none
Filter driver on Win 10 does not call FilterPause RRS feed

  • Question

  • I maintenance NDIS 6.1 filter driver and met weird problem on Win10 1803 with NDIS version 0x60051 returned from NdisGetVersion(). (NDIS 6.81) The same on Win 2016 Server.

    FilterPause() and following FilterDetach handlers are called after DriverUnload(). 

    My DriverUnload()  contains cleaning of globals and it assumes that FilterPause() is already done so driver crashes.

    I did not meet this behavior in the past even probably on older Win 10 I have not this problem. 

    Are known any changes in new NDIS 6.81 which are reason of reversed calling order FilterPause and DriverUnload ?

    Or some other known incompatibility with older drivers ?

     
    • Edited by Peter Skvarka Friday, February 22, 2019 8:33 PM Incorrectly interpreted NDIS version
    Friday, February 22, 2019 9:51 AM

Answers

  • Just because the problem didn't manifest in previous versions of Windows doesn't mean the problem isn't in your driver. Enable NDIS tracing to help debug your issue

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting. Blog at www.azius.com/blog

    Friday, February 22, 2019 7:26 PM
    Moderator

All replies

  • Just because the problem didn't manifest in previous versions of Windows doesn't mean the problem isn't in your driver. Enable NDIS tracing to help debug your issue

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting. Blog at www.azius.com/blog

    Friday, February 22, 2019 7:26 PM
    Moderator
  • Sorry for delay. I must to edit my last post because it is not true that I had reversed order of called functions.

    I have right calling order:

    NdisDeregisterDeviceEx(NdisFilterDeviceHandle);
    NdisFDeregisterFilterDriver(FilterDriverHandle);

    Should not NdisDeregisterDeviceEx() trigger pausing of NDIS lightweight filter ? 

    • Edited by Peter Skvarka Monday, March 18, 2019 7:10 AM Not right
    Sunday, February 24, 2019 8:24 AM