Opening a remote IO target

Wilson_Chew · September 22, 2008, 11:07pm

Hi all, I am trying to send IOCTL from one driver to another remote driver (not the same stack). The steps I took is firstly, WdfIoTargetCreate(), then, WDF_IO_TARGET_OPEN_PARAMS_INIT_OPEN_BY_NAME() and WdfIoTargetOpen().

So my question is, the 2nd parameter of WDF_IO_TARGET_OPEN_PARAMS_INIT_OPEN_BY_NAME() is the TargetDeviceName which I provide the device interface of the remote driver “\\?\root#sample#0000#{cdc35b6e-0be4-4936-bf5f-5537380a7c1a}”.

Am I doing the right way? I am getting bug check when i tried to run it.

Thank you.

Regards,
Wilson

Doron_Holan · September 23, 2008, 2:12am

That should be the right way to do it. Please post the code (including how you got the string) and the output of !analyze -v

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@hotmail.com
Sent: Monday, September 22, 2008 8:08 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Opening a remote IO target

Hi all, I am trying to send IOCTL from one driver to another remote driver (not the same stack). The steps I took is firstly, WdfIoTargetCreate(), then, WDF_IO_TARGET_OPEN_PARAMS_INIT_OPEN_BY_NAME() and WdfIoTargetOpen().

So my question is, the 2nd parameter of WDF_IO_TARGET_OPEN_PARAMS_INIT_OPEN_BY_NAME() is the TargetDeviceName which I provide the device interface of the remote driver “\\?\root#sample#0000#{cdc35b6e-0be4-4936-bf5f-5537380a7c1a}”.

Am I doing the right way? I am getting bug check when i tried to run it.

Thank you.

Regards,
Wilson

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Wilson_Chew · September 23, 2008, 2:35am

Hi doron, thank you for the fast respond. I did not use any unicode or ansi string object for my string. Apology if my coding style is not very good. My driver code:

NTSTATUS
FmForwardEchoIOTarget(
IN WDFREQUEST Request,
IN WDFDEVICE device
){

WDFIOTARGET ioTarget;
WDF_IO_TARGET_OPEN_PARAMS openParams;
NTSTATUS status = STATUS_SUCCESS;
WDF_REQUEST_SEND_OPTIONS sendOption;

PAGED_CODE();

status = WdfIoTargetCreate(
device,
WDF_NO_OBJECT_ATTRIBUTES,
&ioTarget );

if (!NT_SUCCESS(status)) {
KdPrint((“IO Target create failed\n”));
return status;
}

WDF_IO_TARGET_OPEN_PARAMS_INIT_OPEN_BY_NAME(
&openParams,
“\\?\root#sample#0000#{cdc35b6e-0be4-4936-bf5f-5537380a7c1a}”,
STANDARD_RIGHTS_ALL);

status = WdfIoTargetOpen(
ioTarget,
&openParams);

if (!NT_SUCCESS(status)) {
KdPrint((“IO Target open failed\n”));
}

WdfObjectDelete(ioTarget);
return status;
}

Doron_Holan · September 23, 2008, 2:59am

I asked for the output of !analyze -v. that means you need to hook up a debugger, at the very least open up the dump file in windbg
how does this even compile? The prototype for WDF_IO_TARGET_OPEN_PARAMS_INIT_CREATE_BY_NAME is this

VOID
WDF_IO_TARGET_OPEN_PARAMS_INIT_CREATE_BY_NAME(
OUT PWDF_IO_TARGET_OPEN_PARAMS Params,
IN PUNICODE_STRING TargetDeviceName,
IN ACCESS_MASK DesiredAccess
);

Note the 2nd parameter is a PUNICODE_STRING, not a PSTR (which is not even the right type of string, you need to init the UNICODE_STRING with a PWSTR)

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@hotmail.com
Sent: Monday, September 22, 2008 11:35 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Opening a remote IO target

Hi doron, thank you for the fast respond. I did not use any unicode or ansi string object for my string. Apology if my coding style is not very good. My driver code:

NTSTATUS
FmForwardEchoIOTarget(
IN WDFREQUEST Request,
IN WDFDEVICE device
){

WDFIOTARGET ioTarget;
WDF_IO_TARGET_OPEN_PARAMS openParams;
NTSTATUS status = STATUS_SUCCESS;
WDF_REQUEST_SEND_OPTIONS sendOption;

