Sysdriver: How to capture Input data and play user audio application data

NTDEV
82

@Tim_Roberts said:
You don’t need MY approval, you need WINDOWS’ approval. Does your CreateFile call get into the driver now?

that i still need to check.

but one more help i already asked, need solution

NTSTATUS IoctlCreateClose(In DEVICE_OBJECT* _DeviceObject,
Inout IRP* _Irp)
{
UNREFERENCED_PARAMETER(_DeviceObject);

PIO_STACK_LOCATION stackLocation = NULL;
stackLocation = IoGetCurrentIrpStackLocation(_Irp);
stackLocation->FileObject->FileName == 
switch (stackLocation->MajorFunction)
{
case IRP_MJ_CREATE:
	DbgPrint("Handle to symbolink link  opened");
	break;
case IRP_MJ_CLOSE:
	DbgPrint("Handle to symbolink link closed");
	break;
default:
	break;
}
_Irp->IoStatus.Information = 0;
_Irp->IoStatus.Status = STATUS_SUCCESS;
IoCompleteRequest(_Irp, IO_NO_INCREMENT);
////PcDispatchIrp(_DeviceObject, _Irp);

return STATUS_SUCCESS;

}

how to knoe that user application calls this api, so that in that case i can avoid PcDispatchIrp

without PcDispatchIrp call here, i couldnot see virtual mic in sound control panel, how to proceed for now

Hi Tim,

For now i have only added PcDispatchIrp and commented IoCompleteRequest(_Irp, IO_NO_INCREMENT); part in IRP_MJ_CREATE handler function still my CreateFile returns FILE_NOT_FOUND error number 2.

some bug in my code that you can only identify sir.

83

Any help on above post…thanks in advance

84

Hi Tim,

inside IRP_MJ_CREATE handler function for now i commented PcDispatchIrp(_DeviceObject, _Irp);

with that Createfile is working, but i am not able to see virtual device sound control panel.
while it is visible in device manager.

so plz help me how i can have both PcDispatchIrp(_DeviceObject, _Irp); and IoCompleteRequest(_Irp, IO_NO_INCREMENT); in IRP_MJ_CREATE handler. under condition that when user app call IRP_MJ_CREATE it should skip PcDispatchIrp(_DeviceObject, _Irp);

NTSTATUS IoctlCreateClose(In DEVICE_OBJECT* _DeviceObject,
Inout IRP* _Irp)
{
UNREFERENCED_PARAMETER(_DeviceObject);

PIO_STACK_LOCATION stackLocation = NULL;
stackLocation = IoGetCurrentIrpStackLocation(_Irp);

switch (stackLocation->MajorFunction)
{
case IRP_MJ_CREATE:
	DbgPrint("Handle to symbolink link  opened");
	break;
case IRP_MJ_CLOSE:
	DbgPrint("Handle to symbolink link closed");
	break;
default:
	break;
}

_Irp->IoStatus.Information = 0;
_Irp->IoStatus.Status = STATUS_SUCCESS;
IoCompleteRequest(_Irp, IO_NO_INCREMENT);
//PcDispatchIrp(_DeviceObject, _Irp);////////////////////////how to keep this also

return STATUS_SUCCESS;

}

85

@chauhan_sumit001 said:
Any help on above post…thanks in advance

my createfile is working now,after commenting pcdispatcher from IRP_MJ_CREATE handler, but i want PCDispatcher also,how to do that

86

I did tell you that earlier in the thread. Port Class uses the file name in the IRP_MJ_CREATE IRP to decide what kind of open it is. You can dump those file names in the debugger to see what they look like. You can add a reference string to your device interface, and that reference string will be passed as the file name. If you use a custom reference string, then you can identify when the open comes from your application.

87

Hi Tim,

Plz give some clue on above post.

88

@Tim_Roberts said:
I did tell you that earlier in the thread. Port Class uses the file name in the IRP_MJ_CREATE IRP to decide what kind of open it is. You can dump those file names in the debugger to see what they look like. You can add a reference string to your device interface, and that reference string will be passed as the file name. If you use a custom reference string, then you can identify when the open comes from your application.

