Hello,

I am wondering if there is an easy way to install a lower filter
driver. I would like to implement the functionality myself. I looked
through the source code of DevCon in the windows DDK, but I was a bit
confused about the concept of MSG's that the code uses.

I would like to be able to install the Lower Filter driver as well as
delete it. Also, I am wondering if using a .inf file is required?
Someone mentioned to me that it is required so that the OS knows where
to hook it up in the device stack. I have the binary, and I would
prefer not to use the inf, but if I have no choice, than i guess it's
okay.

A while back, I had to install an upper filter driver, and that was
relatively easy. I just used the service control manager and called
OpenService, CreateService etc. Is there something similar to this?

Thank you in advance for your help.

Re: Installing a lower filter driver by anton

anton
Mon Sep 11 21:47:47 CDT 2006

Hi mate

Shortly speaking, you can install your driver without .inf file if and
only if it does not deal with hardware and PNP. Once lower-level
filters normally reside below class drivers, you need an .inf file in
order to install one

Anton Bassov

Jon wrote:
> Hello,
>
> I am wondering if there is an easy way to install a lower filter
> driver. I would like to implement the functionality myself. I looked
> through the source code of DevCon in the windows DDK, but I was a bit
> confused about the concept of MSG's that the code uses.
>
> I would like to be able to install the Lower Filter driver as well as
> delete it. Also, I am wondering if using a .inf file is required?
> Someone mentioned to me that it is required so that the OS knows where
> to hook it up in the device stack. I have the binary, and I would
> prefer not to use the inf, but if I have no choice, than i guess it's
> okay.
>
> A while back, I had to install an upper filter driver, and that was
> relatively easy. I just used the service control manager and called
> OpenService, CreateService etc. Is there something similar to this?
>
> Thank you in advance for your help.


Re: Installing a lower filter driver by sleeper

sleeper
Mon Sep 11 22:29:35 CDT 2006

Thanks for the help. I think i figured out how "devcon" works in the
windows DDK, but when I add the code into my project, it tells me that
it is unable to resolve the reference for

__imp__SetupDiDestroyDeviceInfoList@4
__imp__SetupDiCallClassInstaller@12
__imp__SetupDiSetDeviceRegistryPropertyW@20
__imp__SetupDiCreateDeviceInfoW@28
__imp__SetupDiCreateDeviceInfoList@8
__imp__SetupDiGetINFClassW@20

I linked my project against SetupAPI.lib which I found in my Platform
SDK, and can't resolve it. I did this by going to Project
Properties->Linker->General->Additional Library Directories, and then I
added the path.

any other ideas?

thanks


Re: Installing a lower filter driver by anton

anton
Tue Sep 12 00:27:43 CDT 2006

> I linked my project against SetupAPI.lib which I found in my Platform
> SDK, and can't resolve it. I did this by going to Project
> Properties->Linker->General->Additional Library Directories, and then I
> added the path.
>
> any other ideas?

Put the name of the library to Project->Settings->Link->Object/Library
modules, plus make sure the library is in the right location......

Anton Bassov

sleeper wrote:
> Thanks for the help. I think i figured out how "devcon" works in the
> windows DDK, but when I add the code into my project, it tells me that
> it is unable to resolve the reference for
>
> __imp__SetupDiDestroyDeviceInfoList@4
> __imp__SetupDiCallClassInstaller@12
> __imp__SetupDiSetDeviceRegistryPropertyW@20
> __imp__SetupDiCreateDeviceInfoW@28
> __imp__SetupDiCreateDeviceInfoList@8
> __imp__SetupDiGetINFClassW@20
>
> I linked my project against SetupAPI.lib which I found in my Platform
> SDK, and can't resolve it. I did this by going to Project
> Properties->Linker->General->Additional Library Directories, and then I
> added the path.
>
> any other ideas?
>
> thanks


Re: Installing a lower filter driver by Maxim

Maxim
Tue Sep 12 09:56:15 CDT 2006

Try just adding your filter to the class's LowerFilters REG_MULTI_SZ value.
If there is no such value - create one.
Reboot or at least the stacks start/stop (of all stacks of this class) is
required.

--

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

"Jon" <TheFakeJon@gmail.com> wrote in message
news:1158027085.640542.195390@b28g2000cwb.googlegroups.com...
> Hello,
>
> I am wondering if there is an easy way to install a lower filter
> driver. I would like to implement the functionality myself. I looked
> through the source code of DevCon in the windows DDK, but I was a bit
> confused about the concept of MSG's that the code uses.
>
> I would like to be able to install the Lower Filter driver as well as
> delete it. Also, I am wondering if using a .inf file is required?
> Someone mentioned to me that it is required so that the OS knows where
> to hook it up in the device stack. I have the binary, and I would
> prefer not to use the inf, but if I have no choice, than i guess it's
> okay.
>
> A while back, I had to install an upper filter driver, and that was
> relatively easy. I just used the service control manager and called
> OpenService, CreateService etc. Is there something similar to this?
>
> Thank you in advance for your help.
>


Re: Installing a lower filter driver by anton

anton
Tue Sep 12 13:56:19 CDT 2006

Maxim,

I am afraid this is not the best option in our situation......

