Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTDEV

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


How to generate system sequence to get the IRP_MN_CANCEL_REMOVE_DEVICE

hilly17inhilly17in Member Posts: 50

We have FS MiniFilter which caused a crash on user's system when it receives IRP_MN_CANCEL_REMOVE_DEVICE. Though I was able to identify the cause of crash and fix, the BIG issue remains that we are not able to test our driver by sending this particular IRP. I tried to create a VHD, attach it and remove it. My question is how we can make system send this IRP to our driver for testing purpose or are there any other mechanism to achieve this. Any comment is highly appreciated. Thanks.

Comments

  • Mark_RoddyMark_Roddy Member - All Emails Posts: 4,628

    Well that is an ugly problem. In general FS minifilters are not directly involved in pnp operations, so I assume your problem was a side effect of the cancel. Anyhow, offhand, you could create a filter driver for one of the storage stacks and have that explicitly reject an IRP_MN_QUERY_REMOVE request. That seems like a lot of work. There also might be something usable in the HLK test programs. In particular you could probably use DF - PNP Cancel Remove Device Test - see https://learn.microsoft.com/en-us/windows-hardware/test/hlk/testref/53c9e4a3-147a-4590-be9a-de6104f8d84b, but as always there is a lot of setup and other stuff with these tests that can be time consuming to get right.

  • Peter_Viscarola_(OSR)Peter_Viscarola_(OSR) Administrator Posts: 9,077

    the BIG issue remains that we are not able to test our driver by sending this particular IRP

    OK... I'll ask: Why not? I mean... you're not SUPPOSED to do so, but what prevents you from building the IRP and sending it? I've done that a lot, for diagnostic reasons, for OTHER "reserved to the system" IRPs in the past and it DID work just fine...

    Peter

    Peter Viscarola
    OSR
    @OSRDrivers

  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,590

    The WDK used to have the pnpdtest utility which made this incredibly easy to test. Now it's wrapped up in DevFund somewhere so it's no longer incredibly easy to test...Progress!

    Anyhow:

    You should be able to see the IRP_MN_CANCEL_REMOVE if you have a file open when you try and disable/remove the volume. Probably cheap out using PowerShell and DevCon (from the WDK):

    Open a file:
    $file = [System.IO.File]::Open("f:\foo.txt", "OpenOrCreate", "Read")

    Try to disable all volumes (because I'm lazy):

    devcon disable "Storage\Volume"
    

    If all goes according to plan you should see a query remove followed by the cancel...Then make sure you enable the volumes again 😂

    devcon enable "Storage\Volume"
    

    -scott
    OSR

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Internals & Software Drivers 19-23 June 2023 Live, Online
Writing WDF Drivers 10-14 July 2023 Live, Online
Kernel Debugging 16-20 October 2023 Live, Online
Developing Minifilters 13-17 November 2023 Live, Online