PAGED_CODE();

status = WdfIoTargetCreate(
device,
WDF_NO_OBJECT_ATTRIBUTES,
&ioTarget );

if (!NT_SUCCESS(status)) {
KdPrint((“IO Target create failed\n”));
return status;
}

WDF_IO_TARGET_OPEN_PARAMS_INIT_OPEN_BY_NAME(
&openParams,
“\\?\root#sample#0000#{cdc35b6e-0be4-4936-bf5f-5537380a7c1a}”,
STANDARD_RIGHTS_ALL);

status = WdfIoTargetOpen(
ioTarget,
&openParams);

if (!NT_SUCCESS(status)) {
KdPrint((“IO Target open failed\n”));
}

WdfObjectDelete(ioTarget);
return status;
}

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

David_R_Cattley · September 23, 2008, 7:57am

The ‘name’ in

WDF_IO_TARGET_OPEN_PARAMS_INIT_OPEN_BY_NAME(
&openParams,

“\\?\root#sample#0000#{cdc35b6e-0be4-4936-bf5f-5537380a7c1a}”,
STANDARD_RIGHTS_ALL);

Seems to be incorrect. This macro takes a pointer to a UNICODE_STRING
(PUNICODE_STRING) structure, not a wide character string.

Try something more like this:

DECLARE_CONST_UNICODE_STRING(targetDeviceName,
L"\\?\root#sample#0000#{cdc35b6e-0be4-4936-bf5f-5537380a7c1a}");

…

WDF_IO_TARGET_OPEN_PARAMS_INIT_OPEN_BY_NAME(&openParams,
&targetDeviceName, STANDARD_RIGHTS_ALL);

That will probably work much better. You are passing PCSTR (char*) pointer
to the macro when it is expecting a PUNICODE_STRING. Don’t forget that all
of this is WCHAR and that a L"" prefix is needed on the constant string
value to make it a WCHAR string.

Out of curiosity, does the compiler complain about this line of code? The
WDF_IO_TARGET_OPEN_PARAMS_INIT_OPEN_BY_NAME is a FORCEINLINE function with
TargetDeviceName declared as PUNICODE_STRING. A const char * is definitely
not the same type as a struct _UNICODE_STRING* and thus the compiler should
have warned that the pointer types don’t match.

Good Luck,
Dave Cattley
Consulting Engineer
Systems Software Development

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@hotmail.com
Sent: Tuesday, September 23, 2008 2:35 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Opening a remote IO target

Hi doron, thank you for the fast respond. I did not use any unicode or ansi
string object for my string. Apology if my coding style is not very good. My
driver code:

NTSTATUS
FmForwardEchoIOTarget(
IN WDFREQUEST Request,
IN WDFDEVICE device
){

WDFIOTARGET ioTarget;
WDF_IO_TARGET_OPEN_PARAMS openParams;
NTSTATUS status = STATUS_SUCCESS;
WDF_REQUEST_SEND_OPTIONS sendOption;

PAGED_CODE();

status = WdfIoTargetCreate(
device,
WDF_NO_OBJECT_ATTRIBUTES,
&ioTarget );

if (!NT_SUCCESS(status)) {
KdPrint((“IO Target create failed\n”));
return status;
}

WDF_IO_TARGET_OPEN_PARAMS_INIT_OPEN_BY_NAME(
&openParams,

“\\?\root#sample#0000#{cdc35b6e-0be4-4936-bf5f-5537380a7c1a}”,
STANDARD_RIGHTS_ALL);

status = WdfIoTargetOpen(
ioTarget,
&openParams);

if (!NT_SUCCESS(status)) {
KdPrint((“IO Target open failed\n”));
}

WdfObjectDelete(ioTarget);
return status;
}

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Wilson_Chew · September 23, 2008, 9:25pm

Hi Dave, the compiler did not complain about it at all (not even a warning, am using the checked build environment). Yes I have changed the name to a unicode string and no more BSoD. Tks alot Dave and Doron.

The problem I am facing now is that when I run my user mode app to create a handle to the driver( CreateFile()), I am able to get the handle but when I do it in kernel mode( using WdfIoTargetOpen()), I get a NTSTATUS of 0xC0000033 (STATUS_OBJECT_NAME_INVALID). I am using the same device interface as what I have posted here for both my user mode app and kernel mode driver.

Thank you.