It is obvious that the OP is a newbie - even simple tasks(i.e. linking
to the library) are quite problematic for him. Therefore, if he starts
editing the registry manually, he is more than likely to screw up his
system. The best solution in his situation is applying step-by-step
modifications to some existing .inf file, and installing and
uninstalling it, so that he will eventually learn how .inf files work
and what info they add to the registry

Anton Bassov


Maxim S. Shatskih wrote:
> Try just adding your filter to the class's LowerFilters REG_MULTI_SZ value.
> If there is no such value - create one.
> Reboot or at least the stacks start/stop (of all stacks of this class) is
> required.
>
> --
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> maxim@storagecraft.com
> http://www.storagecraft.com
>
> "Jon" <TheFakeJon@gmail.com> wrote in message
> news:1158027085.640542.195390@b28g2000cwb.googlegroups.com...
> > Hello,
> >
> > I am wondering if there is an easy way to install a lower filter
> > driver. I would like to implement the functionality myself. I looked
> > through the source code of DevCon in the windows DDK, but I was a bit
> > confused about the concept of MSG's that the code uses.
> >
> > I would like to be able to install the Lower Filter driver as well as
> > delete it. Also, I am wondering if using a .inf file is required?
> > Someone mentioned to me that it is required so that the OS knows where
> > to hook it up in the device stack. I have the binary, and I would
> > prefer not to use the inf, but if I have no choice, than i guess it's
> > okay.
> >
> > A while back, I had to install an upper filter driver, and that was
> > relatively easy. I just used the service control manager and called
> > OpenService, CreateService etc. Is there something similar to this?
> >
> > Thank you in advance for your help.
> >


Re: Installing a lower filter driver by sleeper

sleeper
Tue Sep 12 14:01:45 CDT 2006

Thanks Anton... I think

:)


Re: Installing a lower filter driver by Abhishek

Abhishek
Tue Sep 12 14:19:14 CDT 2006

Is it a class filter driver or a device filter driver? Meaning, would you
like the filter driver to load on the device stacks of all devices belonging
to a certain device setup class or would you like it to load on a the device
stack of only a specific device?
The DIFx API supports install and uninstall of class filter drivers, but not
device filter drivers. So if it is a class filter driver, I would recommend
using the DIFx API. It comes with the WDK. And you can also download it
from - http://www.microsoft.com/whdc/driver/install/DIFxtls.mspx


"Jon" <TheFakeJon@gmail.com> wrote in message
news:1158027085.640542.195390@b28g2000cwb.googlegroups.com...
> Hello,
>
> I am wondering if there is an easy way to install a lower filter
> driver. I would like to implement the functionality myself. I looked
> through the source code of DevCon in the windows DDK, but I was a bit
> confused about the concept of MSG's that the code uses.
>
> I would like to be able to install the Lower Filter driver as well as
> delete it. Also, I am wondering if using a .inf file is required?
> Someone mentioned to me that it is required so that the OS knows where
> to hook it up in the device stack. I have the binary, and I would
> prefer not to use the inf, but if I have no choice, than i guess it's
> okay.
>
> A while back, I had to install an upper filter driver, and that was
> relatively easy. I just used the service control manager and called
> OpenService, CreateService etc. Is there something similar to this?
>
> Thank you in advance for your help.
>



Re: Installing a lower filter driver by sleeper

sleeper
Tue Sep 12 14:51:50 CDT 2006

Hi again, actually the lower filter driver is a keyboard lower filter
driver. I was thinking about just using the sample code in "devcon"
in the windows DDK. That seems to be the easiest.


Re: Installing a lower filter driver by Jon

Jon
Tue Sep 12 16:56:00 CDT 2006

I have another small question that I was hoping someone could answer. I
was wondering if the kbfiltr driver provided with the windows DDK is a
lower filter driver? I thought the definition of whether it is an
upper or lower filter driver is based on where it attaches to the
stack. Since the kbfiltr driver in the windows ddk attaches to the
i8042 driver, I assumed this is a lower filter driver? I wrote an upper
filter driver not too long ago and it attaches to the keyboard class
device driver. Is this correct reasoning?

Thank you in advance for all the help!!


Re: Installing a lower filter driver by anton

anton
Tue Sep 12 18:00:15 CDT 2006


Jon,


> was wondering if the kbfiltr driver provided with the windows DDK is a
> lower filter driver?

Indeed, it is...

>thought the definition of whether it is an
> upper or lower filter driver is based on where it attaches to the
> stack.

Again, this is true - terms'Lower-level" and "upper-level" describe the
position of a filter driver in relation to the class driver. Once
kbdfilter is below kbdclass driver on the stack, it is lower-level
filter driver

Anton Bassov

Jon wrote:
> I have another small question that I was hoping someone could answer. I
> was wondering if the kbfiltr driver provided with the windows DDK is a
> lower filter driver? I thought the definition of whether it is an
> upper or lower filter driver is based on where it attaches to the
> stack. Since the kbfiltr driver in the windows ddk attaches to the
> i8042 driver, I assumed this is a lower filter driver? I wrote an upper
> filter driver not too long ago and it attaches to the keyboard class
> device driver. Is this correct reasoning?
>
> Thank you in advance for all the help!!


Re: Installing a lower filter driver by Don

Don
Tue Sep 12 18:14:57 CDT 2006


"anton bassov" <soviet_bloke@hotmail.com> wrote in message
>
> Again, this is true - terms'Lower-level" and "upper-level" describe the
> position of a filter driver in relation to the class driver. Once
> kbdfilter is below kbdclass driver on the stack, it is lower-level
> filter driver

The above is really stretching the definitions most documentation uses. A
lower filter is a filter below the driver, that modifies actions of the
driver, typically as it heads to the hardware. An upper filter is a filter
above the driver modifying requests (and the requests results) to the
driver.

Note: some drivers attach to more than one stack or class, so a class filter
only filters for the one class, but a lower filter on the device driver
filters all the classes the driver is on. For any given stack you can find

upper filter for driver 1
driver 1
lower filter for driver 1
upper filter for driver 2
driver 2
lower filter for driver 2

There is a difference but it is a subtle one.



