Windows文件系统迷你过滤驱动编译无错但未生成.sys文件

安全阿岳

2026-6-14

问题：Windows迷你过滤驱动编译无错但未生成.sys文件

开发环境

开发工具：Visual Studio（最新版本）、Windows Driver Kit（WDK）、Windows SDK
配置情况：已手动配置项目属性的Include和Lib路径指向WDK目录，编译过程无错误，但输出目录中未生成.sys文件

核心代码

C代码

PFLT_FILTER FilterHandle = NULL;

NTSTATUS MiniUnload(FLT_FILTER_UNLOAD_FLAGS Flags);
FLT_POSTOP_CALLBACK_STATUS MiniPostCreate(
    PFLT_CALLBACK_DATA Data,
    PCFLT_RELATED_OBJECTS FltObjects,
    PVOID* CompletionContext,
    FLT_POST_OPERATION_FLAGS Flags
);
FLT_PREOP_CALLBACK_STATUS MiniPreCreate(
    PFLT_CALLBACK_DATA Data,
    PCFLT_RELATED_OBJECTS FltObjects,
    PVOID* CompletionContext
);
FLT_PREOP_CALLBACK_STATUS MiniPreWrite(
    PFLT_CALLBACK_DATA Data,
    PCFLT_RELATED_OBJECTS FltObjects,
    PVOID* CompletionContext
);

// Callback array
const FLT_OPERATION_REGISTRATION Callbacks[] = {
    {IRP_MJ_CREATE, 0, MiniPreCreate, MiniPostCreate},
    {IRP_MJ_WRITE, 0, MiniPreWrite, NULL},
    {IRP_MJ_OPERATION_END}
};

// Filter registration structure
const FLT_REGISTRATION FilterRegistration = {
    sizeof(FLT_REGISTRATION),       // Size
    FLT_REGISTRATION_VERSION,       // Version
    0,                              // Flags
    NULL,                           // Context
    Callbacks,                      // Operation callbacks
    MiniUnload,                     // Unload callback
    NULL,                           // Instance setup callback
    NULL,                           // Instance query teardown callback
    NULL,                           // Instance teardown start callback
    NULL,                           // Instance teardown complete callback
    NULL,                           // Generate file name callback
    NULL,                           // Normalize name component callback
    NULL,                           // Normalize context cleanup callback
    NULL                            // Transaction callbacks
};

NTSTATUS MiniUnload(FLT_FILTER_UNLOAD_FLAGS Flags)
{
    KdPrint(("Driver unloaded \r\n"));
    FltUnregisterFilter(FilterHandle);
    return STATUS_SUCCESS;
}

FLT_POSTOP_CALLBACK_STATUS MiniPostCreate(
    PFLT_CALLBACK_DATA Data,
    PCFLT_RELATED_OBJECTS FltObjects,
    PVOID* CompletionContext,
    FLT_POST_OPERATION_FLAGS Flags
)
{
    KdPrint(("Post create is running \r\n"));
    return FLT_POSTOP_FINISHED_PROCESSING;
}

FLT_PREOP_CALLBACK_STATUS MiniPreCreate(
    PFLT_CALLBACK_DATA Data,
    PCFLT_RELATED_OBJECTS FltObjects,
    PVOID* CompletionContext
)
{
    PFLT_FILE_NAME_INFORMATION FileNameInfo;
    NTSTATUS status;
    WCHAR Name[200] = { 0 };

    status = FltGetFileNameInformation(
        Data,
        FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT,
        &FileNameInfo
    );

    if (NT_SUCCESS(status)) {
        status = FltParseFileNameInformation(FileNameInfo);

        if (NT_SUCCESS(status)) {
            if (FileNameInfo->Name.MaximumLength < 260) {
                RtlCopyMemory(Name, FileNameInfo->Name.Buffer, FileNameInfo->Name.MaximumLength);
                KdPrint(("Create file: %ws \r\n", Name));
            }
        }

        FltReleaseFileNameInformation(FileNameInfo);
    }

    return FLT_PREOP_SUCCESS_WITH_CALLBACK;
}

FLT_PREOP_CALLBACK_STATUS MiniPreWrite(
    PFLT_CALLBACK_DATA Data,
    PCFLT_RELATED_OBJECTS FltObjects,
    PVOID* CompletionContext
)
{
    PFLT_FILE_NAME_INFORMATION FileNameInfo;
    NTSTATUS status;
    WCHAR Name[200] = { 0 };

    status = FltGetFileNameInformation(
        Data,
        FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT,
        &FileNameInfo
    );

    if (NT_SUCCESS(status)) {
        status = FltParseFileNameInformation(FileNameInfo);

        if (NT_SUCCESS(status)) {
            if (FileNameInfo->Name.MaximumLength < 260) {
                RtlCopyMemory(Name, FileNameInfo->Name.Buffer, FileNameInfo->Name.MaximumLength);
                _wcsupr(Name);

                if (wcsstr(Name, L"OPENME.TXT") != NULL) {
                    KdPrint(("Write file: %ws blocked \r\n", Name));
                    Data->IoStatus.Status = STATUS_INVALID_PARAMETER;
                    Data->IoStatus.Information = 0;
                    FltReleaseFileNameInformation(FileNameInfo);
                    return FLT_PREOP_COMPLETE;
                }

