Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.More Info on Driver Writing and Debugging
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
evtioread and evtiowrite isn't call
OSR_Community_User
Member Posts: 110,217
in WINDBG
Hello. I used this article http://www.osronline.com/article.cfm?article=446 to create a driver filter for usb flash. Installed this driver as the upper filter driver. In windbg, when debugging, the breakpoints in the ioread and oiwrite events do not call when I try to read or write data to the device. The breakpoints on the device addition and retrieval events are triggered. What could be the problem?
| Upcoming OSR Seminars | ||
|---|---|---|
| OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
| Internals & Software Drivers | 30 Nov 2020 | LIVE ONLINE |
| Writing WDF Drivers | 7 Dec 2020 | LIVE ONLINE |
| Developing Minifilters | Early 2021 | LIVE ONLINE |
Comments
-scott
OSR
@OSRDrivers
-scott
OSR
> Hello. I used this article http://www.osronline.com/article.cfm?article=446 to create a driver filter for usb flash. Installed this driver as the upper filter driver. In windbg, when debugging, the breakpoints in the ioread and oiwrite events do not call when I try to read or write data to the device. The breakpoints on the device addition and retrieval events are triggered. What could be the problem?
> The driver is installed for devices in the stack along this path:
> HLM\System\CurrentControlSet\Enum\USB. The example uses
> EvtIoDeviceControl and EvtIoInternalDeviceControl. The breakpoint is
> triggered by EvtIoInternalDeviceControl.
What is the overall goal you are hoping to accomplish? From your
message, I'm guessing you don't really understand how drivers are
stacked in Windows.
Writing to a USB flash drive involves 6 or more drivers. Each one has
its own interfaces in and out, and you need to know where you have to be
to get the information you want. When you do a WriteFile to a USB flash
device, that request goes to a file system driver, and that file system
driver sees it as an IRP_MJ_WRITE request, which would go to an
EvtIoWrite handler. That file system driver converts the write into
partition-relative requests, and sends to a volume driver. That driver
converts the write to disk-relative request, which it sends to a disk
driver. In this case, that is disk.sys (in the ENUM\USBSTOR tree).Â
That driver talks to the storage driver, which is usbstor.sys. That's
the driver in Enum\USB. That driver sends USB requests (URBs) to
usbhub,sys, which talks to the host controller driver.
Below that very top level, almost all inter-driver communication is done
via ioctls or internal ioctls. It's quite possible that, by the time
you get to usbstor.sys where your filter driver lives, all of the
requests have been turned into IRP_MJ_SCSI, which is the same as
IRP_MJ_INTERNAL_DEVICE_CONTROL.
So, tell us what you want to learn, and someone here can guide you on
where to filter.
--
Tim Roberts, [email protected]
Providenza & Boekelheide, Inc.
Tim Roberts, [email protected]
Providenza & Boekelheide, Inc.
I'm really new to driver development. Therefore, I do not understand much. The main task for me is in cryptographic protection of data. I need to encrypt all the data on the flash drive and decrypt the data when authorizing. From this task and a brief study of the material, I came to the conclusion that I need a upper filter driver. I would be very happy to receive advice.
On Thu, Apr 12, 2018, 1:11 PM [email protected]
wrote:
> Thank you, Tim.
> I'm really new to driver development. Therefore, I do not understand much.
> The main task for me is in cryptographic protection of data. I need to
> encrypt all the data on the flash drive and decrypt the data when
> authorizing. From this task and a brief study of the material, I came to
> the conclusion that I need a upper filter driver. I would be very happy to
> receive advice.
>
> ---
> WINDBG is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer>
>