Jump-start your project by learning from devs who
write Windows drivers and file systems every day.
Take an OSR seminar!

Upcoming OSR Seminars:
WDM Lab, Seattle, WA 16 August 2010
WDF Lab, Santa Clara, CA 27 September 2010
Debug Lab, Portland, OR 18 October 2010
Windows Internals & Software Drivers Lab, Santa Clara, CA 15 November 2010


Go Back   OSR Online Lists > ntdev
Welcome, Guest
You must login to post to this list
  Message 1 of 3  
07 Mar 02 22:34
ntdev member 4165
xxxxxx@263.net
Join Date:
Posts To This List: 67
Another serious problem about TDI Filter driver

QW5vdGhlciBzZXJpb3VzIHByb2JsZW0gYWJvdXQgVERJLWZpbHRlciBkcml2ZXIuDQpXaGVuIHVz ZXJzIGFzayB0byBzdG9wIHRoZSBmaWx0ZXIgZHJpcnZlciwgSSBoYXZlIHRvIHVubG9hZCBteSBU REktRmlsdGVyIGRyaXZlci4NCkluIG15IHVubG9hZCBjb2RlLCBJIGZpcnN0IHRvIGNoZWNrIGlm IHRoZXJlIGFyZSBzdGlsbCBvdXRzdGFuZGluZyByZXF1ZXN0cyANCi5JZiBubywgSSBkZXRhY2gg bXkgZmlsdGVyIGRyaXZlciBmcm9tIFxcRGV2aWNlXFxUY3AuIEkgdGhpbmsgdGhpcw0KZmxvdyBp cyBjb3JyZWN0LiBCdXQgYWZ0ZXIgSSB1bmxvYWQgbXkgZHJpdmVyIGFuZCB0aGVyZSBhcmUgc3Rp bGwNCmFwcGxpY2F0aW9ucyBzdWNoIGZ0cC5leGUgbm90IHF1aXQsIGlmIEkgZG8gc29tZSBhY3Rp b25zIHN1Y2ggYXMgdGhlIGZ0cA0KY29tbWFuZCAnbHMnIHRoZSBzeXN0ZW0gY3Jhc2VkLiBXaHkg YW5kIGhvdyB0byBhdm9pZCB0aGlzLg0KDQpiZXN0IHJlZ2FyZHMNCnlvdXJzIGJydWNpZQ0K
  Message 2 of 3  
07 Mar 02 22:58
Thomas F. Divine
xxxxxx@hotmail.com
Join Date:
Posts To This List: 536
Re: Another serious problem about TDI Filter driver

Perhaps your TDI Filter does not attach early enough. With SoftICE loaded at boot time you can see a trace of network components being loaded. Make sure that other TDI users are loaded after your filter. The load order apparently differs between NT/W2K/XP. In any case, unloading a filter driver (of any kind) is not recommended. For sure, even components loaded after your filter may hold a reference to an object or pointer that is somehow related to your filter. Good luck, -- Thomas F. Divine PCAUSA - Tools & Resources For Network Software Developers NDIS Protocol/Intermediate/Hooking - TDI Client/Filter <http://www.pcausa.com> - <http://www.rawether.net> "brucie" <xxxxx@263.net> wrote in message news:24701@ntdev... > Another serious problem about TDI-filter driver. > When users ask to stop the filter drirver, I have to unload my TDI-Filter driver. > In my unload code, I first to check if there are still outstanding requests > .If no, I detach my filter driver from \\Device\\Tcp. I think this > flow is correct. But after I unload my driver and there are still > applications such ftp.exe not quit, if I do some actions such as the ftp > command 'ls' the system crased. Why and how to avoid this. > > best regards > yours brucie >
  Message 3 of 3  
09 Mar 02 05:10
ntdev member 8006
xxxxxx@unshadow.net
Join Date:
Posts To This List: 47
Re: Another serious problem about TDI Filter driver

> Another serious problem about TDI-filter driver. OKay. When you call IoDeleteDevice() in your Unload routine DDK documentation says that "When IoDeleteDevice is called, there cannot be any outstanding references to the device being deleted nor any attached devices. If there are, a system erorr occurs." TDIMON of SysInternals doesn't unload its filter driver even GUI is closed. If Mark Russinovich doesn't know solution maybe there's no way? But only for debug purposes I'll risk to give solution only for extremally guys. When AFD wants to send bytes he calls IoCallDriver() which calls routine DeviceObject->DriverObject->MajorFunction[n]. Where DeviceObject is yours and nonexistant! The solution is to replace MajorFunctions in your DriverObject with MajorFunctions from filtered device. /* deinitialization */ VOID OnUnload(IN PDRIVER_OBJECT DriverObject) { if (g_tcpoldobj && g_tcpfltobj) { int i; for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++) DriverObject->MajorFunction[i] = g_tcpoldobj->DriverObject->MajorFunction[i]; } if (g_tcpoldobj) IoDetachDevice(g_tcpoldobj); if (g_tcpfltobj) IoDeleteDevice(g_tcpfltobj); } But you shouldn't use this way in release version. Am I right? vlad-ntdev > When users ask to stop the filter drirver, I have to unload my TDI-Filter driver. > In my unload code, I first to check if there are still outstanding requests > .If no, I detach my filter driver from \\Device\\Tcp. I think this > flow is correct. But after I unload my driver and there are still > applications such ftp.exe not quit, if I do some actions such as the ftp > command 'ls' the system crased. Why and how to avoid this. >
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntdev list to be able to post.

All times are GMT -5. The time now is 13:54.


Copyright ©2005, OSR Open Systems Resourcs, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license