                KdPrint(("Create file: %ws \r\n", Name));
            }
        }

        FltReleaseFileNameInformation(FileNameInfo);
    }

    return FLT_PREOP_SUCCESS_NO_CALLBACK;
}

NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
    NTSTATUS status;

    status = FltRegisterFilter(DriverObject, &FilterRegistration, &FilterHandle);

    if (NT_SUCCESS(status)) {
        status = FltStartFiltering(FilterHandle);

        if (!NT_SUCCESS(status)) {
            FltUnregisterFilter(FilterHandle);
        }
    }

    return status;
}

INF文件

[Version]
Signature   = "$Windows NT$"
Class       = "ActivityMonitor"
ClassGuid   = {b86dff51-a31e-4bac-b3cf-e8cfe75c9fc2}
Provider    = "HelloWorld Corporation"
DriverVer   = 
CatalogFile = HelloWorld.cat

[DestinationDirs]
DefaultDestDir          = 12
MiniFilter.DriverFiles  = 12            ; %windir%\system32\drivers

[DefaultInstall]
OptionDesc          = %ServiceDescription%
CopyFiles           = MiniFilter.DriverFiles

[DefaultInstall.Services]
AddService          = %ServiceName%,,MiniFilter.Service

[DefaultUninstall]
DelFiles   = MiniFilter.DriverFiles

[DefaultUninstall.Services]
DelService = %ServiceName%,0x200

[MiniFilter.Service]
DisplayName      = "HelloWorld Service"
Description      = "HelloWorld Mini-Filter Driver"
ServiceBinary    = %12%\HelloWorld.sys
Dependencies     = "FltMgr"
ServiceType      = 2
StartType        = 3
ErrorControl     = 1
LoadOrderGroup   = "FSFilter Activity Monitor"
AddReg           = MiniFilter.AddRegistry

[MiniFilter.AddRegistry]
HKR,,"DebugFlags",0x00010001,0x0
HKR,,"SupportedFeatures",0x00010001,0x3
HKR,"Instances","DefaultInstance",0x00000000,%DefaultInstance%
HKR,"Instances\"%Instance1.Name%","Altitude",0x00000000,%Instance1.Altitude%
HKR,"Instances\"%Instance1.Name%","Flags",0x00010001,%Instance1.Flags%

[MiniFilter.DriverFiles]
HelloWorld.sys

[SourceDisksFiles]
HelloWorld.sys = 1,,

[SourceDisksNames]
1 = %DiskId1%,,,

[Strings]
ManufacturerName        = "HelloWorld Corporation"
ServiceDescription      = "HelloWorld Mini-Filter Driver"
ServiceName             = "HelloWorld"
DriverName              = "HelloWorld"
DiskId1                 = "HelloWorld Device Installation Disk"

DefaultInstance         = "HelloWorld Instance"
Instance1.Name          = "HelloWorld Instance"
Instance1.Altitude      = "371000"
Instance1.Flags         = 0x0

已尝试操作

确认项目属性“配置属性>驱动设置”中已选择驱动类型
验证“配置属性>常规”中的目标平台为Desktop

核心疑问

编译过程无错误提示，但输出目录始终未生成.sys文件，求排查原因及确保生成.sys文件的解决办法

解决办法

1. 确认项目类型是否正确

若你是用普通Win32项目手动配置驱动编译，大概率会遗漏关键设置。建议直接用Visual Studio内置的File System Mini-Filter Driver模板创建项目，再将现有代码迁移进去——模板会自动配置驱动编译所需的链接器、子系统、入口点等核心参数。

2. 检查链接器关键配置

打开项目属性，依次检查：

配置属性>链接器>常规：确保输出文件设置为$(OutDir)\$(TargetName).sys
配置属性>链接器>系统：子系统选择Windows Driver，驱动选项设为Driver
配置属性>链接器>高级：入口点设为DriverEntry（注意大小写敏感）

3. 验证编译目标与驱动类型匹配

确认当前编译配置（Debug/Release）对应的目标平台（x86/x64/ARM64）与测试环境一致
检查配置属性>驱动设置>常规：驱动类型必须选择File System Mini-Filter，而非其他驱动类型

4. 检查WDK集成完整性

打开Visual Studio的工具>获取工具和功能，确认已安装对应版本WDK与VS的集成组件，且WDK和Windows SDK版本兼容
项目属性的VC++目录无需手动添加WDK路径，模板会自动配置；手动添加可能导致版本不匹配，引发隐性问题

5. 查看编译输出日志细节

编译时打开输出窗口（视图>输出），切换到生成日志，检查是否有隐藏的警告或链接阶段问题（比如找不到驱动库、符号未定义等）——这类问题可能不触发编译错误，但会跳过.sys文件的生成

6. 修复INF文件的DriverVer字段

你的INF文件中DriverVer字段为空，虽不直接影响.sys生成，但会导致后续安装失败。建议补充版本信息，格式为MM/DD/YYYY,X.X.X.X，例如01/01/2024,1.0.0.0

内容的提问来源于stack exchange，提问作者Ritesh Parwal

Windows文件系统迷你过滤驱动编译无错但未生成.sys文件

开发环境 #

核心代码 #

C代码 #

INF文件 #

已尝试操作 #

核心疑问 #

解决办法 #

1. 确认项目类型是否正确 #

2. 检查链接器关键配置 #

3. 验证编译目标与驱动类型匹配 #

4. 检查WDK集成完整性 #

5. 查看编译输出日志细节 #

6. 修复INF文件的DriverVer字段 #