Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
I am developing a file system mini filter driver, where I try to read a file by allocating/sending an IRP with major function IRP_MJ_READ.
But, IoCallDriver fails with status = STATUS_INVALID_USER_BUFFER (0XC00000E8). Below are the setup details & steps.
Setup Details
OS : Windows 10 20h1
WDk SDK : Vs 2019 with 10.0.19041
Filter LoadOrderGroup : FSFilter Encryption
Altitude : 141000
Steps in sending IRP
IoCreateFileSpecifyDeviceObjectHint - Send a create request for the file
ObReferenceObjectByHandle - Get FILE_OBJECT for the file.
FltGetVolumeFromFileObject - Get the Volume that a given file stream resides on
FltGetDeviceObject - Get pointer to the Filter Manager's volume device
object (VDO) for a given volume
IoGetDeviceAttachmentBaseRef - Get the lowest-level device object in a file system driver stack.
IoAllocateIrp - Allocate IRP
IoSetCompletionRoutineEx - Set a completion routine.
IoCallDriver - Send the IRP to the lowest-level device object
obtained using IoGetDeviceAttachmentBaseRef)
Questions
Is it possible to read a file by sending IRP_MJ_READ (if we have a FILE_OBJECT )
FILE _OBJECT does not give the length of file. How can we get it?
What value we need to give "irpStack->Parameters.Read.Key"
What need to be done if the IocallDriver returns STATUS_INVALID_USER_BUFFER (0XC00000E8)
Please let me know your inputs
Thanks
Sam
Upcoming OSR Seminars | ||
---|---|---|
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
Developing Minifilters | 24 May 2021 | Live, Online |
Writing WDF Drivers | 14 June 2021 | Live, Online |
Internals & Software Drivers | 2 August 2021 | Live, Online |
Kernel Debugging | 27 Sept 2021 | Live, Online |
Comments
It is ‘misguided’ to use any of the IoXXXX operations you are calling, they all have FltXXX homologs (or are not needed). Also what you are doing won’t work within the filter manager architecture (which is why there are Flt versions)
FltCreateFileEx(....) FltReadFile()