--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
http://www.windrvr.com
Remove StopSpam from the email to reply




Re: Installing a lower filter driver by Jon

Jon
Tue Sep 12 18:22:01 CDT 2006

Thank you guys both. This makes much more sense now.

-Jon


Re: Installing a lower filter driver by soviet_bloke

soviet_bloke
Tue Sep 12 20:04:43 CDT 2006

Don,

> lower filter is a filter below the driver, that modifies actions of the
> driver, typically as it heads to the hardware. An upper filter is a filter
> above the driver modifying requests (and the requests results) to the
> driver.

Assuming a standard port-miniport-class architecture, what is "driver"
in your definition???? Apparently, it is not port, because port driver
is the one that actually deals with the controller, so that there is no
need to modify its actions, although you may want to modify requests
(and the requests results) that it receives. Apparently, it is not
miniport either, because the very idea of miniport driver is to
customize interactions between the class and port drivers, so that it
does not really matter if your filter driver is below or above miniport
driver - in any case, it will be able to have both functionalities that
you have mentioned. Therefore, the only driver that left is class
driver, and your driver's functionality depends whether it is above or
below the class driver - it cannot have them both

Anton Bassov



Don Burn wrote:
> "anton bassov" <soviet_bloke@hotmail.com> wrote in message
> >
> > Again, this is true - terms'Lower-level" and "upper-level" describe the
> > position of a filter driver in relation to the class driver. Once
> > kbdfilter is below kbdclass driver on the stack, it is lower-level
> > filter driver
>
> The above is really stretching the definitions most documentation uses. A
> lower filter is a filter below the driver, that modifies actions of the
> driver, typically as it heads to the hardware. An upper filter is a filter
> above the driver modifying requests (and the requests results) to the
> driver.
>
> Note: some drivers attach to more than one stack or class, so a class filter
> only filters for the one class, but a lower filter on the device driver
> filters all the classes the driver is on. For any given stack you can find
>
> upper filter for driver 1
> driver 1
> lower filter for driver 1
> upper filter for driver 2
> driver 2
> lower filter for driver 2
>
> There is a difference but it is a subtle one.
>
>
>
> --
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> http://www.windrvr.com
> Remove StopSpam from the email to reply


Re: Installing a lower filter driver by Slava

Slava
Tue Sep 12 20:45:14 CDT 2006

<soviet_bloke@hotmail.com> wrote in message
news:1158109483.114477.49020@i42g2000cwa.googlegroups.com...

> Assuming a standard port-miniport-class architecture

Which one of these three is ftdisk.sys? Or usbstor.sys?

S



Re: Installing a lower filter driver by soviet_bloke

soviet_bloke
Tue Sep 12 22:20:26 CDT 2006


> > Assuming a standard port-miniport-class architecture
>
> Which one of these three is ftdisk.sys? Or usbstor.sys?

It is understandable that above mentioned architecture applies only to
drivers that deal with hardware devices. However, FtDisk.sys deals with
logical volumes on basic disks, so that I don't really understand why
Slava M.Usov mentioned FtDisk.sys here.

Anyway, if Slava M.Usov is desperate to classify FtDisk.sys somehow
...... then I have to inform him that Russinovich and Solomon
classified it as a bus driver, responsible for enumerating basic disks
in order to detect basic volumes and report them to PnP Manager
("Windows Internals", Fourth Edition, page 626).


Usbstor.sys is a class driver - it manages devices of USB Storage
Class
(http://www.microsoft.com/whdc/device/storage/usbfaq.mspx).

Therefore, if filter device gets attached to it, it is both upper-level
filter (as far as USB Storage Class driver, i.e. Usbstor.sys, is
concerned) and lower-level one (as far as Disk Class driver, i.e.
Disk.sys, is concerned)

Anton Bassov



Slava M. Usov wrote:
> <soviet_bloke@hotmail.com> wrote in message
> news:1158109483.114477.49020@i42g2000cwa.googlegroups.com...
>
> > Assuming a standard port-miniport-class architecture
>
> Which one of these three is ftdisk.sys? Or usbstor.sys?
>
> S


Re: Installing a lower filter driver by Doron

Doron
Tue Sep 12 23:40:22 CDT 2006

usbstor is a driver which implements a class specification, it is not the
same as a class filter. usbstor is an FDO

d

--
Please do not send e-mail directly to this alias. this alias is for
newsgroup purposes only.
This posting is provided "AS IS" with no warranties, and confers no rights.


<soviet_bloke@hotmail.com> wrote in message
news:1158117626.777550.263680@i3g2000cwc.googlegroups.com...
>
>> > Assuming a standard port-miniport-class architecture
>>
>> Which one of these three is ftdisk.sys? Or usbstor.sys?
>
> It is understandable that above mentioned architecture applies only to
> drivers that deal with hardware devices. However, FtDisk.sys deals with
> logical volumes on basic disks, so that I don't really understand why
> Slava M.Usov mentioned FtDisk.sys here.
>
> Anyway, if Slava M.Usov is desperate to classify FtDisk.sys somehow
> ...... then I have to inform him that Russinovich and Solomon
> classified it as a bus driver, responsible for enumerating basic disks
> in order to detect basic volumes and report them to PnP Manager
> ("Windows Internals", Fourth Edition, page 626).
>
>
> Usbstor.sys is a class driver - it manages devices of USB Storage
> Class
> (http://www.microsoft.com/whdc/device/storage/usbfaq.mspx).
>
> Therefore, if filter device gets attached to it, it is both upper-level
> filter (as far as USB Storage Class driver, i.e. Usbstor.sys, is
> concerned) and lower-level one (as far as Disk Class driver, i.e.
> Disk.sys, is concerned)
>
> Anton Bassov
>
>
>
> Slava M. Usov wrote:
>> <soviet_bloke@hotmail.com> wrote in message
>> news:1158109483.114477.49020@i42g2000cwa.googlegroups.com...
>>
>> > Assuming a standard port-miniport-class architecture
>>
>> Which one of these three is ftdisk.sys? Or usbstor.sys?
>>
>> S
>



