无法部署Minifilter驱动：启动失败错误2排查求助

问题背景 #

已在本地构建Minifilter驱动，完成以下操作后启动失败：

1. 禁用驱动签名强制；
2. 用sc create命令创建服务，服务条目已出现在HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services中；
3. 执行sc start或fltmc load时，报错[SC] StartService FAILED 2: 系统找不到指定的文件。

相关代码 #

驱动C代码 #

#include <fltKernel.h>
#include <dontuse.h>
#include <suppress.h>
PFLT_FILTER FilterHandle = NULL;
// Function declarations
NTSTATUS MiniUnload(FLT_FILTER_UNLOAD_FLAGS Flags);
FLT_POSTOP_CALLBACK_STATUS MiniPostCreate(
    PFLT_CALLBACK_DATA Data, 
    PCFLT_RELATED_OBJECTS FltObjects, 
    PVOID* CompletionContext, 
    FLT_POST_OPERATION_FLAGS Flags
);
FLT_PREOP_CALLBACK_STATUS MiniPreCreate(
    PFLT_CALLBACK_DATA Data, 
    PCFLT_RELATED_OBJECTS FltObjects, 
    PVOID* CompletionContext
);
FLT_PREOP_CALLBACK_STATUS MiniPreWrite(
    PFLT_CALLBACK_DATA Data, 
    PCFLT_RELATED_OBJECTS FltObjects, 
    PVOID* CompletionContext
);
// Callback structure
const FLT_OPERATION_REGISTRATION Callbacks[] = {
    { IRP_MJ_CREATE, 0, MiniPreCreate, MiniPostCreate },
    { IRP_MJ_WRITE, 0, MiniPreWrite, NULL },
    { IRP_MJ_OPERATION_END }
};
// Filter registration structure
const FLT_REGISTRATION FilterRegistration = {
    sizeof(FLT_REGISTRATION),             // Size
    FLT_REGISTRATION_VERSION,             // Version
    0,                                    // Flags
    NULL,                                 // Context registration
    Callbacks,                            // Operation callbacks
    MiniUnload,                           // Unload routine
    NULL,                                 // Instance setup
    NULL,                                 // Instance query teardown
    NULL,                                 // Instance teardown start
    NULL,                                 // Instance teardown complete
    NULL,                                 // Generate file name
    NULL,                                 // Normalize name component
    NULL,                                 // Normalize context cleanup
    NULL                                  // Transaction notification
};
// Unload routine
NTSTATUS MiniUnload(FLT_FILTER_UNLOAD_FLAGS Flags)
{
    KdPrint(("Driver unloaded \r\n"));
    FltUnregisterFilter(FilterHandle);
    return STATUS_SUCCESS;
}
// Post-create callback
FLT_POSTOP_CALLBACK_STATUS MiniPostCreate(
    PFLT_CALLBACK_DATA Data, 
    PCFLT_RELATED_OBJECTS FltObjects, 
    PVOID* CompletionContext, 
    FLT_POST_OPERATION_FLAGS Flags
)
{
    KdPrint(("Post create is running \r\n"));
    return FLT_POSTOP_FINISHED_PROCESSING;
}
// Pre-create callback
FLT_PREOP_CALLBACK_STATUS MiniPreCreate(
    PFLT_CALLBACK_DATA Data, 
    PCFLT_RELATED_OBJECTS FltObjects, 
    PVOID* CompletionContext
)
{
    PFLT_FILE_NAME_INFORMATION FileNameInfo;
    NTSTATUS status;
    WCHAR Name[200] = { 0 };
    status = FltGetFileNameInformation(
        Data, 
        FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, 
        &FileNameInfo
    );
    if (NT_SUCCESS(status))
    {
        status = FltParseFileNameInformation(FileNameInfo);
        if (NT_SUCCESS(status))
        {
            if (FileNameInfo->Name.MaximumLength < 260)
            {
                RtlCopyMemory(Name, FileNameInfo->Name.Buffer, FileNameInfo->Name.MaximumLength);
                KdPrint(("Create file: %ws \r\n", Name));
            }
        }
        FltReleaseFileNameInformation(FileNameInfo);
    }
    return FLT_PREOP_SUCCESS_WITH_CALLBACK;
}
// Pre-write callback
FLT_PREOP_CALLBACK_STATUS MiniPreWrite(
    PFLT_CALLBACK_DATA Data, 
    PCFLT_RELATED_OBJECTS FltObjects, 
    PVOID* CompletionContext
)
{
    PFLT_FILE_NAME_INFORMATION FileNameInfo;
    NTSTATUS status;
    WCHAR Name[200] = { 0 };
    status = FltGetFileNameInformation(
        Data, 
        FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, 
        &FileNameInfo
    );
    if (NT_SUCCESS(status))
    {
        status = FltParseFileNameInformation(FileNameInfo);
        if (NT_SUCCESS(status))
        {
            if (FileNameInfo->Name.MaximumLength < 260)
            {
                RtlCopyMemory(Name, FileNameInfo->Name.Buffer, FileNameInfo->Name.MaximumLength);
                _wcsupr(Name); // Convert name to uppercase
                if (wcsstr(Name, L"OPENME.TXT") != NULL)
                {
                    KdPrint(("Write file: %ws blocked \r\n", Name));
                    Data->IoStatus.Status = STATUS_INVALID_PARAMETER;
                    Data->IoStatus.Information = 0;
                    FltReleaseFileNameInformation(FileNameInfo);
                    return FLT_PREOP_COMPLETE;
                }
                KdPrint(("Create file: %ws \r\n", Name));
            }
        }
        FltReleaseFileNameInformation(FileNameInfo);
    }
    return FLT_PREOP_SUCCESS_NO_CALLBACK;
}
// Driver entry point
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
    NTSTATUS status;
    status = FltRegisterFilter(DriverObject, &FilterRegistration, &FilterHandle);
    if (NT_SUCCESS(status))
    {
        status = FltStartFiltering(FilterHandle);
        if (!NT_SUCCESS(status))
        {
            FltUnregisterFilter(FilterHandle);
        }
    }
    return status;
}

