过滤驱动直接AttachVolume提示FltStartFiltering has not been called

[Dickson]

求教下， 我学习miniFilter中，在FltStartFiltering下面增加了一段代码，想驱动服务一运行自动Attach到C 盘的Volume上：

status = FltStartFiltering(MiniSpyData.Filter);

if (!NT_SUCCESS(status)) {

FltUnregisterFilter(MiniSpyData.Filter);
}
else {
RtlInitUnicodeString(&uniString, L"\\Device\\HarddiskVolume1");
PFLT_VOLUME vol;
FltGetVolumeFromName(&MiniSpyData.Filter, &uniString, &vol);
status = FltAttachVolume(&MiniSpyData.Filter, vol, NULL, NULL);
}


但是一加载驱动就得到这个提示"The filter is not ready for attachment to volumes because it has not finished initialize (FltStartFiltering has not been called)." 然后就蓝屏。。。 我已经FltStartFiltering()过了啊，这是什么原因呢？多谢指教

[Dickson]

找到答案了。。。 FltGetVolumeFromName(&MiniSpyData.Filter, &uniString, &vol); status = FltAttachVolume(&MiniSpyData.Filter, vol, NULL, NULL); 应该改成 FltGetVolumeFromName(MiniSpyData.Filter, &uniString, &vol); status = FltAttachVolume(MiniSpyData.Filter, vol, NULL, NULL);