Hi Tim,

I have one doubt, you have mentioned about “add a reference string to your device interface”

Is it the same reference string which we pass inside

UNICODE_STRING device_sym_link = RTL_CONSTANT_STRING(L"\Device\RemotePCVadDevice");
UNICODE_STRING device_ref_string = RTL_CONSTANT_STRING(L"RemotePCVadDevice");

ntStatus = IoRegisterDeviceInterface(
PhysicalDeviceObject,
&RPC_IOCTL_AUDIO,
&device_ref_string,/////////////////are u talking about this???plz clarify
&device_sym_link
);

if yes then we can use

const auto IsUserSpaceAppRequest =
!RtlCompareUnicodeString(&device_ref_string
, &IrpStack->FileObject->FileName
, TRUE);

to identify the call inside IRP_MJ_CREATE

In CreateFile I am passing “\?\ROOT#MEDIA#0007#{4d36e96c-e325-11ce-bfc1-08002be10318}\RemotePCVadDevice” as file name

plz clarify.

89

Yes, that’s it. I don’t remember whether the driver gets a leading "" or not; you’ll have to do some debug prints to verify that.

90

Hi Tim,

over the TCP connection I am receiving encoded mic output from source application ,at target app i am decoding the audio data , now
I have decoded audio data(using AAC) in my target application, that I want to redirect to virtual audio mic(earlier i was playing it using SDL player). do I need to store that decoded data again in ring buffer within the driver code??,

I can transfer that decode data to driver using IOCTL, but there I will receive inside driver.cpp custom IOCTL handler, from custom IOCTL handler how can I transfer the data to MiniportWaveRTStream::WriteBytes and copy it to m_pDmaBuffer. plz help with some sample code snippet.

VOID MiniportWaveRTStream::WriteBytes
(
In ULONG ByteDisplacement
)
/*++

Routine Description:

This function writes the audio buffer using a sine wave generator
Arguments:

ByteDisplacement - # of bytes to process.

–*/
{

ULONG bufferOffset = m_ullLinearPosition % m_ulDmaBufferSize;

//// Normally this will loop no more than once for a single wrap, but if
//// many bytes have been displaced then this may loops many times.
while (ByteDisplacement > 0)
{
	ULONG runWrite = min(ByteDisplacement, m_ulDmaBufferSize - bufferOffset);
	SIZE_T actuallyWritten;
	
	m_RingBuffer->Take(m_pDmaBuffer + bufferOffset, runWrite, &actuallyWritten);
	if (actuallyWritten < runWrite)
	{
		RtlZeroMemory(m_pDmaBuffer + bufferOffset + actuallyWritten, runWrite - actuallyWritten);
	}
	
	bufferOffset = (bufferOffset + runWrite) % m_ulDmaBufferSize;
	ByteDisplacement -= runWrite;
}

}

if i have to feed my audio buffer to m_pDmaBuffer , do i need to write that much code inside WriteBytes(mentioned above), except
memcpy(m_pDmaBuffer ,my audio buffer received USING IOCTL, length)???

plz need your help.

91

Hi , Any suggestion on above post.

92

Any suggestion on above post.

Here’s one suggestion. Be patient, damn it. You posted this on Sunday afternoon here in the US, then prodded when you didn’t get a reply in 6 hours.
Most of us who do this for a living aren’t working on Sundays. We don’t need you to demand results.

I can transfer that decode data to driver using IOCTL, but there I will receive inside driver.cpp custom IOCTL handler,
from custom IOCTL handler how can I transfer the data to MiniportWaveRTStream::WriteBytes and copy it to m_pDmaBuffer.

Your ioctl handler needs to copy your data into the circular buffer. You shouldn’t need to change WriteBytes; it already knows how to read from the circular buffer. The only tricky part is finding the MiniPortWaveRTStream device so you can access its m_pDmaBuffer. That’s just a matter of following the pointers for the objects you do have.

