filter driver won't load

I have a template driver that doesn’t do anything much yet apart from WdfDriverCreate() (see below).

It is going to be a LowerFilter driver for disk class, but when I add it to the registry as a LowerFilter (along with partmgr) boot fails (0x7B boot device inaccessible). WinDbg shows that DriverEntry is never called (added dbgprint statements to confirm).

As a test, if I add it as a filter to another driver (vhdmp, for example) it loads just fine - DriverEntry and RB_EvtDeviceAdd are called, so I’m at a loss to explain what I’m doing wrong.

In the service key, Type=1, Start=0, and Group=Boot Bus Extender.

The driver signing must be okay or it wouldn’t load as a filter to vhdmp.

When I compare my driver to the keys that another disk class filter uses (eg partmgr), I can see anything much apart from that partmgr has some entries under Event keys.

Can anyone suggest what I’m doing wrong? Or what additional information I need to provide? Or how windbg can tell me about why a driver failed to even try to load?

Thanks

James

NTSTATUS
DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) {
NTSTATUS status;
WDF_DRIVER_CONFIG config;
WDFDRIVER driver;

UNREFERENCED_PARAMETER(RegistryPath);

WDF_DRIVER_CONFIG_INIT(&config, RB_EvtDeviceAdd);
status = WdfDriverCreate(DriverObject, RegistryPath, WDF_NO_OBJECT_ATTRIBUTES, &config, &driver);
if (!NT_SUCCESS(status)) {
return status;
}
return status;
}

Is the wdf runtime driver set to boot start as well?

d

Bent from my phone


From: James Harpermailto:xxxxx
Sent: ?5/?1/?2015 6:12 PM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: [ntdev] filter driver won’t load

I have a template driver that doesn’t do anything much yet apart from WdfDriverCreate() (see below).

It is going to be a LowerFilter driver for disk class, but when I add it to the registry as a LowerFilter (along with partmgr) boot fails (0x7B boot device inaccessible). WinDbg shows that DriverEntry is never called (added dbgprint statements to confirm).

As a test, if I add it as a filter to another driver (vhdmp, for example) it loads just fine - DriverEntry and RB_EvtDeviceAdd are called, so I’m at a loss to explain what I’m doing wrong.

In the service key, Type=1, Start=0, and Group=Boot Bus Extender.

The driver signing must be okay or it wouldn’t load as a filter to vhdmp.

When I compare my driver to the keys that another disk class filter uses (eg partmgr), I can see anything much apart from that partmgr has some entries under Event keys.

Can anyone suggest what I’m doing wrong? Or what additional information I need to provide? Or how windbg can tell me about why a driver failed to even try to load?

Thanks

James

NTSTATUS
DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) {
NTSTATUS status;
WDF_DRIVER_CONFIG config;
WDFDRIVER driver;

UNREFERENCED_PARAMETER(RegistryPath);

WDF_DRIVER_CONFIG_INIT(&config, RB_EvtDeviceAdd);
status = WdfDriverCreate(DriverObject, RegistryPath, WDF_NO_OBJECT_ATTRIBUTES, &config, &driver);
if (!NT_SUCCESS(status)) {
return status;
}
return status;
}


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></mailto:xxxxx>

It’s a default install of win81.

Wdf01000:
Type=1
Start=0
Group=WdfLoadGroup

ServiceGroupOrder:
System Reserved
EMS
WdfLoadGroup
Boot Bus Extender
System Bus Extender

Which appears to say that wdf01000.sys is loaded before my driver

Thanks

James

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-581903-
xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Saturday, 2 May 2015 11:41 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] filter driver won’t load

Is the wdf runtime driver set to boot start as well?

d

Bent from my phone


From: James Harper mailto:xxxxx
> Sent: ?5/?1/?2015 6:12 PM
> To: Windows System Software Devs Interest List
> mailto:xxxxx
> Subject: [ntdev] filter driver won’t load
>
>
> I have a template driver that doesn’t do anything much yet apart from
> WdfDriverCreate() (see below).
>
> It is going to be a LowerFilter driver for disk class, but when I add it to the
> registry as a LowerFilter (along with partmgr) boot fails (0x7B boot device
> inaccessible). WinDbg shows that DriverEntry is never called (added dbgprint
> statements to confirm).
>
> As a test, if I add it as a filter to another driver (vhdmp, for example) it loads
> just fine - DriverEntry and RB_EvtDeviceAdd are called, so I’m at a loss to
> explain what I’m doing wrong.
>
> In the service key, Type=1, Start=0, and Group=Boot Bus Extender.
>
> The driver signing must be okay or it wouldn’t load as a filter to vhdmp.
>
> When I compare my driver to the keys that another disk class filter uses (eg
> partmgr), I can see anything much apart from that partmgr has some entries
> under Event keys.
>
> Can anyone suggest what I’m doing wrong? Or what additional information I
> need to provide? Or how windbg can tell me about why a driver failed to
> even try to load?
>
> Thanks
>
> James
>
> NTSTATUS
> DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING
> RegistryPath) {
> NTSTATUS status;
> WDF_DRIVER_CONFIG config;
> WDFDRIVER driver;
>
> UNREFERENCED_PARAMETER(RegistryPath);
>
> WDF_DRIVER_CONFIG_INIT(&config, RB_EvtDeviceAdd);
> status = WdfDriverCreate(DriverObject, RegistryPath,
> WDF_NO_OBJECT_ATTRIBUTES, &config, &driver);
> if (!NT_SUCCESS(status)) {
> return status;
> }
> return status;
> }
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
> http:
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer</http:></mailto:xxxxx></mailto:xxxxx>

