EldoS | Feel safer!

Software components for data protection, secure storage and transfer

UninstallDriver call fails with exception 'There are no more files'

Also by EldoS: BizCrypto
Components for BizTalk® and SQL Server® Integration Services that let you securely store and transfer information in your business automation solutions.
#34544
Posted: 09/25/2015 10:53:40
by Chris Spiteri (Standard support level)
Joined: 10/06/2014
Posts: 57

Hello,

When uninstalling the driver via a CallbackFilter.UninstallDriver(string ProductName, ref bool RebootNeeded), the uninstallation fails and an exception 'There are no more files' is thrown.

To reproduce it, I am setting up some filter rules within our product executable to activate the filter and monitor some file activity. I then stop this program, and uninstall the filter from a separate executable as follows:

Code
try
{
  if (Filter.Active)
  {
      Logger.Trace("Detaching...");
      Filter.DetachFilter();
  }
  Logger.Trace("Disposing...");
  Filter.Dispose();
  Logger.Trace("Uninstalling...");
  CallbackFilter.UninstallDriver(ProductName, ref reboot);
}
catch (ECBFltError ex)
{
  Logger.Trace("ERROR: " + ex.Message);
  throw ex;
}


During the execution of the above code, the logs indicate that DetachFilter does not execute (because Filter.Active is false), Dispose() completes successfully, while UninstallDriver(..) throws the exception 'There are no more files'.

Executing the same code a second time results in a successful uninstallation.

We are using filter v3.1.91.92.

Let me know if you require further information.

Kind regards,
Chris
#34546
Posted: 09/25/2015 11:19:30
by Vladimir Cherniga (EldoS Corp.)

Filter.Dispose() call detach filter in the case if it is in active state. It is also delete all assigned rules internally. In order to check the filter state, you need to create filter instance and call AttachFilter to activate it. So doing this check (Filter.Active) from another process doesn't have sense, because you are using a different filter instances. UninstallDriver api may raise an exception with ERROR_ACCESS_DENIED code if any active filter instance exists. Could you check the Windows system log, does any related messages created as a result of your code execution ?
#34547
Posted: 09/25/2015 11:52:25
by Chris Spiteri (Standard support level)
Joined: 10/06/2014
Posts: 57

Thank you for your reply.

I cannot find any ERROR_ACCESS_DENIED events (or any other similar events) in the system log.

The only events i can see are from the FilterManager when the filter installs and uninstall successfully.

One thing i forgot to mention is that I install the filter in minifilter mode.

How do i suggest i proceed next?

Regards,
Chris
#34548
Posted: 09/25/2015 13:14:53
by Vladimir Cherniga (EldoS Corp.)

Thank you for the information. Do you get the same results if you uninstall driver in separate process using only one line of code ?
Code
    try
    {
      CallbackFilter.UninstallDriver(ProductName, ref reboot);
    }
    catch (ECBFltError ex)
    {
      Logger.Trace("ERROR: " + ex.Message);
      throw ex;
    }
#34551
Posted: 09/28/2015 04:27:20
by Chris Spiteri (Standard support level)
Joined: 10/06/2014
Posts: 57

I removed the extra lines to leave just the uninstall call, but it made no difference, i.e. i still get the same exception.
#34552
Posted: 09/28/2015 05:06:18
by Vladimir Cherniga (EldoS Corp.)

I will move the question to helpdesk system for further investigation.
Also by EldoS: BizCrypto
Components for BizTalk® and SQL Server® Integration Services that let you securely store and transfer information in your business automation solutions.

Reply

Statistics

Topic viewed 4335 times

Number of guests: 1, registered members: 0, in total hidden: 0




|

Back to top

As of July 15, 2016 EldoS Corporation will operate as a division of /n software inc. For more information, please read the announcement.

Got it!