How to query Device Instance Id in minifilter ?

NTFSD
1

I have created a file system mini-filter to filter the file operations.
Now I have created a function to find the Instance Path of USB Storage Device.but it causes the crash of mini-filter.
Following block of code is used for Querying Instance Path.

    NTSTATUS CheckPNPID( PDEVICE_OBJECT pdo )
    {
    	DEVPROPKEY propertyKey = DEVPKEY_Device_InstanceId;
    	ULONG bufferLength = 100; // Hopefully big enough size
    	PVOID pDevicePropertyData;
    	DEVPROPTYPE devicePropertydataType;
    	ULONG returnedLength;
    	NTSTATUS status=STATUS_SUCCESS;
    
    	pDevicePropertyData = ExAllocatePoolWithTag(NonPagedPool, bufferLength, NL_POOL_TAG_NIK);
    	if (pDevicePropertyData == NULL) {
    		DbgPrint("MINIFILTER  :CheckPNPID ExAllocatePoolWithTag  pDevicePropertyData==NULL");
    		return(status);
    	}
    
    	status = IoGetDevicePropertyData(
    		pdo, // PhysicalDeviceObject
    		&propertyKey,
    		LOCALE_NEUTRAL,
    		0,
    		bufferLength,
    		pDevicePropertyData,
    		&returnedLength,
    		&devicePropertydataType
    		);
    
    	if (status != STATUS_SUCCESS && status != STATUS_BUFFER_TOO_SMALL) {
    		DbgPrint("MINIFILTER  :CheckPNPID IoGetDevicePropertyData  status!=STATUS_SUCCESS 1");
    		return(status);
    	}
    	if (status == STATUS_BUFFER_TOO_SMALL) {
    		ExFreePoolWithTag(pDevicePropertyData, NL_POOL_TAG_NIK); 
    		bufferLength = returnedLength;
    		pDevicePropertyData = ExAllocatePoolWithTag(NonPagedPool, bufferLength, NL_POOL_TAG_NIK);
    		if (pDevicePropertyData == NULL) {
    			DbgPrint("MINIFILTER  :CheckPNPID ExAllocatePoolWithTag  pDevicePropertyData==NULL 2");
    			return(status);
    		}
    		status = IoGetDevicePropertyData(
    			pdo, // PhysicalDeviceObject
    			&propertyKey,
    			LOCALE_NEUTRAL,
    			0,
    			bufferLength,
    			pDevicePropertyData,
    			&returnedLength,
    			&devicePropertydataType
    			);
    		if (status != STATUS_SUCCESS) {
    			DbgPrint("MINIFILTER  :CheckPNPID Using IOGETDEVICEPROPERTY  failed");
    			return(status);
    		}
    		else
    		{
    			DbgPrint("MINIFILTER  :CheckPNPID Using IOGETDEVICEPROPERTY  success 2");
    		}
    	}
    	if(status==STATUS_SUCCESS)
    	{
    		DbgPrint("MINIFILTER :CheckPNPID Using IOGETDEVICEPROPERTY  success");
    	}
    	return(status);
    }

I am using  WDK 8.0 and build a 32-bit driver. Is the above code wrong?
2

Mini filter = NTFSD forum

This post = NTDEV forum

Result: thread moved. Please be more careful.

Peter

3

Why are using such an old version of the WDK?

Please post the output of the !analyze -v, including the stack, with the symbols set correctly.

Peter