Sysdriver: How to capture Input data and play user audio application data

@chauhan_sumit001 said:
Any help on above post…thanks in advance

my createfile is working now,after commenting pcdispatcher from IRP_MJ_CREATE handler, but i want PCDispatcher also,how to do that

I did tell you that earlier in the thread. Port Class uses the file name in the IRP_MJ_CREATE IRP to decide what kind of open it is. You can dump those file names in the debugger to see what they look like. You can add a reference string to your device interface, and that reference string will be passed as the file name. If you use a custom reference string, then you can identify when the open comes from your application.

Hi Tim,

Plz give some clue on above post.

@Tim_Roberts said:
I did tell you that earlier in the thread. Port Class uses the file name in the IRP_MJ_CREATE IRP to decide what kind of open it is. You can dump those file names in the debugger to see what they look like. You can add a reference string to your device interface, and that reference string will be passed as the file name. If you use a custom reference string, then you can identify when the open comes from your application.

Hi Tim,

I have one doubt, you have mentioned about “add a reference string to your device interface”

Is it the same reference string which we pass inside

UNICODE_STRING device_sym_link = RTL_CONSTANT_STRING(L"\Device\RemotePCVadDevice");
UNICODE_STRING device_ref_string = RTL_CONSTANT_STRING(L"RemotePCVadDevice");

ntStatus = IoRegisterDeviceInterface(
PhysicalDeviceObject,
&RPC_IOCTL_AUDIO,
&device_ref_string,/////////////////are u talking about this???plz clarify
&device_sym_link
);

if yes then we can use

const auto IsUserSpaceAppRequest =
!RtlCompareUnicodeString(&device_ref_string
, &IrpStack->FileObject->FileName
, TRUE);

to identify the call inside IRP_MJ_CREATE

In CreateFile I am passing “\?\ROOT#MEDIA#0007#{4d36e96c-e325-11ce-bfc1-08002be10318}\RemotePCVadDevice” as file name

plz clarify.

Yes, that’s it. I don’t remember whether the driver gets a leading "" or not; you’ll have to do some debug prints to verify that.

Hi Tim,

over the TCP connection I am receiving encoded mic output from source application ,at target app i am decoding the audio data , now
I have decoded audio data(using AAC) in my target application, that I want to redirect to virtual audio mic(earlier i was playing it using SDL player). do I need to store that decoded data again in ring buffer within the driver code??,

I can transfer that decode data to driver using IOCTL, but there I will receive inside driver.cpp custom IOCTL handler, from custom IOCTL handler how can I transfer the data to MiniportWaveRTStream::WriteBytes and copy it to m_pDmaBuffer. plz help with some sample code snippet.

VOID MiniportWaveRTStream::WriteBytes
(
In ULONG ByteDisplacement
)
/*++

Routine Description:

This function writes the audio buffer using a sine wave generator
Arguments:

ByteDisplacement - # of bytes to process.

–*/
{

ULONG bufferOffset = m_ullLinearPosition % m_ulDmaBufferSize;

//// Normally this will loop no more than once for a single wrap, but if
//// many bytes have been displaced then this may loops many times.
while (ByteDisplacement > 0)
{
	ULONG runWrite = min(ByteDisplacement, m_ulDmaBufferSize - bufferOffset);
	SIZE_T actuallyWritten;
	
	m_RingBuffer->Take(m_pDmaBuffer + bufferOffset, runWrite, &actuallyWritten);
	if (actuallyWritten < runWrite)
	{
		RtlZeroMemory(m_pDmaBuffer + bufferOffset + actuallyWritten, runWrite - actuallyWritten);
	}
	
	bufferOffset = (bufferOffset + runWrite) % m_ulDmaBufferSize;
	ByteDisplacement -= runWrite;
}

}

if i have to feed my audio buffer to m_pDmaBuffer , do i need to write that much code inside WriteBytes(mentioned above), except
memcpy(m_pDmaBuffer ,my audio buffer received USING IOCTL, length)???

plz need your help.

Hi , Any suggestion on above post.

Any suggestion on above post.

Here’s one suggestion. Be patient, damn it. You posted this on Sunday afternoon here in the US, then prodded when you didn’t get a reply in 6 hours.
Most of us who do this for a living aren’t working on Sundays. We don’t need you to demand results.

I can transfer that decode data to driver using IOCTL, but there I will receive inside driver.cpp custom IOCTL handler,
from custom IOCTL handler how can I transfer the data to MiniportWaveRTStream::WriteBytes and copy it to m_pDmaBuffer.

Your ioctl handler needs to copy your data into the circular buffer. You shouldn’t need to change WriteBytes; it already knows how to read from the circular buffer. The only tricky part is finding the MiniPortWaveRTStream device so you can access its m_pDmaBuffer. That’s just a matter of following the pointers for the objects you do have.

@chauhan_sumit001 said:
Hi Tim,

over the TCP connection I am receiving encoded mic output from source application ,at target app i am decoding the audio data , now
I have decoded audio data(using AAC) in my target application, that I want to redirect to virtual audio mic(earlier i was playing it using SDL player). do I need to store that decoded data again in ring buffer within the driver code??,

I can transfer that decode data to driver using IOCTL, but there I will receive inside driver.cpp custom IOCTL handler, from custom IOCTL handler how can I transfer the data to MiniportWaveRTStream::WriteBytes and copy it to m_pDmaBuffer. plz help with some sample code snippet.

