NDIS Filter driver install issue - Rebinding of Protocol drivers not getting initiated

Question

Hello,

I am trying to install the sample NDIS 6.0 filter driver on windows 7. This is a mandatory filter drivers are filter drivers that must be present for a driver stack to function properly.

To attach a mandatory filter module to a driver stack, NDIS unbinds all the protocol bindings, attaches the filter module, and then reestablishes all the protocol bindings. If the driver does not attach, NDIS tears down the underlying driver stack.

When a computer restarts, NDIS will not bind any protocol drivers to a miniport adapter if any mandatory filter module that is associated with the adapter does not attach to the miniport adapter.

Because the protocol drivers are not getting binded to miniport driver, i am not able to establish net connection. So not able to test the filter driver functionality.

I looked into inf file in which, we can set properties to prevent/force the unbind of all the protocols, But that is supported in WIndows 8 - NDIS 6.3. 

Can anyone tell me how to re-establish the binding between the miniport and protocol stack after attaching the filter module.

Thanks in advance.

Bas

Answer 1

If a NDIS 6.0 mandatory filter installs correctly then NDIS will automatically rebind protocols to the reconfigured filter stack. There is nothing special that the NDIS filter driver or it's installer needs to do to make this happen.

So, it is likely that your NDIS 6.0 driver did not actually load. And because it was marked as mandatory, protocols will not be be bound.

Examine the Windows event logs for errors related to your driver. Examine the \Windows\INF setupapi logs for errors related to your driver. Examine your INF file for mistakes.

If you are installing the driver on a 64-bit system then the driver package must:

1.) Be digitally signed using the WDK signing tools.

- OR -

2.) You must use the test signing procedures described in the WDK. These allow an unsigned driver to be installed for testing.

If you built a 64-bit version of the NDIS 6.0 filter and did not attend to signing details then you would have exactly the problem you are describing.

Good luck!

 

---

Thomas F. Divine http://www.pcausa.com

Answer 2

The sample filter driver doesn't automatically start the driver after installation -- you need to run "net start ndislwf" to start it.

Alternatively, you can modify the sample INF to get the service to start automatically with the 0x800 flag:

AddService=NdisLwf,0x800,NdisLwf_Service_Inst ; SPSVCINST_STARTSERVICE

If you're doing all that, then check why your filter driver isn't loading (Thomas gives some hints). You can attach a kernel debugger and use !ndiskd.miniport to see what NDIS thinks is attached to the miniport.

Answer 3

Hello Thomas,

Thanks for your suggestion. I test signed the driver and i was able to load it and the protocol drivers did rebind automatically to miniport drivers.

Bas