"\Device\000000XX" -> "\\.\PhysicalDriveX" ?

NTDEV
1

Hi. I have developed disk filter driver and I could monitor disk I/Os finally.

My disk filter driver is attached to “HKLM\System\CurrentControlSet\Control\Class{4D36E967-E325-11CE-BFC1-08002BE10318}” as UpperFilters. (This class is DiskDrive)

However I cannot figure out which physical drive number X is being monitored.

I logged some properties of the attached device in EvtDriverDeviceAdd function.

DriverKeyName: \Device\0000006a
Manufacturer: (Standard disk drives)
FriendlyName: VMware, VMware Virtual S SCSI Disk Device
LocationInformation: Bus Number 0, Target Id 1, LUN 0
PhysicalDeviceObjectName: {4d36e967-e325-11ce-bfc1-08002be10318}\0001

This device is \.\PhysicalDrive1
I guessed that “0001” is physical drive number but it was wrong.

How can I convert or get this device to \.\PhysicalDriveX ?

Thank you.

2

One more thing…

I checked symbolic links by WinObj tool.

Global??\PhysicalDrive1 -> \Device\Harddisk1\DR2
Global??\Disk{0395543C-7E9A-11E8-A3E6-000C29A8FA93} -> \Device\Harddisk1\DR2

I cannot figure out the relation between this links and that above device properties.

3

I found solution.

Below function gives STORAGE_DEVICE_NUMBER from WDFDEVICE and the member DeviceNumber of STORAGE_DEVICE_NUMBER is physical disk number.

NTSTATUS getDeviceNumber(WDFDEVICE device, STORAGE_DEVICE_NUMBER *storageDeviceNumber)
{
WDF_MEMORY_DESCRIPTOR memoryDescriptor;
WDF_MEMORY_DESCRIPTOR_INIT_BUFFER(&memoryDescriptor, storageDeviceNumber, sizeof(STORAGE_DEVICE_NUMBER));

return WdfIoTargetSendIoctlSynchronously(WdfDeviceGetIoTarget(device), nullptr, IOCTL_STORAGE_GET_DEVICE_NUMBER, nullptr, &memoryDescriptor, nullptr, nullptr);
}