given usermode program tester.exe and kernel minifilter tester.sys and
tester.inf, and cleaning out all tester.* from c:\winnt\*, and
removing all pertinant "tester" fom the registery,
using the same compiled code on two machines, I install the usermode
program (which is a service) and the driver with:
sc create testerService binpath= c:\tester\tester.exe
rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 c:\tester
\tester.inf
sc queryex testerService
sc queryex testerDriver
and both are loaded.
Everything else I can think of being equal, upon starting the service,
one machine calls FilterAttach() successfully and one machine receives
0x80070032 from FilterAttach() !!!
What to do!?
it appears that the returned hr is encoding ERROR_NOT_SUPPORTED, so
what to do!
I can find ZERO documentation on this behavior short of my previous
and somewhat related post.
the difference being that this error is being received not on a single
attempted FilterAttach().