93

@chauhan_sumit001 said:
Hi Tim,

over the TCP connection I am receiving encoded mic output from source application ,at target app i am decoding the audio data , now
I have decoded audio data(using AAC) in my target application, that I want to redirect to virtual audio mic(earlier i was playing it using SDL player). do I need to store that decoded data again in ring buffer within the driver code??,

I can transfer that decode data to driver using IOCTL, but there I will receive inside driver.cpp custom IOCTL handler, from custom IOCTL handler how can I transfer the data to MiniportWaveRTStream::WriteBytes and copy it to m_pDmaBuffer. plz help with some sample code snippet.

VOID MiniportWaveRTStream::WriteBytes
(
In ULONG ByteDisplacement
)
/*++

Routine Description:

This function writes the audio buffer using a sine wave generator
Arguments:

ByteDisplacement - # of bytes to process.

–*/
{

ULONG bufferOffset = m_ullLinearPosition % m_ulDmaBufferSize;

//// Normally this will loop no more than once for a single wrap, but if
//// many bytes have been displaced then this may loops many times.
while (ByteDisplacement > 0)
{
ULONG runWrite = min(ByteDisplacement, m_ulDmaBufferSize - bufferOffset);
SIZE_T actuallyWritten;

  m_RingBuffer->Take(m_pDmaBuffer + bufferOffset, runWrite, &actuallyWritten);
  if (actuallyWritten < runWrite)
  {
  	RtlZeroMemory(m_pDmaBuffer + bufferOffset + actuallyWritten, runWrite - actuallyWritten);
  }
  
  bufferOffset = (bufferOffset + runWrite) % m_ulDmaBufferSize;
  ByteDisplacement -= runWrite;

}
}

if i have to feed my audio buffer to m_pDmaBuffer , do i need to write that much code inside WriteBytes(mentioned above), except
memcpy(m_pDmaBuffer ,my audio buffer received USING IOCTL, length)???

plz need your help.

94

Hi All,

I am stuck at one point, i want to access ringbuffer and feed the data received from IOCTL inside IOCTL handler from user application, but currenly my ringbuffer is inside MiniportWaveRTStream class where inside WriteBytes I am taking data from ringbuffer and feeding it to dma buffer, so how can I access the same ringbuffer inside my IOCTL handler in adapter.cpp in SYSVAD class to put the data. plz provide some code snippet.

need your help badly…

95

@Tim_Roberts said:

Any suggestion on above post.

Here’s one suggestion. Be patient, damn it. You posted this on Sunday afternoon here in the US, then prodded when you didn’t get a reply in 6 hours.
Most of us who do this for a living aren’t working on Sundays. We don’t need you to demand results.

I can transfer that decode data to driver using IOCTL, but there I will receive inside driver.cpp custom IOCTL handler,
from custom IOCTL handler how can I transfer the data to MiniportWaveRTStream::WriteBytes and copy it to m_pDmaBuffer.

Your ioctl handler needs to copy your data into the circular buffer. You shouldn’t need to change WriteBytes; it already knows how to read from the circular buffer. The only tricky part is finding the MiniPortWaveRTStream device so you can access its m_pDmaBuffer. That’s just a matter of following the pointers for the objects you do have.

Hi Tim,

I am extremely sorry for being impatient, it was not at all intended.

If I understood your point correctly, then I should not create one more ringbuffer inside driver class to store my audio data received using IOCTL handler.

is m_pDmaBuffer is circular buffer???

if yes then directly I can copy my data to m_pDmaBuffer. is that correct???

96

Also plz provide some clue on,how to find MiniportWaveRTStream device inside custom IOCTL handler…

97

It is very easy to find things going UP an object tree. It is difficult to find things going DOWN a tree. Therefore, the right answer is to move the circular buffers into the top-level adapter object, where it can easily be found by the ioctl handlers. The miniport stream objects also have access to the adapter object, so they can call a function to fetch a pointer to the circular buffer.

98

Dear Tim,

first of all Thanks for all the help which u provided, with that i am able to transfer my audio to virtual microphone from my user application.

