none
How to Dispatch Fast/Io RRS feed

  • Question

  • How to Dispatch File system Filter driver Fast / IO Dispatch routines. 

    Is it necessary ? 

    I am following the manual as follow. 

    https://msdn.microsoft.com/en-us/windows/hardware/drivers/ifs/introduction-to-file-system-filter-drivers

    Any help Appreciated. 

    Thanks 

    Friday, November 25, 2016 2:35 AM

Answers

  • If this is a file system filter use the mini-filter model and the framework will do all the work for you.  If you are not using a minifilter tell us what you are trying to do.


    Don Burn Windows Driver Consulting Website: http://www.windrvr.com

    • Marked as answer by Thomas Hopes Friday, November 25, 2016 12:54 PM
    Friday, November 25, 2016 12:06 PM

All replies

  • If this is a file system filter use the mini-filter model and the framework will do all the work for you.  If you are not using a minifilter tell us what you are trying to do.


    Don Burn Windows Driver Consulting Website: http://www.windrvr.com

    • Marked as answer by Thomas Hopes Friday, November 25, 2016 12:54 PM
    Friday, November 25, 2016 12:06 PM
  • It's not Minifilter driver. I am trying to make Filesystem Filtering Driver which filters before sending IRP to Process by mini-Filter. As i got hint that only Mini-filter Driver has to have Fast I/O to be initialized. 

    Thanks 

    Friday, November 25, 2016 12:54 PM
  • Why are you doing such an architecture?  Minifilters have an altitude, so you can place them close to being the top filter or some other area depending on your goals.   Note: you cannot ensure that your filter (whether minifilter or legacy) is the top of the stack, since if two filters both want to be on top somebody is going to lose.


    Don Burn Windows Driver Consulting Website: http://www.windrvr.com

    Friday, November 25, 2016 1:06 PM
  • What you advice : minifilter or legacy. I am trying to build an AV's system driver. 

    Thanks

    Friday, November 25, 2016 1:42 PM
  • Minifilter, writing a file system filter driver is one of the hardest pieces of code in the kernel.  Using the legacy model just makes it many times harder.  I've worked in both models, I would never do a legacy filter again.


    Don Burn Windows Driver Consulting Website: http://www.windrvr.com

    Friday, November 25, 2016 1:54 PM