Driver Problems? Questions? Issues?
Put OSR's experience to work for you! Contact us for assistance with:
  • Creating the right design for your requirements
  • Reviewing your existing driver code
  • Analyzing driver reliability/performance issues
  • Custom training mixed with consulting and focused directly on your specific areas of interest/concern.
Check us out. OSR, the Windows driver experts.

OSR Seminars


Go Back   OSR Online Lists > ntdev
Welcome, Guest
You must login to post to this list
  Message 1 of 14  
13 Mar 18 02:40
makrurisan makkeln
xxxxxx@x-publisher.com
Join Date: 12 Jan 2018
Posts To This List: 84
saving persistent registry information for a filter driver

What is the recommend place to save persistent information for a filter driver or others? I have seen that some places are changing over restart and repair. Is this good: "\\Registry\\Machine\\System\\CurrentControlSet\\Enum\\" {Class}
  Message 2 of 14  
13 Mar 18 03:18
Tim Roberts
xxxxxx@probo.com
Join Date: 28 Jan 2005
Posts To This List: 11963
saving persistent registry information for a filter driver

On Mar 12, 2018, at 11:40 PM, xxxxx@x-publisher.com <xxxxx@lists.osr.com> wrote: > > What is the recommend place to save persistent information for a filter driver or others? > I have seen that some places are changing over restart and repair. > > Is this good: > "\\Registry\\Machine\\System\\CurrentControlSet\\Enum\\" {Class} You don't ever specify the path directly. Use WdfDeviceOpenRegistryKey to get the proper key. It depends. Is this information that is common to all instances? If so, then you'd put it in the "Services" key by using PLUGPLAY_REGKEY_DRIVER. If the information is specific to each device, then you'd put in the "Enum" key by using PLUGPLAY_REGKEY_DEVICE. ??? Tim Roberts, xxxxx@probo.com Providenza & Boekelheide, Inc.
  Message 3 of 14  
13 Mar 18 08:12
makrurisan makkeln
xxxxxx@x-publisher.com
Join Date: 12 Jan 2018
Posts To This List: 84
saving persistent registry information for a filter driver

thank you Tim, Using WdfDeviceOpenRegistryKey we get WDFKEY. Is this castable to HANDLE to use with ZwEnumerateKey?
  Message 4 of 14  
13 Mar 18 09:25
Doron Holan
xxxxxx@microsoft.com
Join Date: 08 Sep 2005
Posts To This List: 10209
saving persistent registry information for a filter driver

Wdf handles are not castable to anything else. They have Get or Retrieve functions to return the underlying properties. WdfRegistryWdmGetHandle d Bent from my phone ________________________________ From: xxxxx@lists.osr.com <xxxxx@lists.osr.com> on behalf of xxxxx@x-publisher.com <xxxxx@lists.osr.com> Sent: Tuesday, March 13, 2018 5:11:46 AM To: Windows System Software Devs Interest List Subject: RE:[ntdev] saving persistent registry information for a filter driver thank you Tim, Using WdfDeviceOpenRegistryKey we get WDFKEY. Is this castable to HANDLE to use with ZwEnumerateKey? --- NTDEV is sponsored by OSR Visit the list online at: <https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.osronline.co m%2Fshowlists.cfm%3Flist%3Dntdev&data=04%7C01%7CDoron.Holan%40microsoft.com%7C19f ecc9f5c2d4cb5c31a08d588db9c6c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636565 399158003827%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6 Ik1haWwifQ%3D%3D%7C-1&sdata=NjNCtoVPYt6oaRX9LK01ZasXd%2Be3qr%2BD5%2B36Xwe7pJA%3D& reserved=0> MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers! Details at <https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.osr.com%2Fse minars&data=04%7C01%7CDoron.Holan%40microsoft.com%7C19fecc9f5c2d4cb5c31a08d588db9 c6c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636565399158003827%7CUnknown%7CT WFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwifQ%3D%3D%7C-1&sdat a=66%2BvCVot6KAU8tHuZSB6QGGJRa9KUshqlTDb23yVyZg%3D&reserved=0> To unsubscribe, visit the List Server section of OSR Online at <https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.osronline.co m%2Fpage.cfm%3Fname%3DListServer&data=04%7C01%7CDoron.Holan%40microsoft.com%7C19f ecc9f5c2d4cb5c31a08d588db9c6c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636565 399158003827%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6 Ik1haWwifQ%3D%3D%7C-1&sdata=9k9mZhS6gjGV66Rt9S0Rgi7mAjfPimfqA%2BbdG2SU5K8%3D&rese rved=0> --
  Message 5 of 14  
13 Mar 18 12:13
makrurisan makkeln
xxxxxx@x-publisher.com
Join Date: 12 Jan 2018
Posts To This List: 84
saving persistent registry information for a filter driver