Re: Installing a lower filter driver by anton

anton
Wed Sep 13 00:42:48 CDT 2006

Doron,

> usbstor is a driver which implements a class specification, it is not the
> same as a class filter. usbstor is an FDO

FDO is a device object that has been created by a function driver,
right? Now let's look at how MSDN defines the term 'function driver',
and how it uses the term 'class driver' in this definition - here is
the excerpt from
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dndevio/html/plugnplay.asp:


//////////////////
A function driver is the main device driver and provides the
operational interface for its device. It is a required driver unless
the device is used raw (an implementation in which I/O is done by the
bus driver and any bus filter drivers). The function driver for a
device is typically implemented as a driver/minidriver pair. In such
driver pairs, a class driver (usually written by Microsoft) provides
the functionality required by all devices of that type, and a
minidriver (usually written by the device vendor) provides
device-specific functionality. The Plug and Play Manager loads one
function driver for each device.
//////////////////



Therefore, according to MSDN, a function driver is "driver/minidriver
pair", where "driver" is MSFT-provided class driver. Once Usbstor.sys
is FDO, is it a mistake to refer to it with the term"class
driver"??????


Anton Bassov



Doron Holan [MS] wrote:
> usbstor is a driver which implements a class specification, it is not the
> same as a class filter. usbstor is an FDO
>
> d
>
> --
> Please do not send e-mail directly to this alias. this alias is for
> newsgroup purposes only.
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
>
> <soviet_bloke@hotmail.com> wrote in message
> news:1158117626.777550.263680@i3g2000cwc.googlegroups.com...
> >
> >> > Assuming a standard port-miniport-class architecture
> >>
> >> Which one of these three is ftdisk.sys? Or usbstor.sys?
> >
> > It is understandable that above mentioned architecture applies only to
> > drivers that deal with hardware devices. However, FtDisk.sys deals with
> > logical volumes on basic disks, so that I don't really understand why
> > Slava M.Usov mentioned FtDisk.sys here.
> >
> > Anyway, if Slava M.Usov is desperate to classify FtDisk.sys somehow
> > ...... then I have to inform him that Russinovich and Solomon
> > classified it as a bus driver, responsible for enumerating basic disks
> > in order to detect basic volumes and report them to PnP Manager
> > ("Windows Internals", Fourth Edition, page 626).
> >
> >
> > Usbstor.sys is a class driver - it manages devices of USB Storage
> > Class
> > (http://www.microsoft.com/whdc/device/storage/usbfaq.mspx).
> >
> > Therefore, if filter device gets attached to it, it is both upper-level
> > filter (as far as USB Storage Class driver, i.e. Usbstor.sys, is
> > concerned) and lower-level one (as far as Disk Class driver, i.e.
> > Disk.sys, is concerned)
> >
> > Anton Bassov
> >
> >
> >
> > Slava M. Usov wrote:
> >> <soviet_bloke@hotmail.com> wrote in message
> >> news:1158109483.114477.49020@i42g2000cwa.googlegroups.com...
> >>
> >> > Assuming a standard port-miniport-class architecture
> >>
> >> Which one of these three is ftdisk.sys? Or usbstor.sys?
> >>
> >> S
> >


Re: Installing a lower filter driver by Doron

Doron
Wed Sep 13 01:16:10 CDT 2006

see my other post. you taking the docs a bit too literally. there are class
filter drivers which are loaded by reg values in the class key. then there
is the FDO for the stack. The FDO for the stack can be a class driver,
where class is an industry spec so that one driver can control devices from
many vendors. hidusb, usbccid, usbstor, bthusb are all examples of USB
class drivers which are FDOs for their stack. in the end, it is nomenclature
for how to build the stack and who the default power policy owner is. once
the stack is loaded, the naming of the role is not very relevant and the OS
doesn't care.

d

--
Please do not send e-mail directly to this alias. this alias is for
newsgroup purposes only.
This posting is provided "AS IS" with no warranties, and confers no rights.


