More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

Best Of

Re: Blackbone library issues when injecting DLL from PsSetLoadImageNotifyRoutineEx callback

Seriously... This is a hacker thing, right?

Why would we help you with this? You KNOW what we do on this forum, right?

Peter

Peter_Viscarola_(OSR)

Re: RtlStringCchPrintfExW vs _snwprintf

I've determined it is the VS update, not WDK/SDK. That is actually worse as it it potentially impacts building release branch builds. This is yet another example of why a production CI/CD environment for windows drivers should use the self-contained EWDK toolkits and not rely on the fragile integration of VS and WDK.

Mark_Roddy

Re: Real time detecting of mutex objects

would be nice if ObCallbacks notified for mutex objects

Nope. As we’ve said, I think, several times by now, they do not.

I apologize, but I find this whole notion laughable. Singling out Mutex objects is, from my limited point of view as a mere kernel dev and not any sort of security or malware researcher, simply ridiculous. These are not the only objects that can be named. So, why choose Mutex for special treatment? Asking for and/or expecting a callback for the instantiation of a simple kernel synchronization primitive is foolish. The callback can create more overhead overhead than the instantiation... for something that might be done frequently.

OK... I realize my editorializing on this has no real point behind satisfying myself.

Peter

Peter_Viscarola_(OSR)

Re: Get SID from IO_SECURITY_CONTEXT in PreCreate

That client token address is bogus. Looks like the start of a pool block instead of a valid pointer:

0: kd> .formats 0x3066744e03030000 
Evaluate expression:
..
  Chars:   0ftN....
..

So, you're grabbing the wrong pointer somehow (or you're looking at freed memory). I recently posted a working example here if you want to try that.

Scott_Noone_(OSR)

Re: DPC_WATCHDOG_VIOLATION (133) with parameter 1

@parsa Some advice: If your post doesn’t show up, posting it again multiple times probably won’t help. What it will do is create a mess that we have to manually clean up.

As it says in the sticky at the top of this forum if your post does not show up after you’ve submitted it, it’s probably in the spam queue. Post a note in the A&A section asking a mod to free it.

But lease don’t just post it again, multiple times.

Peter

Peter_Viscarola_(OSR)

Re: Service hang with Critical section lock

Did you verify thread(af8.3aa8) raw call stack? If not please try that. You can use dps command.

Saikrishna_Ravikanti

Re: How to convert DOS file path to usable driver format?

Prepend \??\ so c:\foo\bar.txt becomes \??\c:\foo\bar.txt.

rod_widdowson

Re: 2 (or more) identical PCIe cards in PC

Two interesting factoids here. First, manufacturers almost never number their PCIe slots in a human-readable way. Second, the slots will always enumerate in the same order. No web site will promise that, but it's true. When we've had this problem with USB cameras, we have the application present two images and say "which of these is camera 1"? Or, sometimes, "by what name should we call THIS camera?"

Tim_Roberts

Re: 2 (or more) identical PCIe cards in PC

Have the program store the configuration in the Registry, where the driver can read it and do something appropriate with it. Change the Interface reference string, create a distinct device name, or implement an IOCTL that returns which device is which.

This isn’t a Windows challenge so much as a logical challenge for you to figure out how to distinguish one device from the other. Consider running the config program, disconnecting both external interface, then connecting the first interface... that allows the config program and driver to identity which device is connected to that interface. Or something similar.

It’s device dependent, right?

Peter

Peter_Viscarola_(OSR)

Re: 2 (or more) identical PCIe cards in PC

the slots will always enumerate in the same order. No web site will promise that, but it's true

So, what Mr. Roberts is saying here is that if CardX is enumerated before CardY today, then CardX will always be enumerated before CardY.

That's a reasonable bet, but not one that I'd (quite frankly) be willing to make or on which I'd be willing to base a product.

But, then again... I don't think the OP asked this question in any case.

I had a client who added a bus extender card and box that confused things on some systems

So, the OP asked specifically about whether the b:d:f can change.

The reason I didn't comment on this specific question is (a) it's not really relevant (I mean, who cares if your first card is 1:2:0 and your second is 2:3:0??), and (b) I'm just not sure that given things like Thunderbolt and "bus extenders" as Mr. Burn noted, the B:D:F of a given device can't change.

I would definitely expect it to NOT change, but again... this isn't something I'd personally be willing to base a product.

Mr. Roberts gave you an example of the heuristic that's best to use: Your user runs a config program. You ask them something about one of the devices (Mr. Roberts' camera case... or think of how you identify which monitor is connected to a given port on a graphics card) , and you use this user action to identify that particular device.

Like I said... this isn't a Windows OS architecture challenge -- It's a "how clever are you" challenge to figure out a way to allow your users to identify each device instance and then store that id info somewhere that your driver can retrieve it.

Peter

Peter_Viscarola_(OSR)