Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

IRP_MJ_READ from File System Mini Filter

samalexander620samalexander620 Member Posts: 6

I am developing a file system mini filter driver, where I try to read a file by allocating/sending an IRP with major function IRP_MJ_READ.
But, IoCallDriver fails with status = STATUS_INVALID_USER_BUFFER (0XC00000E8). Below are the setup details & steps.

Setup Details


OS : Windows 10 20h1
WDk SDK : Vs 2019 with 10.0.19041
Filter LoadOrderGroup : FSFilter Encryption
Altitude : 141000

Steps in sending IRP


IoCreateFileSpecifyDeviceObjectHint - Send a create request for the file
ObReferenceObjectByHandle - Get FILE_OBJECT for the file.
FltGetVolumeFromFileObject - Get the Volume that a given file stream resides on
FltGetDeviceObject - Get pointer to the Filter Manager's volume device
object (VDO) for a given volume
IoGetDeviceAttachmentBaseRef - Get the lowest-level device object in a file system driver stack.
IoAllocateIrp - Allocate IRP
IoSetCompletionRoutineEx - Set a completion routine.
IoCallDriver - Send the IRP to the lowest-level device object
obtained using IoGetDeviceAttachmentBaseRef)

Questions


  1. Is it possible to read a file by sending IRP_MJ_READ (if we have a FILE_OBJECT )

  2. FILE _OBJECT does not give the length of file. How can we get it?

  3. What value we need to give "irpStack->Parameters.Read.Key"

  4. What need to be done if the IocallDriver returns STATUS_INVALID_USER_BUFFER (0XC00000E8)

Please let me know your inputs

Thanks
Sam

Comments

  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,195

    It is ‘misguided’ to use any of the IoXXXX operations you are calling, they all have FltXXX homologs (or are not needed). Also what you are doing won’t work within the filter manager architecture (which is why there are Flt versions)

    FltCreateFileEx(....) FltReadFile()

  • Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 435
    via Email
    Oh, how lucky you are that you never needed to go out of FltXxx domain :)
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Developing Minifilters 24 May 2021 Live, Online
Writing WDF Drivers 14 June 2021 Live, Online
Internals & Software Drivers 27 September 2021 Live, Online
Kernel Debugging 15 November 2021 Live, Online