"anton bassov" <soviet_bloke@hotmail.com> wrote in message
news:1158126168.611046.210240@b28g2000cwb.googlegroups.com...
> Doron,
>
>> usbstor is a driver which implements a class specification, it is not the
>> same as a class filter. usbstor is an FDO
>
> FDO is a device object that has been created by a function driver,
> right? Now let's look at how MSDN defines the term 'function driver',
> and how it uses the term 'class driver' in this definition - here is
> the excerpt from
> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dndevio/html/plugnplay.asp:
>
>
> //////////////////
> A function driver is the main device driver and provides the
> operational interface for its device. It is a required driver unless
> the device is used raw (an implementation in which I/O is done by the
> bus driver and any bus filter drivers). The function driver for a
> device is typically implemented as a driver/minidriver pair. In such
> driver pairs, a class driver (usually written by Microsoft) provides
> the functionality required by all devices of that type, and a
> minidriver (usually written by the device vendor) provides
> device-specific functionality. The Plug and Play Manager loads one
> function driver for each device.
> //////////////////
>
>
>
> Therefore, according to MSDN, a function driver is "driver/minidriver
> pair", where "driver" is MSFT-provided class driver. Once Usbstor.sys
> is FDO, is it a mistake to refer to it with the term"class
> driver"??????
>
>
> Anton Bassov
>
>
>
> Doron Holan [MS] wrote:
>> usbstor is a driver which implements a class specification, it is not the
>> same as a class filter. usbstor is an FDO
>>
>> d
>>
>> --
>> Please do not send e-mail directly to this alias. this alias is for
>> newsgroup purposes only.
>> This posting is provided "AS IS" with no warranties, and confers no
>> rights.
>>
>>
>> <soviet_bloke@hotmail.com> wrote in message
>> news:1158117626.777550.263680@i3g2000cwc.googlegroups.com...
>> >
>> >> > Assuming a standard port-miniport-class architecture
>> >>
>> >> Which one of these three is ftdisk.sys? Or usbstor.sys?
>> >
>> > It is understandable that above mentioned architecture applies only to
>> > drivers that deal with hardware devices. However, FtDisk.sys deals with
>> > logical volumes on basic disks, so that I don't really understand why
>> > Slava M.Usov mentioned FtDisk.sys here.
>> >
>> > Anyway, if Slava M.Usov is desperate to classify FtDisk.sys somehow
>> > ...... then I have to inform him that Russinovich and Solomon
>> > classified it as a bus driver, responsible for enumerating basic disks
>> > in order to detect basic volumes and report them to PnP Manager
>> > ("Windows Internals", Fourth Edition, page 626).
>> >
>> >
>> > Usbstor.sys is a class driver - it manages devices of USB Storage
>> > Class
>> > (http://www.microsoft.com/whdc/device/storage/usbfaq.mspx).
>> >
>> > Therefore, if filter device gets attached to it, it is both upper-level
>> > filter (as far as USB Storage Class driver, i.e. Usbstor.sys, is
>> > concerned) and lower-level one (as far as Disk Class driver, i.e.
>> > Disk.sys, is concerned)
>> >
>> > Anton Bassov
>> >
>> >
>> >
>> > Slava M. Usov wrote:
>> >> <soviet_bloke@hotmail.com> wrote in message
>> >> news:1158109483.114477.49020@i42g2000cwa.googlegroups.com...
>> >>
>> >> > Assuming a standard port-miniport-class architecture
>> >>
>> >> Which one of these three is ftdisk.sys? Or usbstor.sys?
>> >>
>> >> S
>> >
>



Re: Installing a lower filter driver by Don

Don
Wed Sep 13 08:12:35 CDT 2006


<soviet_bloke@hotmail.com> wrote in message
news:1158109483.114477.49020@i42g2000cwa.googlegroups.com...
> Don,
>
>> lower filter is a filter below the driver, that modifies actions of the
>> driver, typically as it heads to the hardware. An upper filter is a
>> filter
>> above the driver modifying requests (and the requests results) to the
>> driver.
>
> Assuming a standard port-miniport-class architecture, what is "driver"
> in your definition???? Apparently, it is not port, because port driver
> is the one that actually deals with the controller, so that there is no
> need to modify its actions, although you may want to modify requests
> (and the requests results) that it receives. Apparently, it is not
> miniport either, because the very idea of miniport driver is to
> customize interactions between the class and port drivers, so that it
> does not really matter if your filter driver is below or above miniport
> driver - in any case, it will be able to have both functionalities that
> you have mentioned. Therefore, the only driver that left is class
> driver, and your driver's functionality depends whether it is above or
> below the class driver - it cannot have them both

You are assuming a model that is only used in a few cases, there are lots of
stacks out there with no mini-ports what so ever in them. I would guess
that less that 10% of my work in the last 12 years of doing Windows drivers
has involved a mini-port.

The reason the distinction is important is that it can impact operation,
since if the filter is a device specific filter a lower filter for the
device will work no matter what the underlying class is, but an upper class
filter will not work if the class is wrong, and have problems if another
device you do not want filtered is attached. It is for these reasons there
are two filter values in the registry "UpperFilters" and "LowerFilters".


--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
http://www.windrvr.com
Remove StopSpam from the email to reply




Re: Installing a lower filter driver by Maxim

Maxim
Wed Sep 13 08:36:44 CDT 2006

> It is obvious that the OP is a newbie - even simple tasks(i.e. linking
> to the library) are quite problematic for him. Therefore, if he starts
> editing the registry manually, he is more than likely to screw up his
> system. The best solution in his situation is applying step-by-step
> modifications to some existing .inf file, and installing and

INF files are more complex then registry editions, and an error in INF can
easily render the whole OS unbootable - saw this once.

I would like to avoid complexities, and so, if something can be done without
INF - then let it be done without INF.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com


Re: Installing a lower filter driver by Maxim

Maxim
Wed Sep 13 08:41:02 CDT 2006

> Therefore, according to MSDN, a function driver is "driver/minidriver
> pair", where "driver" is MSFT-provided class driver.

Not necessary. For NICs, it is true. For storage controllers, it is true. For
USBSTOR, or input stack - not true.

Having a "driver/minidriver" pair is just convinience, it does not reflect the
PnP roles of the driver, and "upper filter" and "lower filter" are PnP roles.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com


Re: Installing a lower filter driver by anton

anton
Wed Sep 13 11:54:49 CDT 2006

Don,


> You are assuming a model that is only used in a few cases, there are lots of
> stacks out there with no mini-ports what so ever in them. I would guess
> that less that 10% of my work in the last 12 years of doing Windows drivers
> has involved a mini-port.

It is understandable that miniport driver is not an absolute must . The
only reason why I mentioned it is because I wanted to mention all kind
of drivers that one may encounter on the standard device stack(apart
from bus driver, of course, so that I did not even mention it), in
order to conclude that the term"driver" in your definition, apparently,
refered to the class driver, rather than to any other type of driver
one may encounter



> The reason the distinction is important is that it can impact operation,
> since if the filter is a device specific filter a lower filter for the
> device will work no matter what the underlying class is, but an upper class
> filter will not work if the class is wrong, and have problems if another
> device you do not want filtered is attached.

