none
Attaching mini filter with same altitude more than once RRS feed

  • Question

  • Hi All,

    I am learning minifilter driver development. When i run the following command to know about the installed minifilter on my computer it is showing same minifilter instance more than once but with same altitude as shown below. What is the benefit of using same altitude and attaching more than once instance on the same volume.

    

    Thanks,

    Jay

    Tuesday, September 17, 2019 4:06 PM

All replies

  • There are many cases where you don't care exactly how the filters are stacked.  If you need to be above layer 1 but below layer 3, then you don't need to care how many drivers there are at layer 2.

    Tim Roberts | Driver MVP Emeritus | Providenza & Boekelheide, Inc.

    Tuesday, September 17, 2019 5:03 PM
  • Thanks Tim.

    One more question whether a minifilter can be attached to different frame. For example, as shown in this link https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/filter-manager-concepts, is it correct to attach MiniFilter B on top of MiniFilter D in Frame 0? I assume that the altitude range in one frame (frame 0) does not care about altitude range in another frame (frame 1) on top or below it.

    Wednesday, September 18, 2019 4:20 AM
  • The altitude must match the "load order group", which means each frame has a distinct range.  A single minifilter can be attached in different frames, but each one is a separate instance with its own altitude.

    If you want to find the real experts on this, go to the [NTFSD] forum on the OSR web site, at https://community.osr.com.  File system drivers are not my primary milieu.


    Tim Roberts | Driver MVP Emeritus | Providenza & Boekelheide, Inc.

    Wednesday, September 18, 2019 5:07 PM
  • Thanks Tim i will check OSR forum for more details
    Wednesday, September 18, 2019 11:17 PM