Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTDEV

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

Filter External HDD

john0000john0000 Member Posts: 2

I'm developing usb filter driver to block usb devices by its serial number.
and it can't block external hdd.
how can i block external hdd by its serial number?

Comments

  • Mark_RoddyMark_Roddy Member - All Emails Posts: 4,440
    via Email
    You query the drive for its serial number and hope it actually provides one.
    Mark Roddy
  • craig_howardcraig_howard Member Posts: 126

    Many USB thumb drives either don't have a serial number or use the same one ... what is the problem you are attempting to solve?

  • john0000john0000 Member Posts: 2

    @craig_howard said:
    Many USB thumb drives either don't have a serial number or use the same one ... what is the problem you are attempting to solve?

    I'd like to block usb hdd except specific ones

  • Don_BurnDon_Burn Member - All Emails Posts: 1,739

    I haven't dealt in this area for a decade, but be aware that determining that a drive is USB used to not be as easy as it seemed. I don't know what things are like now, but there were surprises along the way.

    Also, what are you going to do for situation that craig_howard spells out where you don't have a serial number? Assuming this is for security you should be thinking of more than just a serial number.

  • craig_howardcraig_howard Member Posts: 126

    When you say "specific ones" do you mean USB's from a specific vendor/ model (which will have a unique VID/PID, easy to detect, but means you will need to be forever updating those blacklisted VID/PIDs when the vendor ships a new device) or USB's that you have initialized in some way (which means you can put a PBKDF2 hash in a specific file on the USB, reject if it doesn't match but which means there is an initialize step)?

    There's also a potential problem with the "block usb hdd" request ... most (likely "all" but I'm going to hedge my answer) USB drives to through the MS class driver these days, which means you're going to have to intercept the load with a filter driver of some sort, then fail the load ... there are discussions here about USB filter drivers and actually quite a few threads here through the years about blocking USB access; most of them eventually end up as the best way to block a USB device is to plug the ports with some silicone caulk ...

    Have you read those threads and understand the issues you may be facing?

  • Xiaofan_ChenXiaofan_Chen Member - All Emails Posts: 208

    Usually in the corporate world, it is management software plus corporate IT policy. The policy part is important as the technology side is not fool proof.

    One example software management solution:
    https://www.crowdstrike.com/blog/tech-center/falcon-device-control/

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Developing Minifilters 24 May 2021 Live, Online
Writing WDF Drivers 14 June 2021 Live, Online
Internals & Software Drivers 27 September 2021 Live, Online
Kernel Debugging 15 November 2021 Live, Online