If I do the following: WdfDeviceOpenRegistryKey(device, PLUGPLAY_REGKEY_DRIVER... I see that the variable are written to: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96b-e325-11ce-bfc1-08 002be10318}\0025 What does "0025" and what does "ControlSet001" mean? @Tim: I don't see Services in the name. I am a little bit confused. I want to save some information under my filter driver and my driver class starts with "{A3E32DBA..." How can or should I do this if I shouldnt use the path directly?
  Message 6 of 14  
13 Mar 18 12:37
Don Burn
xxxxxx@windrvr.com
Join Date: 23 Feb 2011
Posts To This List: 1406
saving persistent registry information for a filter driver

There are multiple ControlSet00x one of which is pointed to by the symbolic line CurrentControlSet which is all you should ever worry about. At Tim Roberts already said: " It depends. Is this information that is common to all instances? If so, then you'd put it in the "Services" key by using PLUGPLAY_REGKEY_DRIVER. If the information is specific to each device, then you'd put in the "Enum" key by using PLUGPLAY_REGKEY_DEVICE." Under the services key, of the CurrentControlSet is a name for your drivers service, that is specified in the INX file. Under the Enum key is a key for the key for the specific class of device, and under it the specific device instance. Don Burn Windows Driver Consulting Website: http://www.windrvr.com -----Original Message----- From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@x-publisher.com Sent: Tuesday, March 13, 2018 12:13 PM To: Windows System Software Devs Interest List <xxxxx@lists.osr.com> Subject: RE:[ntdev] saving persistent registry information for a filter driver If I do the following: WdfDeviceOpenRegistryKey(device, PLUGPLAY_REGKEY_DRIVER... I see that the variable are written to: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96b-e325-11ce-bf c1-08002be10318}\0025 What does "0025" and what does "ControlSet001" mean? @Tim: I don't see Services in the name. I am a little bit confused. I want to save some information under my filter driver and my driver class starts with "{A3E32DBA..." How can or should I do this if I shouldnt use the path directly? --- NTDEV is sponsored by OSR Visit the list online at: <http://www.osronline.com/showlists.cfm?list=ntdev> MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers! Details at <http://www.osr.com/seminars> To unsubscribe, visit the List Server section of OSR Online at <http://www.osronline.com/page.cfm?name=ListServer>
  Message 7 of 14  
13 Mar 18 12:41
Tim Roberts
xxxxxx@probo.com
Join Date: 28 Jan 2005
Posts To This List: 11963
saving persistent registry information for a filter driver

xxxxx@x-publisher.com wrote: > thank you Tim, > Using WdfDeviceOpenRegistryKey we get WDFKEY. Is this castable to HANDLE to use with ZwEnumerateKey? Google would have told you this.  There are "get" and "set" functions within KMDF directly: WdfRegistryAssignXxx and WdfRegistryQueryXxx.  If you're persisting data, you don't usually need to enumerate the subkeys, but as Doron said, WdfRegisterWdmGetHandle will let you do that. -- Tim Roberts, xxxxx@probo.com Providenza & Boekelheide, Inc.
  Message 8 of 14  
13 Mar 18 12:54
Tim Roberts
xxxxxx@probo.com
Join Date: 28 Jan 2005
Posts To This List: 11963
saving persistent registry information for a filter driver

