Understanding Device Drivers and Filters

[center]Understanding Device Drivers and Filters

(Or my original title: "What the heck is a Windows Filter? And why you should care to know!")[/center][center][/center]
This post provides an introduction to help understand Windows drivers and filters
....> To learn how to easily view and get info about flters on your computer see [post=815752]"How to Find/View Filter Drivers on Your Computer"[/post]
....> For help to fix filter problems see [post=815753]"CD/DVD or Disk Problems? How to Fix Problems Caused by Filters"[/post]

It can be pretty darn frustrating when you have a Windows device that refuses to work
Device Driver Overview
The Function Driver vs. Upper and Lower Filter Drivers
A Windows device driver consists of

• A single (and required) function driver
  > This is the device's main driver
• Zero or more (optional) filters
  > Filters intercept (and may modify) device I/O data Request Packets (IRPs) before and/or after the function driver processes them
  • Upper filters first intercept data requests before the function driver
    >> Upper filters typically provide added-value features for a device (examples later)
  • Lower filters first intercept data requests after the function driver
    >> Lower filters typically modify the behavior of the device hardware
    >> This may include translating proprietary communication into a standard language for the main driver

Device Name vs. Device Class
A filter can be installed for a specific device or device class. Every hardware device has a device name and belongs to a Windows device class
> The device name uniquely identifies the hardware device
> The device class indicates the type of device

Here's a few examples of pre-defined Windows device classes
Device Filters vs. Class Filters
Filters can be installed and applied to a single device or applied to all devices of the same class

• A device filter is device specific. It's applied to a single and specific device
• While a class filter is applied to every device in the class
  > So, a single class filter for class= DiskDrive is applied to and will affect every disk on the computer!

It's the class filters that can cause device problems! as they're typically from 3rd party vendors. Example

• You install a data backup product
• The product MIGHT install a class filter to intercept all the I/O to all your disk drives
• That single 3rd party class filter might not work well with one or more of your disks (and the disk's device driver)
• You can uninstall/reinstall all your disk drivers till kingdom come!
  > For this case, the problem with your disk doesn't go away till you finally uninstall and fix the disk drive class filter!

Examples of Filters

• Keyboard Upper Class Filter
  A keyboard upper filter may implement additional security checks and provide enhanced functionality when it intercepts, and possibly modifies the IRPs as they pass between an application or OS/module and the keyboard's function driver
  
  
• Keyboard Lower Class Filter
  A Keyboard lower filter may intercept physical keystrokes to "clean-up" the key presses sent between the keyboard hardware and its function driver.
  • You may have only pressed the hardware key once, but internally, the key press may have made repeated physical electrical contact within a few milliseconds, sending more than one signal when only one was intended
  • A lower filter can recognize and clean-up the un-intended behavior, change the data stream received from the hardware and only forward 1 keystroke to the function driver
  • From the end-user's perspective, they only see a one key-press response. For the user, it looks like a simple one press per one character response
  
  
• Notes About the Keyboard Filter Examples
  • Note how a "layered" approach to device drivers makes it easy to swap-out and change filter functionality
    > E.g. in above examples, simply change a filter to change how security is being applied or how multi-press keystrokes are handled
  • In the keyboard example, note that a simple change to upper filters can affect how security is applied to a keyboard and its standard device driver.
    > The filter change (and change in security) could be implemented without ever changing and no need to modify the keyboard function driver itself

[center]How to Find/View Filter Drivers on Your Computer[/center][center][/center][center]
[/center][center][/center]
This post explains methods and tools so you can find and view the filter drivers on your computer
....> For an understanding of concepts and terminology, start with [post=815751]"Tutorial: Understanding Device Drivers and Filters"[/post]
....> For help with fixing filter problems see [post=815753]"CD/DVD or Disk Problems? How to Fix Problems Caused by Filters"[/post]

Below are two of several methods available to find and view the filter drivers on your computer. Each method has its pluses and minuses
Method 1- How to view filters using Filter Driver Load Order Tool
The easiest way to see Disk and CD/DVD filters is using Filter Driver Load Order tool. (For other types of devices see Method 2)
An example of using the tool shown below. Note:

• The left pane displays all the Disks and CD/DVDs found on the computer
• When i select the TSSTcorp DVD device in the example, we see
  • The right pane displays all the filters for the TSSTcorp device. Note these filters happen to include
    >>> Both upper and lower filters as well as class and device filters
    >>> The "Device Object". This is the main device driver (the main driver is called the function driver)
  • When i select a filter, you'll see its file Version Information is displayed
  Important note: This tool displays the registry's view of filters
  • If a filter is defined in the registry yet the filter file is missing, this can cause driver errors
  • In such a case, you'll see the Version Info->File Location missing or equal to N/A
  • Also note: It is OK if other Version Info fields equal N/A or missing BUT NOT the File Location!
  • For this case, removing the filter from the registry can help fix the problem
• Use the Clipboard button to get a text report about all the filters. Then you can simply paste the report where ever you like

Method 2- How to view class filters in the Windows registry
This method displays device class data stored in the Windows registry. Note this method
> Only finds the class filters (both Upper and Lower - if they exist)
> Does not display device filters but that's OK as you really only need to check on class fiters

For this method, we'll use the Regjump tool to help you quickly navigate directly to the right registry key

• Download Regjump. Unzip it and store its unpacked files in C:\Windows\system32
• Open a command prompt window
  > For XP, click Start->Run, enter: cmd
  > For Vista, you must open an elevated command prompt for Regjump to work. (For instructions click here
• Copy / paste one of the following commands after the command prompt
  > Choose the command for the device class you want to see: DiskDrive, CDROM, or MEDIA