Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTDEV
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


How to read disk sectors in windows using ATA PIO Mode?

kernelboikernelboi Member Posts: 19
edited June 24 in NTDEV

I was reading this paper : Exposing Bootkits with BIOS Emulation

and in it there is a sudo code for using ATA PIO mode to read from disk and bypass rootkit hooks, but there is not much information about it and it doesn't explain how to implement it and doesn't explain it

so is there any open source project or a book or something that i can look at that does this or at least explains in detail how its done? the lowest level programming i have done is writing simple minifilter drivers and such, so i've never implemented something this low level close to hardware

also is this possible to do from user-mode or it has to be implemented in a kernel module?

Comments

  • RourkeRourke Member Posts: 53

    ATA is an ancient interface that was popular in the 1990's. The industry has moved on to new interface types like NVMe today. It is doubtful sending ATA protocol will work with any hardware one may have these days. In user mode there were many ways of sending ATA commands like IOCTL_IDE_PASS_THROUGH, IOCTL_ATA_PASS_THROUGH, IOCTL_ATA_PASS_THROUGH_DIRECT, IOCTL_ATA_PASS_THROUGH_EX, as well as other back doors. But again, the hardware has changed and this protocol no longer exists.

  • kernelboikernelboi Member Posts: 19
    edited June 25

    @Rourke said:
    ATA is an ancient interface that was popular in the 1990's. The industry has moved on to new interface types like NVMe today. It is doubtful sending ATA protocol will work with any hardware one may have these days. In user mode there were many ways of sending ATA commands like IOCTL_IDE_PASS_THROUGH, IOCTL_ATA_PASS_THROUGH, IOCTL_ATA_PASS_THROUGH_DIRECT, IOCTL_ATA_PASS_THROUGH_EX, as well as other back doors. But again, the hardware has changed and this protocol no longer exists.

    Thank you for the answer, so instead of IOCTL_ATA_PASS we should be using IOCTL_SCSI_PASS_THROUGH to support modern hardware and IOCTL_ATA_PASS_THROUGH won't work anymore, correct?

    and is there anywhere that explains how can i send IOCTL_SCSI_PASS_THROUGH or IOCTL_ATA_PASS command from user mode to write or read from disk? i literally spend hours trying to find a simple example that shows this but couldn't find one.

  • Mark_RoddyMark_Roddy Member - All Emails Posts: 4,336
    via Email
    The spti sample from microsoft shows you how to use scsi pass through.

    https://github.com/microsoft/Windows-driver-samples/tree/master/storage/tools/spti



    Mark Roddy
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 15 Jun 2020 LIVE ONLINE
Writing WDF Drivers 22 June 2020 LIVE ONLINE
Internals & Software Drivers 28 Sept 2020 Dulles, VA