New
#11
Think of filters as driver "add-on" parts. A driver consists of one or more functional blocks. Think of these blocks like Lego blocks. A driver may consist of a single block that stands alone or it can easily be attach to other blocks at any time. We typically think of "THE" driver as a single thing - but it may consist of one or more functional blocks.
A device driver starts with one Lego block. This block is called the "function" driver. The function driver provides the base hardware interface needed between Windows and the h/w.
Applications can extend driver functionality to support its needs. It adds-on extended functionality by connecting a new "Lego"
> Upper filters are functions (blocks) that precede the function driver
> Lower filters are functions (blocks) that follow the function driver
It's worth noting: There are "class" filters and "device" filters. Ignore device filters, it's the class filters that sometimes, but certainly not always, can cause problems. More specifically, it's class filters from 3rd parties (not Microsoft). If it's a Microsoft filter, it's OK.
When an app creates a class filter, the filter is added (connected) to the driver for every device in the class.
In this case, Magician created a class filter for class=DISK. Windows applies this class filter to every disk drive on the machine (internal disks, USB flash drives and external disks, etc). Perhaps their filter saves info about machine state and its behavior varies based on state of the machine. The machine state is probably different at the moment it's cloned vs. when the cloned filter is later called on the machine. Just an example of how that could be a bug.
Important point being: A driver actually consists of one OR MORE functional blocks. If any one block fails, the driver fails. When you go looking in Device Manager, it can be deceiving. When you open DevMgr, you're seeing the function driver for the device. You have to dig further, to understand if any filters have been attached to the function driver
btw... That's why, if a class filter is at fault, you can install/uninstall a device till your blue in face without fixing the problem. That's because you're only installing/uninstalling the function driver. The problem class filter still exists and is re-attached to the function driver when it's reinstalled
As an example of class filter: Say an app is implementing encryption in the software. The function driver for a disk remains the same. The app could create an upper class filter for device=Disk
> For disk writes, the DISK class upper filter gets the I/O request to any disk drive BEFORE it goes to the function driver. The filter encrypts the data and then passes it to the function driver to be written to disk
> For disk reads, the function driver reads encrypted data from disk. It's passed to the upper class filter which decrypts it before passing the unencrypted data up to the Windows app
Last edited by ComputerGeek; 20 Jul 2015 at 17:27.