But while playing the virtual mic recorded audio using audacity i observed lots of noise along with actual audio, may I know why i am getting noise along with actual audio.

I am using ringbuffer to store transferred audio packet from user app, and calling RingBuffer::GetRingBufferInstance()->Put((BYTE*)_Irp->AssociatedIrp.SystemBuffer, inBufLength); inside my custom IOCTL handler api.

NTSTATUS HandleCustomIoctl(In DEVICE_OBJECT* _DeviceObject,
Inout IRP* _Irp)
{

//PIO_STACK_LOCATION  irpSp;// Pointer to current stack location
//NTSTATUS            ntStatus = STATUS_SUCCESS;// Assume success
ULONG               inBufLength; // Input buffer length
ULONG               outBufLength; // Output buffer length
PCHAR               /*inBuf,*/ outBuf; // pointer to Input and output buffer
PCHAR               data = "This String is from Device Driver !!!";
size_t              datalen = strlen(data) + 1;//Length of data including null
//PMDL                mdl = NULL;
//PCHAR               buffer = NULL;



UNREFERENCED_PARAMETER(_DeviceObject);
PAGED_CODE();
PIO_STACK_LOCATION stackLocation = NULL;
//CHAR* messageFromKernel = "ohai from them kernelz";
NTSTATUS ntstatus = STATUS_SUCCESS;
stackLocation = IoGetCurrentIrpStackLocation(_Irp);

inBufLength = stackLocation->Parameters.DeviceIoControl.InputBufferLength;
outBufLength = stackLocation->Parameters.DeviceIoControl.OutputBufferLength;

if (stackLocation->Parameters.DeviceIoControl.IoControlCode == IOCTL_CSMT_READ_METHOD_DIRECT_IN)
{
	RingBuffer::GetRingBufferInstance()->Put((BYTE*)_Irp->AssociatedIrp.SystemBuffer, inBufLength);

	DbgPrint("IOCTL_SPOTLESS (0x%x) issued", stackLocation->Parameters.DeviceIoControl.IoControlCode);
	DbgPrint("Input received from userland: %s", (char*)_Irp->AssociatedIrp.SystemBuffer);

	DbgPrint("Input bufferlength: %ld", inBufLength);

	//inBuf = (BYTE*)_Irp->AssociatedIrp.SystemBuffer;
	outBuf = (char*)_Irp->AssociatedIrp.SystemBuffer;
	//CAudioDataRingbuffer::getRingBufferInstance()->RingBuffer_Write(CAudioDataRingbuffer::getRingBufferInstance()->m_global_buffer_struct,
		//(SHORT*)_Irp->AssociatedIrp.SystemBuffer,4096);
	_Irp->IoStatus.Information = 0;// strlen(messageFromKernel);
	_Irp->IoStatus.Status = ntstatus;

	RtlCopyBytes(outBuf, data, outBufLength);
	_Irp->IoStatus.Information = (outBufLength < datalen ? outBufLength : datalen);
	//DbgPrint("Sending to userland: %s", messageFromKernel);
	//RtlCopyMemory(Irp->AssociatedIrp.SystemBuffer, messageFromKernel, strlen(Irp->AssociatedIrp.SystemBuffer));

	IoCompleteRequest(_Irp, IO_NO_INCREMENT);

	return ntstatus;
}
ntstatus = PcDispatchIrp(_DeviceObject, _Irp);
return ntstatus;

}
}

inside WriteBytes i do,

ULONG bufferOffset = m_ullLinearPosition % m_ulDmaBufferSize;

// Normally this will loop no more than once for a single wrap, but if
// many bytes have been displaced then this may loops many times.
while (ByteDisplacement > 0)
{
	ULONG runWrite = min(ByteDisplacement, m_ulDmaBufferSize - bufferOffset);
	SIZE_T actuallyWritten;
	
	RingBuffer::GetRingBufferInstance()->Take(m_pDmaBuffer + bufferOffset, runWrite, &actuallyWritten);
	if (actuallyWritten < runWrite)
	{
		RtlZeroMemory(m_pDmaBuffer + bufferOffset + actuallyWritten, runWrite - actuallyWritten);
	}
	DbgPrint("bytes read : %ld", ByteDisplacement);
	bufferOffset = (bufferOffset + runWrite) % m_ulDmaBufferSize;
	ByteDisplacement -= runWrite;
}

Plz do let me know if u need any other part of code inorder to understand my issue.