Upon closer inspection, it seems that something injected a StartOverride registry key in my Services key. Changing the override from 3 to 0 got it going again.

Frustrating.

James

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-581908-
xxxxx@lists.osr.com] On Behalf Of James Harper
Sent: Saturday, 2 May 2015 1:37 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] filter driver won’t load

It’s a default install of win81.

Wdf01000:
Type=1
Start=0
Group=WdfLoadGroup

ServiceGroupOrder:
System Reserved
EMS
WdfLoadGroup
Boot Bus Extender
System Bus Extender

Which appears to say that wdf01000.sys is loaded before my driver

Thanks

James

> -----Original Message-----
> From: xxxxx@lists.osr.com [mailto:bounce-581903-
> xxxxx@lists.osr.com] On Behalf Of Doron Holan
> Sent: Saturday, 2 May 2015 11:41 AM
> To: Windows System Software Devs Interest List
> Subject: RE: [ntdev] filter driver won’t load
>
> Is the wdf runtime driver set to boot start as well?
>
> d
>
> Bent from my phone
> ________________________________
>
> From: James Harper mailto:xxxxx
> > Sent: ?5/?1/?2015 6:12 PM
> > To: Windows System Software Devs Interest List
> > mailto:xxxxx
> > Subject: [ntdev] filter driver won’t load
> >
> >
> > I have a template driver that doesn’t do anything much yet apart from
> > WdfDriverCreate() (see below).
> >
> > It is going to be a LowerFilter driver for disk class, but when I add it to the
> > registry as a LowerFilter (along with partmgr) boot fails (0x7B boot device
> > inaccessible). WinDbg shows that DriverEntry is never called (added
> dbgprint
> > statements to confirm).
> >
> > As a test, if I add it as a filter to another driver (vhdmp, for example) it loads
> > just fine - DriverEntry and RB_EvtDeviceAdd are called, so I’m at a loss to
> > explain what I’m doing wrong.
> >
> > In the service key, Type=1, Start=0, and Group=Boot Bus Extender.
> >
> > The driver signing must be okay or it wouldn’t load as a filter to vhdmp.
> >
> > When I compare my driver to the keys that another disk class filter uses (eg
> > partmgr), I can see anything much apart from that partmgr has some
> entries
> > under Event keys.
> >
> > Can anyone suggest what I’m doing wrong? Or what additional information
> I
> > need to provide? Or how windbg can tell me about why a driver failed to
> > even try to load?
> >
> > Thanks
> >
> > James
> >
> > NTSTATUS
> > DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING
> > RegistryPath) {
> > NTSTATUS status;
> > WDF_DRIVER_CONFIG config;
> > WDFDRIVER driver;
> >
> > UNREFERENCED_PARAMETER(RegistryPath);
> >
> > WDF_DRIVER_CONFIG_INIT(&config, RB_EvtDeviceAdd);
> > status = WdfDriverCreate(DriverObject, RegistryPath,
> > WDF_NO_OBJECT_ATTRIBUTES, &config, &driver);
> > if (!NT_SUCCESS(status)) {
> > return status;
> > }
> > return status;
> > }
> >
> >
> > —
> > NTDEV is sponsored by OSR
> >
> > Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
> >
> > OSR is HIRING!! See http://www.osr.com/careers
> >
> > For our schedule of WDF, WDM, debugging and other seminars visit:
> > http://www.osr.com/seminars
> >
> > To unsubscribe, visit the List Server section of OSR Online at
> > http://www.osronline.com/page.cfm?name=ListServer
> > http:
> >
> >
> > —
> > NTDEV is sponsored by OSR
> >
> > Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
> >
> > OSR is HIRING!! See http://www.osr.com/careers
> >
> > For our schedule of WDF, WDM, debugging and other seminars visit:
> > http://www.osr.com/seminars
> >
> > To unsubscribe, visit the List Server section of OSR Online at
> > http://www.osronline.com/page.cfm?name=ListServer
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer</http:></mailto:xxxxx></mailto:xxxxx>