Minifilter driver developers are also encouraged to use general-purpose kernel-mode development and testing tools, such as PREfast with driver-specific rules.
Fltmc.exe Control Program
The Fltmc.exe control program is a command-line utility for common minifilter driver management operations. Developers can use Fltmc.exe to load and unload minifilter drivers, attach minifilter drivers to volumes or detach them from volumes, and enumerate minifilter drivers, instances, and volumes.!fltkd Debugger Extension
The !fltkd debugger extension is provided in Debugging Tools for Windows. Commonly used commands include the following:| Command | Description |
|---|---|
| !cbd | The filter manager equivalent of !irp |
| !filter | Lists detailed information about the specified filter |
| !filters | Lists all attached minifilter drivers |
| !frames | Lists all filter manager frames and attached minifilter drivers |
| !instance | Lists detailed information about the specified instance |
| !volume | Lists detailed information about the specified volume |
| !volumes | Lists all volumes and attached minifilter driver instances |
For additional debugging help, test the minifilter driver with the debug version of Fltmgr.sys, which contains numerous ASSERT statements to catch common errors.
Filter Verifier
Filter Verifier is an I/O Verification option in Driver Verifier that validates minifilter driver usage of filter manager functions. Filter Verifier is installed with the filter manager. Developers should always develop minifilter drivers with Driver Verifier and Filter Verifier enabled.To use Filter Verifier, specify the minifilter driver's name and enable the I/O Verification option in Driver Verifier (Verifier.exe). Verification starts when the minifilter driver registers with the filter manager.
Filter Verifier validates the following usage in a minifilter driver:
- Correct use of parameters and calling context
- Correct return values from preoperation and postoperation callback routines
- Consistent and coherent changes to parameters in callback data
- Contexts
- Callback Data structures
- Queued Work Items
- NameInformation structures
- File Objects
- Filter Objects
- Instance Objects
- Volume Objects
No comments:
Post a Comment