99

What do you mean by “noise”? Do you mean you get garbage static, or do you mean it’s mostly OK but with lots of clicks? How often are you feeding the circular buffer, and how much data are you sending? There’s no throttling here, so if you write 10,000 bytes and your circular buffer only holds 4096, you’ll drop data. Your feeding application has to do careful timing to make sure you’re feeding data at the same rate that the microphone is pulling it. You don’t want to overflow, and you don’t want WriteBytes to go dry.

I see you’re using METHOD_IN_DIRECT (based on the ioctl name), but you’re using the first buffer (mistakenly called the “input” buffer). Remember that in a direct I/O IRP, the first buffer is always copied into kernel mode, but the second buffer (mistakenly called the “output” buffer) is directly mapped, not copied. If you’re sending less than a couple of pages at a time, it’s fine, but if you are sending more than that, you should switch to using the second buffer in the DeviceIoControl call, and get your data from Irp->MdlAddress.

1 Like
100

@Tim_Roberts said:
What do you mean by “noise”? Do you mean you get garbage static, or do you mean it’s mostly OK but with lots of clicks? How often are you feeding the circular buffer, and how much data are you sending? There’s no throttling here, so if you write 10,000 bytes and your circular buffer only holds 4096, you’ll drop data. Your feeding application has to do careful timing to make sure you’re feeding data at the same rate that the microphone is pulling it. You don’t want to overflow, and you don’t want WriteBytes to go dry.

I see you’re using METHOD_IN_DIRECT (based on the ioctl name), but you’re using the first buffer (mistakenly called the “input” buffer). Remember that in a direct I/O IRP, the first buffer is always copied into kernel mode, but the second buffer (mistakenly called the “output” buffer) is directly mapped, not copied. If you’re sending less than a couple of pages at a time, it’s fine, but if you are sending more than that, you should switch to using the second buffer in the DeviceIoControl call, and get your data from Irp->MdlAddress.

“noise” means some crackling noise which comes along with actual audio, my ring buffer size is 14112 bytes, and on each call of IOCTL i am sending 4096 bytes which gets stored in ring buffer and later pulled by WriteBytes…

But what I observed is If i increase the input audio packet size from 4096 to some 6000 bytes then the crackling noise is less even though the audio quality degrades. is my buffer underflowing?

101

@Tim_Roberts said:
What do you mean by “noise”? Do you mean you get garbage static, or do you mean it’s mostly OK but with lots of clicks? How often are you feeding the circular buffer, and how much data are you sending? There’s no throttling here, so if you write 10,000 bytes and your circular buffer only holds 4096, you’ll drop data. Your feeding application has to do careful timing to make sure you’re feeding data at the same rate that the microphone is pulling it. You don’t want to overflow, and you don’t want WriteBytes to go dry.

I see you’re using METHOD_IN_DIRECT (based on the ioctl name), but you’re using the first buffer (mistakenly called the “input” buffer). Remember that in a direct I/O IRP, the first buffer is always copied into kernel mode, but the second buffer (mistakenly called the “output” buffer) is directly mapped, not copied. If you’re sending less than a couple of pages at a time, it’s fine, but if you are sending more than that, you should switch to using the second buffer in the DeviceIoControl call, and get your data from Irp->MdlAddress.

“noise” means some crackling noise which comes along with actual audio, my ring buffer size is 12000 bytes, and on each call of IOCTL i am sending 4096 bytes which gets stored in ring buffer and later pulled by WriteBytes…

But what I observed is If i increase the input audio packet size from 4096 to some 6000 bytes then the crackling noise is less even though the audio quality degrades. is my buffer underflowing???