I fully agree with the above . The most interesting thing is that the
above statement is fully consistent with my definition of terms
"upper-level" and "lower-level" in respect to filter's position on the
stack, relative to that of a class driver.

Lower-level filters monitor interactions between devices and their
class drivers, while upper-level ones moniror interactions between
class drivers and the system. Therefore, upper-level filter can attach
itself to all devices that are managed by the target class driver, but
if some lowest-level driver on one of the stacks that upper-level
filter monitors creates devices that belong to different classes,
upper-level filter can attach itself only to the one of the target
class. Lower-level filter is exactly the opposite - it can attach
itself to all devices that have been created by the target driver below
(even if the driver below creates devices that belong to different
classes), but if some class driver on one of the stacks that
lower-level filter monitors creates multiple device objects and
attaches them to the lowest-level ones that have been created by
different drivers,
lower-level filter can attach itself only to the device(s), created by
the the target lowest-level driver.

It is understandable that, in order to work this way, lower-level and
upper-level filter drivers have to get loaded respectively before and
after class drivers do, so that they are always respectively below and
above class drivers on their stacks.



Anton Bassov



Don Burn wrote:
> <soviet_bloke@hotmail.com> wrote in message
> news:1158109483.114477.49020@i42g2000cwa.googlegroups.com...
> > Don,
> >
> >> lower filter is a filter below the driver, that modifies actions of the
> >> driver, typically as it heads to the hardware. An upper filter is a
> >> filter
> >> above the driver modifying requests (and the requests results) to the
> >> driver.
> >
> > Assuming a standard port-miniport-class architecture, what is "driver"
> > in your definition???? Apparently, it is not port, because port driver
> > is the one that actually deals with the controller, so that there is no
> > need to modify its actions, although you may want to modify requests
> > (and the requests results) that it receives. Apparently, it is not
> > miniport either, because the very idea of miniport driver is to
> > customize interactions between the class and port drivers, so that it
> > does not really matter if your filter driver is below or above miniport
> > driver - in any case, it will be able to have both functionalities that
> > you have mentioned. Therefore, the only driver that left is class
> > driver, and your driver's functionality depends whether it is above or
> > below the class driver - it cannot have them both
>
> You are assuming a model that is only used in a few cases, there are lots of
> stacks out there with no mini-ports what so ever in them. I would guess
> that less that 10% of my work in the last 12 years of doing Windows drivers
> has involved a mini-port.
>
> The reason the distinction is important is that it can impact operation,
> since if the filter is a device specific filter a lower filter for the
> device will work no matter what the underlying class is, but an upper class
> filter will not work if the class is wrong, and have problems if another
> device you do not want filtered is attached. It is for these reasons there
> are two filter values in the registry "UpperFilters" and "LowerFilters".
>
>
> --
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> http://www.windrvr.com
> Remove StopSpam from the email to reply


Re: Installing a lower filter driver by Jonathan

Jonathan
Wed Sep 13 13:31:20 CDT 2006

I have a question again about this upper a lower filter discussion;
here is an excerpt out of the kbfiltr filter driver on where it
attaches to the stack:

-------------------------------------------------------------------------------------------------------
KbFilter_AddDevice( __in PDRIVER_OBJECT Driver, __in PDEVICE_OBJECT
PDO){
...
devExt->TopOfStack = IoAttachDeviceToDeviceStack(device, PDO);
...
}
-------------------------------------------------------------------------------------------------------

where PDO is the PDEVICE_OBJECT coming from the AddDevice function
call;

here is the upper filter driver that I wrote earlier this week:

-------------------------------------------------------------------------------------------------------
CCHAR ntNameBuffer[64] = "\\Device\\KeyboardClass0";
STRING ntNameString;
UNICODE_STRING uKeyboardDeviceName;
RtlInitAnsiString( &ntNameString, ntNameBuffer );
RtlAnsiStringToUnicodeString( &uKeyboardDeviceName, &ntNameString, TRUE
);
IoAttachDevice(pKeyboardDeviceObject,&uKeyboardDeviceName,&pKeyboardDeviceExtension->pKeyboardDevice);
RtlFreeUnicodeString(&uKeyboardDeviceName);
-------------------------------------------------------------------------------------------------------

1) so in the first example, I am attaching to the PDO, which is below
the keyboard class driver which is above the i8042 port driver correct?


2) In the second example, I am attaching now above the keyboard class
driver correct?

3) How difficult would it be to actually implement a lower keyboard
filter driver ( below i8042prt driver) that will filter out when keys
are being pushed etc?

Thanks in advance...


Re: Installing a lower filter driver by anton

anton
Wed Sep 13 14:00:18 CDT 2006

Jonathan,

> 1) so in the first example, I am attaching to the PDO....

In the first example you attach your device to the one that is on top
of the stack at the time of the call, i.e. i8042prt - kbdclass is not
yet loaded. When it gets loaded, it will attach its device to the top
of the stack, i.e. to your device.

>....which is below
> the keyboard class driver which is above the i8042 port driver correct?

PDO is *ALWAYS* at the very bottom of the stack


> 2) In the second example, I am attaching now above the keyboard class
> driver correct?

This is true.....

> 3) How difficult would it be to actually implement a lower keyboard
> filter driver ( below i8042prt driver) that will filter out when keys
> are being pushed etc?

i8042prt driver is a port driver, so that it handles kbd interrupt.
Therefore, it is impossible to write such filter driver. No matter what
is below i8042prt, it is related to PnP sequence, rather than i8042prt
driver's actual functionality - as far as functionality is concerned,
i8042prt is at the very bottom of the stack.....

