I’ve added some code to the Windows Filtering Platform MSNMNTR sample for my own application, but it still has the same structure. I’ve compiled the driver and the application for Win8 64-bit and production-signed the driver. On the (virtual) machine that I built the code on, the sample works fine and monitors correctly. When I copy the inf, sys and exe to another machine, the sample does NOT monitor. Through traceview output, I can see that on the second machine, DriverEntry() is not called, therefore the flow controls are never set up. The two machines are running the release version of Win8. It doesn’t appear to be an issue with my new code, since the driver works fine on machine #1, and it doesn’t appear to be a signature problem because when I turn off signature enforcement on machine #2 I still have the problem. Both the release and debug versions of the code have the same issue. The steps I use to set up and run the code are below. What are some things that might cause this behavior?
- Copy driver .pdbs to a folder for traceview.
- Right-click .inf and choose “Install”
- Run “net start msnmntr” from an elevated command prompt.
- Start traceview as administrator.
- Run “monitor monitor “C:\Program Files\Internet Explorer\iexplore.exe”” from an elevated command prompt.
P.S. I haven’t put windbg on this yet, but I will update the question with the results as soon as I try it.
Edited to add: OK, I ran the kernel-mode debugger on both machines and saw a difference in behavior. First of all, DriverEntry does get called on both machines. I was mistaken about that. However, on the machine where the code works (i.e. monitors web traffic) DriverEntry gets called when monitor.exe is run (step 5 above), and on the machine where the code does not work DriverEntry gets called when “net start msnmntr” (step 3 above) is executed.
The problem was that I had not installed the callouts via “monitor addcallouts” on the second machine. Since this is a one-time step, I had forgotten I did it weeks ago on the original machine.