OSR's ntdev List: Another serious problem about TDI Filter driver

Message 1 of 3

07 Mar 02 22:34

ntdev member 4165

xxxxxx@263.net

Join Date:

Posts To This List: 67

Another serious problem about TDI Filter driver

QW5vdGhlciBzZXJpb3VzIHByb2JsZW0gYWJvdXQgVERJLWZpbHRlciBkcml2ZXIuDQpXaGVuIHVz ZXJzIGFzayB0byBzdG9wIHRoZSBmaWx0ZXIgZHJpcnZlciwgSSBoYXZlIHRvIHVubG9hZCBteSBU REktRmlsdGVyIGRyaXZlci4NCkluIG15IHVubG9hZCBjb2RlLCBJIGZpcnN0IHRvIGNoZWNrIGlm IHRoZXJlIGFyZSBzdGlsbCBvdXRzdGFuZGluZyByZXF1ZXN0cyANCi5JZiBubywgSSBkZXRhY2gg bXkgZmlsdGVyIGRyaXZlciBmcm9tIFxcRGV2aWNlXFxUY3AuIEkgdGhpbmsgdGhpcw0KZmxvdyBp cyBjb3JyZWN0LiBCdXQgYWZ0ZXIgSSB1bmxvYWQgbXkgZHJpdmVyIGFuZCB0aGVyZSBhcmUgc3Rp bGwNCmFwcGxpY2F0aW9ucyBzdWNoIGZ0cC5leGUgbm90IHF1aXQsIGlmIEkgZG8gc29tZSBhY3Rp b25zIHN1Y2ggYXMgdGhlIGZ0cA0KY29tbWFuZCAnbHMnIHRoZSBzeXN0ZW0gY3Jhc2VkLiBXaHkg YW5kIGhvdyB0byBhdm9pZCB0aGlzLg0KDQpiZXN0IHJlZ2FyZHMNCnlvdXJzIGJydWNpZQ0K

Message 2 of 3

07 Mar 02 22:58

Thomas F. Divine

xxxxxx@hotmail.com

Join Date:

Posts To This List: 536

Re: Another serious problem about TDI Filter driver

Perhaps your TDI Filter does not attach early enough. With SoftICE loaded at boot time you can see a trace of network components being loaded. Make sure that other TDI users are loaded after your filter. The load order apparently differs between NT/W2K/XP. In any case, unloading a filter driver (of any kind) is not recommended. For sure, even components loaded after your filter may hold a reference to an object or pointer that is somehow related to your filter. Good luck, -- Thomas F. Divine PCAUSA - Tools & Resources For Network Software Developers NDIS Protocol/Intermediate/Hooking - TDI Client/Filter <http://www.pcausa.com> - <http://www.rawether.net> "brucie" <xxxxx@263.net> wrote in message news:24701@ntdev... > Another serious problem about TDI-filter driver. > When users ask to stop the filter drirver, I have to unload my TDI-Filter driver. > In my unload code, I first to check if there are still outstanding requests > .If no, I detach my filter driver from \\Device\\Tcp. I think this > flow is correct. But after I unload my driver and there are still > applications such ftp.exe not quit, if I do some actions such as the ftp > command 'ls' the system crased. Why and how to avoid this. > > best regards > yours brucie >

Message 3 of 3

09 Mar 02 05:10

ntdev member 8006

xxxxxx@unshadow.net

Join Date:

Posts To This List: 47

Re: Another serious problem about TDI Filter driver

> Another serious problem about TDI-filter driver. OKay. When you call IoDeleteDevice() in your Unload routine DDK documentation says that "When IoDeleteDevice is called, there cannot be any outstanding references to the device being deleted nor any attached devices. If there are, a system erorr occurs." TDIMON of SysInternals doesn't unload its filter driver even GUI is closed. If Mark Russinovich doesn't know solution maybe there's no way? But only for debug purposes I'll risk to give solution only for extremally guys. When AFD wants to send bytes he calls IoCallDriver() which calls routine DeviceObject->DriverObject->MajorFunction[n]. Where DeviceObject is yours and nonexistant! The solution is to replace MajorFunctions in your DriverObject with MajorFunctions from filtered device. /* deinitialization */ VOID OnUnload(IN PDRIVER_OBJECT DriverObject) { if (g_tcpoldobj && g_tcpfltobj) { int i; for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++) DriverObject->MajorFunction[i] = g_tcpoldobj->DriverObject->MajorFunction[i]; } if (g_tcpoldobj) IoDetachDevice(g_tcpoldobj); if (g_tcpfltobj) IoDeleteDevice(g_tcpfltobj); } But you shouldn't use this way in release version. Am I right? vlad-ntdev > When users ask to stop the filter drirver, I have to unload my TDI-Filter driver. > In my unload code, I first to check if there are still outstanding requests > .If no, I detach my filter driver from \\Device\\Tcp. I think this > flow is correct. But after I unload my driver and there are still > applications such ftp.exe not quit, if I do some actions such as the ftp > command 'ls' the system crased. Why and how to avoid this. >

Posting Rules
You may not post new threads You may not post replies You may not post attachments	You must login to OSR Online AND be a member of the ntdev list to be able to post.

All times are GMT -5. The time now is 13:54.