Anton Bassov





Jonathan wrote:
> I have a question again about this upper a lower filter discussion;
> here is an excerpt out of the kbfiltr filter driver on where it
> attaches to the stack:
>
> -------------------------------------------------------------------------------------------------------
> KbFilter_AddDevice( __in PDRIVER_OBJECT Driver, __in PDEVICE_OBJECT
> PDO){
> ...
> devExt->TopOfStack = IoAttachDeviceToDeviceStack(device, PDO);
> ...
> }
> -------------------------------------------------------------------------------------------------------
>
> where PDO is the PDEVICE_OBJECT coming from the AddDevice function
> call;
>
> here is the upper filter driver that I wrote earlier this week:
>
> -------------------------------------------------------------------------------------------------------
> CCHAR ntNameBuffer[64] = "\\Device\\KeyboardClass0";
> STRING ntNameString;
> UNICODE_STRING uKeyboardDeviceName;
> RtlInitAnsiString( &ntNameString, ntNameBuffer );
> RtlAnsiStringToUnicodeString( &uKeyboardDeviceName, &ntNameString, TRUE
> );
> IoAttachDevice(pKeyboardDeviceObject,&uKeyboardDeviceName,&pKeyboardDeviceExtension->pKeyboardDevice);
> RtlFreeUnicodeString(&uKeyboardDeviceName);
> -------------------------------------------------------------------------------------------------------
>
> 1) so in the first example, I am attaching to the PDO, which is below
> the keyboard class driver which is above the i8042 port driver correct?
>
>
> 2) In the second example, I am attaching now above the keyboard class
> driver correct?
>
> 3) How difficult would it be to actually implement a lower keyboard
> filter driver ( below i8042prt driver) that will filter out when keys
> are being pushed etc?
>
> Thanks in advance...


Re: Installing a lower filter driver by Maxim

Maxim
Wed Sep 13 14:11:46 CDT 2006

> Lower-level filters monitor interactions between devices and their

In PnP world, the notions of "upper filter" and "lower filter" are
well-defined, and has nothing to do with all of this.

Lower filters are attached to devnode below the functional DO, upper - above.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com


Re: Installing a lower filter driver by Maxim

Maxim
Wed Sep 13 14:15:55 CDT 2006

> IoAttachDevice

IoAttachDevice is long ago obsolete, forget it.

For PnP stacks, you must properly register in PnP registry and then do the
attach from your AddDevice routine.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com


Re: Installing a lower filter driver by Jon

Jon
Wed Sep 13 15:04:26 CDT 2006

Thanks Anton, I appreciate the help.


Re: Installing a lower filter driver by soviet_bloke

soviet_bloke
Wed Sep 13 15:06:22 CDT 2006

Maxim,

> In PnP world, the notions of "upper filter" and "lower filter" are
> well-defined, and has nothing to do with all of this.
>
> Lower filters are attached to devnode below the functional DO, upper - above.


This is a perfect definition that I am ready to accept. However, at
this point few more questions arise. What are disk, kbdclass and
mouclass class drivers??? Are they FDOs that implement class
specifications, or are they just upper filters that attach
themselves to different device stacks???? What is kbdfilter - is it
upper or lower filter???

Anton Bassov

Maxim S. Shatskih wrote:
> > Lower-level filters monitor interactions between devices and their
>
> In PnP world, the notions of "upper filter" and "lower filter" are
> well-defined, and has nothing to do with all of this.
>
> Lower filters are attached to devnode below the functional DO, upper - above.
>
> --
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> maxim@storagecraft.com
> http://www.storagecraft.com


Re: Installing a lower filter driver by Maxim

Maxim
Wed Sep 13 15:19:30 CDT 2006

> This is a perfect definition that I am ready to accept. However, at
> this point few more questions arise. What are disk, kbdclass and
> mouclass class drivers???

Disk+ClassPnP pair is functional driver.
kbdclass and mouclass are upper filters.

> themselves to different device stacks???? What is kbdfilter - is it
> upper or lower filter???

Upper.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com


Re: Installing a lower filter driver by soviet_bloke

soviet_bloke
Wed Sep 13 16:20:49 CDT 2006

Maxim,

> Disk+ClassPnP pair is functional driver.
> kbdclass and mouclass are upper filters.


But what makes them different???

Anton Bassov


Maxim S. Shatskih wrote:
> > This is a perfect definition that I am ready to accept. However, at
> > this point few more questions arise. What are disk, kbdclass and
> > mouclass class drivers???
>
> Disk+ClassPnP pair is functional driver.
> kbdclass and mouclass are upper filters.
>
> > themselves to different device stacks???? What is kbdfilter - is it
> > upper or lower filter???
>
> Upper.
>
> --
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> maxim@storagecraft.com
> http://www.storagecraft.com


Re: Installing a lower filter driver by Slava

Slava
Wed Sep 13 16:19:40 CDT 2006

<soviet_bloke@hotmail.com> wrote in message
news:1158117626.777550.263680@i3g2000cwc.googlegroups.com...

> It is understandable that above mentioned architecture applies only to
> drivers that deal with hardware devices. However, FtDisk.sys deals with
> logical volumes on basic disks

The above mentioned architecture cannot exist then, because if class drivers
are always to talk to ports, they can never deal with hardware devices. They
always deal with something logical, exactly as ftdisk does.

[...]

> FtDisk.sys

[...]

> Russinovich and Solomon classified it as a bus driver

So? disk.sys is a bus driver, too.

[...]

> ("Windows Internals", Fourth Edition, page 626).

Pointless reference, this book is not an authoritative source on WDM.

> Usbstor.sys is a class driver - it manages devices of USB Storage Class

So in a USB storage stack we would have a class driver attached to a class
driver. So much for the "standard port-miniport-class architecture".