Wilson

Doron_Holan · September 24, 2008, 12:22am

How did you get the string? Did you copy it from your user mode app? If so, the format for symbolic links is different in KM vs UM. Call IoGetDeviceInterfaces with your GUID to get the sym link string or register a pnp notification callback (IoRegisterPlugPlayNotification with your GUID) to be notified when the instance shows up.

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@hotmail.com
Sent: Tuesday, September 23, 2008 6:26 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Opening a remote IO target

Hi Dave, the compiler did not complain about it at all (not even a warning, am using the checked build environment). Yes I have changed the name to a unicode string and no more BSoD. Tks alot Dave and Doron.

The problem I am facing now is that when I run my user mode app to create a handle to the driver( CreateFile()), I am able to get the handle but when I do it in kernel mode( using WdfIoTargetOpen()), I get a NTSTATUS of 0xC0000033 (STATUS_OBJECT_NAME_INVALID). I am using the same device interface as what I have posted here for both my user mode app and kernel mode driver.

Thank you.

Wilson

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Wilson_Chew · September 24, 2008, 11:13pm

Hi Doron,

Have tried using IoGetDeviceInterfaces() to grab the symbolic links, printed it out using debug and the string looks like this “???\Root#SAMPLE#0000#{cdc35b6e-0be4-4936-bf5f-5537380a7c1a}”. This time I get a NTSTATUS of 0xC000003B (STATUS_OBJECT_PATH_SYNTAX_BAD) when I tried to open the target.

The code snippet on how I grab the string:

PWSTR pSymbolicNameList = NULL;
UNICODE_STRING deviceInterface;
//////////////////////////////////////////////////////////////////////////////////////
// get the symbolic link of echo app
//////////////////////////////////////////////////////////////////////////////////////
status = IoGetDeviceInterfaces(
(LPGUID)&GUID_DEVINTERFACE_ECHO,
NULL,
0,
&pSymbolicNameList);

if (NT_SUCCESS(status) && (NULL != pSymbolicNameList))
{
RtlInitUnicodeString(&deviceInterface, pSymbolicNameList);
ExFreePool(pSymbolicNameList);

KdPrint((“Echo Device interface is %wZ \n”, &deviceInterface));
}
else{
if(NULL != pSymbolicNameList)
KdPrint((“Io Get Device Interfaces failed\n”));
else
KdPrint((“No echo device found failed\n”));
}
//////////////////////////////////////////////////////////////////////////////////////

Thank you.

Regards,
Wilson

Doron_Holan · September 25, 2008, 2:36am

I hope you realize that RtlInitUnicodeString does not make a copy of the buffer (pSymbolicNameList) that you pass in. that means that you are freeing the memory and the dereferencing freed memory in your KdPrint and subsequent attempt to open the target. Try freeing the buffer when you are done with it, not at the start.

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@hotmail.com
Sent: Wednesday, September 24, 2008 8:13 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Opening a remote IO target

Hi Doron,

Have tried using IoGetDeviceInterfaces() to grab the symbolic links, printed it out using debug and the string looks like this “???\Root#SAMPLE#0000#{cdc35b6e-0be4-4936-bf5f-5537380a7c1a}”. This time I get a NTSTATUS of 0xC000003B (STATUS_OBJECT_PATH_SYNTAX_BAD) when I tried to open the target.

The code snippet on how I grab the string:

PWSTR pSymbolicNameList = NULL;
UNICODE_STRING deviceInterface;
//////////////////////////////////////////////////////////////////////////////////////
// get the symbolic link of echo app
//////////////////////////////////////////////////////////////////////////////////////
status = IoGetDeviceInterfaces(
(LPGUID)&GUID_DEVINTERFACE_ECHO,
NULL,
0,
&pSymbolicNameList);

if (NT_SUCCESS(status) && (NULL != pSymbolicNameList))
{
RtlInitUnicodeString(&deviceInterface, pSymbolicNameList);
ExFreePool(pSymbolicNameList);

KdPrint((“Echo Device interface is %wZ \n”, &deviceInterface));
}
else{
if(NULL != pSymbolicNameList)
KdPrint((“Io Get Device Interfaces failed\n”));
else
KdPrint((“No echo device found failed\n”));
}
//////////////////////////////////////////////////////////////////////////////////////

Thank you.

Regards,
Wilson

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Wilson_Chew · September 25, 2008, 2:56am

Hi Doron, thank you for your help. I do have alot to learn in driver development. Really appreciate the patient and help from the people here.

Regards,
Wilson