INF文件 #

;;
;;; HelloWorld
;;;

[Version]
Signature   = "$Windows NT$"
Class       = "ActivityMonitor"
ClassGuid   = {b86dff51-a31e-4bac-b3cf-e8cfe75c9fc2}
Provider    = "HelloWorld Corporation"
DriverVer   = 
CatalogFile = HelloWorld.cat

[DestinationDirs]
DefaultDestDir          = 12
MiniFilter.DriverFiles  = 12            ; %windir%\system32\drivers

[DefaultInstall]
OptionDesc          = %ServiceDescription%
CopyFiles           = MiniFilter.DriverFiles

[DefaultInstall.Services]
AddService          = %ServiceName%,,MiniFilter.Service

[DefaultUninstall]
DelFiles   = MiniFilter.DriverFiles

[DefaultUninstall.Services]
DelService = %ServiceName%,0x200

[MiniFilter.Service]
DisplayName      = "HelloWorld Service"
Description      = "HelloWorld Mini-Filter Driver"
ServiceBinary    = %12%\HelloWorld.sys
Dependencies     = "FltMgr"
ServiceType      = 2
StartType        = 3
ErrorControl     = 1
LoadOrderGroup   = "FSFilter Activity Monitor"
AddReg           = MiniFilter.AddRegistry

[MiniFilter.AddRegistry]
HKR,, "DebugFlags",0x00010001,0x0
HKR,, "SupportedFeatures",0x00010001,0x3
HKR,"Instances","DefaultInstance",0x00000000,%DefaultInstance%
HKR,"Instances\"%Instance1.Name%,"Altitude",0x00000000,%Instance1.Altitude%
HKR,"Instances\"%Instance1.Name%,"Flags",0x00010001,%Instance1.Flags%

[MiniFilter.DriverFiles]
HelloWorld.sys

[SourceDisksFiles]
HelloWorld.sys = 1,,

[SourceDisksNames]
1 = %DiskId1%,,,

[Strings]
ManufacturerName        = "HelloWorld Corporation"
ServiceDescription      = "HelloWorld Mini-Filter Driver"
ServiceName             = "HelloWorld"
DriverName              = "HelloWorld"
DiskId1                 = "HelloWorld Device Installation Disk"

DefaultInstance         = "HelloWorld Instance"
Instance1.Name          = "HelloWorld Instance"
Instance1.Altitude      = "371000"
Instance1.Flags         = 0x0

可能的错误点及解决步骤 #

1. sc create命令的binPath参数错误 #

• 问题：binPath=后面必须加空格，路径含空格时需用双引号包裹，遗漏空格或引号会导致路径解析错误。
• 验证：打开注册表HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<你的服务名>，查看ImagePath值是否与驱动实际完整路径完全一致（内核路径区分大小写）。
• 解决：先删除错误服务（sc delete <服务名>），再执行正确命令，例如：

  sc create HelloWorld binPath= "C:\Path\To\Your\HelloWorld.sys" type= kernel start= demand error= normal DisplayName= "HelloWorld Service"
  

2. 驱动文件位置或权限问题 #

• 问题：驱动文件未放到指定路径、路径输入错误，或存放目录无内核读取权限（如用户目录）。
• 验证：直接打开binPath指向的路径，确认HelloWorld.sys存在；优先使用C:\Windows\System32\drivers目录（驱动默认存放路径，权限可靠）。
• 解决：将驱动复制到C:\Windows\System32\drivers，重新创建服务时binPath设为%SystemRoot%\System32\drivers\HelloWorld.sys或绝对路径。

3. 驱动文件损坏或构建错误 #

• 问题：构建过程存在编译/链接错误，生成的.sys文件无效。
• 验证：查看Visual Studio构建输出窗口，确认无错误；用dumpbin工具验证驱动镜像有效性：

  dumpbin /headers HelloWorld.sys
  

  输出需包含FILE HEADER VALUES和OPTIONAL HEADER VALUES，且Subsystem为Native。
• 解决：修复构建错误，重新生成驱动文件。

4. INF文件与手动创建服务冲突 #

• 问题：INF文件中DriverVer字段为空，且同时手动用sc create创建服务，易导致配置冲突。
• 解决：删除手动创建的服务，用INF安装驱动：

  rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 132 .\HelloWorld.inf
  

  安装完成后用fltmc load HelloWorld启动驱动。

5. 系统架构不匹配 #

• 问题：驱动构建架构（x86/x64）与系统架构不一致。
• 验证：查看系统架构（右键此电脑→属性），确认Visual Studio解决方案平台选择的架构。
• 解决：重新构建对应架构的驱动文件。

内容的提问来源于stack exchange，提问作者Ritesh Parwal