Search code examples
filterdriverwdk

Windows Lower Filter Driver


Have some special USB drives whose Oxford Semi controllers are proclaiming themselves non-removable and I need to make them removable [which of course they are]. Oxford will not cooperate. Took Hitachi's cfadisk.c, tweaked the QueryPropertyCompletion function to confirm that the vendor ID was the one I'm looking for, then set the removable property before returning. Used DDK's addfilter to insert a lower filter for one of my special USB devices. addfilter listdevices showed the lower filter properly installed. Rebooted. Now special USB device no longer shows up; Windows Explorer doesn't see it. addfilter of course cannot be used to remove the lower filter because the device has to be there in the first place. Hunted down all references to my filter driver in the registry, but regedt32 declines to remove "LowerFilter" references that specify my driver. I even renamed the folder where my driver was found, rebooted, but regedt32 still declines to remove the references. How to convince Windows to let go of the lower filter driver? And I guess I'll have to setup a kernel debugger to find out what the filter driver is doing. Thanks.


Solution

  • The permission settings you describe in your comments wouldn't allow anyone other than the SYSTEM account and perhaps the owner to delete it. Logging in as an admin wouldn't matter unless that admin was also the owner and owner permissions allow delete, which is apparently not the case on your machine.

    Every key on my machine (Win7) that contains a LowerFilters value gives full control to administrators, which means I could delete them. So the only way you're going to delete or modify those values is to give full control to administrators on those keys. How they came to not have full control, I can't say.