S



Re: Installing a lower filter driver by Slava

Slava
Wed Sep 13 16:24:59 CDT 2006

"anton bassov" <soviet_bloke@hotmail.com> wrote in message
news:1158166489.287528.269810@e63g2000cwd.googlegroups.com...

[...]

> Lower-level filter is exactly the opposite - it can attach itself to all
> devices that have been created by the target driver below

"[B]y the target driver below"? There is only one target driver, and it is
not below, it is above for a lower filter.

> (even if the driver below creates devices that belong to different
> classes)

And the parenthetical remark, as is frequently the case with parenthetical
remarks of this author, is simply wrong. A lower filter driver will always
attach only to the devices that the target driver attaches to.

> but if some class driver on one of the stacks that lower-level filter
> monitors creates multiple device objects and attaches them to the
> lowest-level ones that have been created by different drivers, lower-level
> filter can attach itself only to the device(s), created by the the target
> lowest-level driver.

This is not decipherable, but is probably wrong.

> It is understandable that, in order to work this way, lower-level and
> upper-level filter drivers have to get loaded respectively before and
> after class drivers do, so that they are always respectively below and
> above class drivers on their stacks.

And this is nothing but ignorance about WDM fundamentals.

S




Re: Installing a lower filter driver by Slava

Slava
Wed Sep 13 16:25:15 CDT 2006

"Jonathan" <TheFakeJon@gmail.com> wrote in message
news:1158172280.306145.101170@i42g2000cwa.googlegroups.com...

[...]

> 3) How difficult would it be to actually implement a lower keyboard
> filter driver ( below i8042prt driver) that will filter out when keys
> are being pushed etc?

You need an upper filter for this. The DDK documentation explains this very
well.

S



Re: Installing a lower filter driver by Maxim

Maxim
Wed Sep 13 16:33:40 CDT 2006

> > Disk+ClassPnP pair is functional driver.
> > kbdclass and mouclass are upper filters.
>
>
> But what makes them different???

They way they are registered in registry.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com


Re: Installing a lower filter driver by Jon

Jon
Wed Sep 13 17:41:40 CDT 2006

Hello everyone,

so I decided to play with the kbfiltr sample and make a quick little
key logger from it. I figure it should be easy, I would just intercept
the scancodes in ServiceCallBack routine. So I wanted it to such that
if i have multiple keyboards are attached, they would all write to the
same log file. so in my "AddDevice", I create a file and store the
handle in my DeviceExtension. In the ServiceCallBack function, I use
this handle I created to the file object to write to the file. In my
unload, is where I close the log file.

I am getting BSODs unfortunately, and I am not sure why. I was
thinking that maybe it was a synchronization issue with the file, but I
only have 1 keyboard hooked up at the moment, so there should only be 1
device writing to the log file.

Note that in the ServiceCallBack routine, if i just print out the keys
to the screen it works fine. So in other words, once I have the
scancode, I convert it to the actual keycode and DbgPrint it works
fine, no blue screens. The second i uncomment the "ZwWriteFile"
function to write the character to the file, after a few key pushes, it
BSOD.

I create the file with:

ZwCreateFile(&devExt->hLogFile,
GENERIC_WRITE,
&obj_attrib,
&file_status,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_WRITE,
FILE_OPEN_IF,
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0);

and write to the file with:

ZwWriteFile( devExt->hLogFile, NULL, NULL, NULL, &io_status, &key, 1,
NULL, NULL);

Thanks


Re: Installing a lower filter driver by Slava

Slava
Wed Sep 13 18:22:57 CDT 2006

"Jon" <TheFakeJon@gmail.com> wrote in message
news:1158187300.331682.265880@e3g2000cwe.googlegroups.com...

[...]

> Note that in the ServiceCallBack routine, if i just print out the keys
> to the screen it works fine. So in other words, once I have the
> scancode, I convert it to the actual keycode and DbgPrint it works
> fine, no blue screens. The second i uncomment the "ZwWriteFile"
> function to write the character to the file, after a few key pushes, it
> BSOD.

Acquaint yourself with the concept of IRQL. The DDK design guide, section on
interrupts, should get you started. Your problem is that the callback
routine runs at an elevated IRQL, which is incompatible with file IO
routines.

S



Re: Installing a lower filter driver by Jon

Jon
Wed Sep 13 18:48:07 CDT 2006

oh, I totally forgot to check the IRQL of the ServiceCallBack

thanks


Slava M. Usov wrote:
> "Jon" <TheFakeJon@gmail.com> wrote in message
> news:1158187300.331682.265880@e3g2000cwe.googlegroups.com...
>
> [...]
>
> > Note that in the ServiceCallBack routine, if i just print out the keys
> > to the screen it works fine. So in other words, once I have the
> > scancode, I convert it to the actual keycode and DbgPrint it works
> > fine, no blue screens. The second i uncomment the "ZwWriteFile"
> > function to write the character to the file, after a few key pushes, it
> > BSOD.
>
> Acquaint yourself with the concept of IRQL. The DDK design guide, section on
> interrupts, should get you started. Your problem is that the callback
> routine runs at an elevated IRQL, which is incompatible with file IO
> routines.
>
> S


Re: Installing a lower filter driver by anton

anton
Wed Sep 13 20:07:44 CDT 2006

> > It is understandable that above mentioned architecture applies only to
> > drivers that deal with hardware devices. However, FtDisk.sys deals with
> > logical volumes on basic disks
>
> The above mentioned architecture cannot exist then, because if class drivers
> are always to talk to ports, they can never deal with hardware devices.

In fact, kbd and mouse architectures on PS/2-based machines *DO EXIST*,
even if Slava M.Usov denies them the right to - they are just classical
examples of class driver (i.e. respectively kbdclas and mouseclass)
dealing with port driver, i.e. i8042prt,