unload callback? One option I know is to shut down the entire filter manager. 1. What other options to I have? 2. What privileges are required? 3. Is there some way to make the filter driver robust in a way that is can not be interrupted even with admin privileges?
  Message 2 of 3  
15 Mar 17 13:29
Scott Noone
xxxxxx@osr.com
Join Date: 10 Jul 2002
Posts To This List: 951
List Moderator
FilterUnloadCallback

>How can one unload a mini filter driver if it does not support the unload >callback? Disable the filter's service and reboot. This is the only supported way. -scott OSR @OSRDrivers wrote in message news:102279@ntfsd... Hi, Citing from MS page "A minifilter driver's FilterUnloadCallback routine is called when the minifilter driver is unloaded. This routine closes any open communication server ports, calls FltUnregisterFilter, and performs any needed cleanup. Registering this routine is optional. However, if the minifilter driver does not register a FilterUnloadCallback routine, the minifilter driver cannot be unloaded" Link: https://msdn.microsoft.com/en-us/windows/hardware/drivers/ifs/loading-and-unloadi ng How can one unload a mini filter driver if it does not support the unload callback? One option I know is to shut down the entire filter manager. 1. What other options to I have? 2. What privileges are required? 3. Is there some way to make the filter driver robust in a way that is can not be interrupted even with admin privileges?
  Message 3 of 3  
16 Mar 17 07:00
Gabriel Bercea
xxxxxx@gmail.com
Join Date: 03 Mar 2008
Posts To This List: 293
FilterUnloadCallback

Shutting down the entire filter manager will disrupt the entire system because there might be many filters ( AVs, encryption ,virtualization etc...) that are built to run withing the filter manager. All the MSFT filter are based on filter manager now. By shutting down the filter manager you will for sure disrupt the normal behavior of the system. If you have admin privileges then you can do whatever you want anyway without having to stop the filter manager from working. You can simply delete the filter. The filter may support manual instance detach. So you can detach the filter from all the attached volumes. You could also mark the start type of the filter service in registry as disabled ( 4 ) this way the filter will not be loaded all together. To unload it during run-time without the unload callback is not an option. Cheers, Gabriel www.kasardia.com On Wed, Mar 15, 2017 at 6:29 PM, Scott Noone <xxxxx@osr.com> wrote: > How can one unload a mini filter driver if it does not support the unload >> callback? >> > > Disable the filter's service and reboot. This is the only supported way. > > -scott > OSR > @OSRDrivers > <...excess quoted lines suppressed...> -- Bercea. G. --
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntfsd list to be able to post.

All times are GMT -5. The time now is 10:17.


Copyright ©2015, OSR Open Systems Resources, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license