xxxxx@x-publisher.com wrote: > If I do the following: > WdfDeviceOpenRegistryKey(device, PLUGPLAY_REGKEY_DRIVER... > I see that the variable are written to: > HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96b-e325-11ce-bfc1-08 002be10318}\0025 > What does "0025" and what does "ControlSet001" mean? Windows keeps several copies of the driver/device configuration information in the registry, for recoverability purposes, called ControlSet001, ControlSet002, etc.  There is an alias called CurrentControlSet that points to the one currently active.  You don't see it much any more, but at boot time you have the option to boot to the "last known good configuration"; all that does is switch the CurrentControlSet link to the previous one.  As a coder, you will always use CurrentControlSet. {4d36e96b-e325-11ce-bfc1-08002be10318} is the ClassGuid for keyboard drivers, as you apparently specified in your INF file. The 0025 simply means that yours is the 26th keyboard driver to be enumerated on this computer.  If you go into regedit, you should be able to see the other 25 entries. > @Tim: I don't see Services in the name. Hmmm.  I thought PLUGPLAY_REGKEY_DRIVER points to the Services key.  It may be you need to open that key directly.  That would give you a key for your filter, independent of the devices you are filtering.  I presume you know the service name of your filter driver.  Note that your custom entries go in the Parameters subkey of the Services entry. > I am a little bit confused. I want to save some information under my filter driver and my driver class starts with "{A3E32DBA..." > How can or should I do this if I shouldnt use the path directly? What do you mean by "my driver class starts with {A3E32DBA..."?  Where do you see that GUID? The concept "under my filter driver" doesn't really mean anything.  There are several places in the registry where device/driver data get stored.  The Enum tree is "per device", and uses the device's hardware ID as its key.  The Control\Class tree is per driver installation, and uses the INF ClassGuid as its key.  The Services tree is "per driver", and uses the driver's service name as its key.  A filter driver is a bit like a parasite, because you are borrowing several of those locations.  The Services tree belongs strictly to the driver -- not device related -- but that means you need to be careful to make sure the information isn't specific to any one device.  Always think "what happens if I'm filtering three keyboards?" -- Tim Roberts, xxxxx@probo.com Providenza & Boekelheide, Inc.
  Message 9 of 14  
13 Mar 18 13:14
makrurisan makkeln
xxxxxx@x-publisher.com
Join Date: 12 Jan 2018
Posts To This List: 84
saving persistent registry information for a filter driver

Sorry, I want Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\"myfilterdriver" and I do WdfDeviceOpenRegistryKey(device, PLUGPLAY_REGKEY_DRIVER... but dont get the above. What is wrong?
  Message 10 of 14  
13 Mar 18 13:28
makrurisan makkeln
xxxxxx@x-publisher.com
Join Date: 12 Jan 2018
Posts To This List: 84
saving persistent registry information for a filter driver

The Driver is created with WdfDriverCreate and at this moment the RegistryPath is set to services. Should I save the RegistryPath or are a better method because PLUGPLAY_REGKEY_DRIVER from a device gives me an other hive.
  Message 11 of 14  
13 Mar 18 13:30
Tim Roberts
xxxxxx@probo.com
Join Date: 28 Jan 2005
Posts To This List: 11963
saving persistent registry information for a filter driver

xxxxx@x-publisher.com wrote: > Sorry, I want > Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\"myfilterdriver" > and I do > WdfDeviceOpenRegistryKey(device, PLUGPLAY_REGKEY_DRIVER... > but dont get the above. What is wrong? My advice was wrong.  PLUGPLAY_REGKEY_DRIVER goes to the Control\Class tree. You can use WdfDriverOpenParametersRegistryKey to get to the Services\xxx\Parameters tree. -- Tim Roberts, xxxxx@probo.com Providenza & Boekelheide, Inc.
  Message 12 of 14  
13 Mar 18 13:32
Tim Roberts
xxxxxx@probo.com
Join Date: 28 Jan 2005
Posts To This List: 11963
saving persistent registry information for a filter driver

xxxxx@x-publisher.com wrote: > The Driver is created with WdfDriverCreate and at this moment the RegistryPath is set to services. Should I save the RegistryPath or are a better method because PLUGPLAY_REGKEY_DRIVER from a device gives me an other hive. You know, it only took me 15 seconds with Google to find the answer to this, as I just posted.  Searching for "driver registry keys" took me to the article entitled "Introduction to Registry Keys for Drivers", and the first subsection describes how a KMDF driver gets to the Services key. -- Tim Roberts, xxxxx@probo.com Providenza & Boekelheide, Inc.
  Message 13 of 14  
13 Mar 18 13:44
makrurisan makkeln
xxxxxx@x-publisher.com
Join Date: 12 Jan 2018
Posts To This List: 84
saving persistent registry information for a filter driver

@Tim: Thank you for your detailed explanation. What do mean by this: "...you're persisting data, you don't usually need to enumerate the subkeys," If I save data to different subkeys like "setting 1", "setting 2" what is the way to access them?
  Message 14 of 14  
13 Mar 18 16:01
Tim Roberts
xxxxxx@probo.com
Join Date: 28 Jan 2005
Posts To This List: 11963
saving persistent registry information for a filter driver

xxxxx@x-publisher.com wrote: > @Tim: Thank you for your detailed explanation. > > What do mean by this: > "...you're persisting data, you don't usually need to enumerate the subkeys," > If I save data to different subkeys like "setting 1", "setting 2" what is the way to access them? You just open the keys by name, with WdfRegistryOpenKey.  Enumeration is only necessary if you don't know what subkeys to expect. -- Tim Roberts, xxxxx@probo.com Providenza & Boekelheide, Inc.
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntdev list to be able to post.

All times are GMT -5. The time now is 17:48.


Copyright ©2015, OSR Open Systems Resources, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license