VOID MiniportWaveRTStream::WriteBytes
(
In ULONG ByteDisplacement
)
/*++

Routine Description:

This function writes the audio buffer using a sine wave generator
Arguments:

ByteDisplacement - # of bytes to process.

–*/
{

ULONG bufferOffset = m_ullLinearPosition % m_ulDmaBufferSize;

//// Normally this will loop no more than once for a single wrap, but if
//// many bytes have been displaced then this may loops many times.
while (ByteDisplacement > 0)
{
ULONG runWrite = min(ByteDisplacement, m_ulDmaBufferSize - bufferOffset);
SIZE_T actuallyWritten;

  m_RingBuffer->Take(m_pDmaBuffer + bufferOffset, runWrite, &actuallyWritten);
  if (actuallyWritten < runWrite)
  {
  	RtlZeroMemory(m_pDmaBuffer + bufferOffset + actuallyWritten, runWrite - actuallyWritten);
  }
  
  bufferOffset = (bufferOffset + runWrite) % m_ulDmaBufferSize;
  ByteDisplacement -= runWrite;

}
}

if i have to feed my audio buffer to m_pDmaBuffer , do i need to write that much code inside WriteBytes(mentioned above), except
memcpy(m_pDmaBuffer ,my audio buffer received USING IOCTL, length)???

plz need your help.

Hi All,

I am stuck at one point, i want to access ringbuffer and feed the data received from IOCTL inside IOCTL handler from user application, but currenly my ringbuffer is inside MiniportWaveRTStream class where inside WriteBytes I am taking data from ringbuffer and feeding it to dma buffer, so how can I access the same ringbuffer inside my IOCTL handler in adapter.cpp in SYSVAD class to put the data. plz provide some code snippet.

need your help badly…

@Tim_Roberts said:

Any suggestion on above post.

Here’s one suggestion. Be patient, damn it. You posted this on Sunday afternoon here in the US, then prodded when you didn’t get a reply in 6 hours.
Most of us who do this for a living aren’t working on Sundays. We don’t need you to demand results.

I can transfer that decode data to driver using IOCTL, but there I will receive inside driver.cpp custom IOCTL handler,
from custom IOCTL handler how can I transfer the data to MiniportWaveRTStream::WriteBytes and copy it to m_pDmaBuffer.

Your ioctl handler needs to copy your data into the circular buffer. You shouldn’t need to change WriteBytes; it already knows how to read from the circular buffer. The only tricky part is finding the MiniPortWaveRTStream device so you can access its m_pDmaBuffer. That’s just a matter of following the pointers for the objects you do have.

Hi Tim,

I am extremely sorry for being impatient, it was not at all intended.

If I understood your point correctly, then I should not create one more ringbuffer inside driver class to store my audio data received using IOCTL handler.

is m_pDmaBuffer is circular buffer???

if yes then directly I can copy my data to m_pDmaBuffer. is that correct???

Also plz provide some clue on,how to find MiniportWaveRTStream device inside custom IOCTL handler…

It is very easy to find things going UP an object tree. It is difficult to find things going DOWN a tree. Therefore, the right answer is to move the circular buffers into the top-level adapter object, where it can easily be found by the ioctl handlers. The miniport stream objects also have access to the adapter object, so they can call a function to fetch a pointer to the circular buffer.

Dear Tim,

first of all Thanks for all the help which u provided, with that i am able to transfer my audio to virtual microphone from my user application.

But while playing the virtual mic recorded audio using audacity i observed lots of noise along with actual audio, may I know why i am getting noise along with actual audio.

I am using ringbuffer to store transferred audio packet from user app, and calling RingBuffer::GetRingBufferInstance()->Put((BYTE*)_Irp->AssociatedIrp.SystemBuffer, inBufLength); inside my custom IOCTL handler api.

NTSTATUS HandleCustomIoctl(In DEVICE_OBJECT* _DeviceObject,
Inout IRP* _Irp)
{

//PIO_STACK_LOCATION  irpSp;// Pointer to current stack location
//NTSTATUS            ntStatus = STATUS_SUCCESS;// Assume success
ULONG               inBufLength; // Input buffer length
ULONG               outBufLength; // Output buffer length
PCHAR               /*inBuf,*/ outBuf; // pointer to Input and output buffer
PCHAR               data = "This String is from Device Driver !!!";
size_t              datalen = strlen(data) + 1;//Length of data including null
//PMDL                mdl = NULL;
//PCHAR               buffer = NULL;



UNREFERENCED_PARAMETER(_DeviceObject);
PAGED_CODE();
PIO_STACK_LOCATION stackLocation = NULL;
//CHAR* messageFromKernel = "ohai from them kernelz";
NTSTATUS ntstatus = STATUS_SUCCESS;
stackLocation = IoGetCurrentIrpStackLocation(_Irp);

inBufLength = stackLocation->Parameters.DeviceIoControl.InputBufferLength;
outBufLength = stackLocation->Parameters.DeviceIoControl.OutputBufferLength;

if (stackLocation->Parameters.DeviceIoControl.IoControlCode == IOCTL_CSMT_READ_METHOD_DIRECT_IN)
{
	RingBuffer::GetRingBufferInstance()->Put((BYTE*)_Irp->AssociatedIrp.SystemBuffer, inBufLength);

	DbgPrint("IOCTL_SPOTLESS (0x%x) issued", stackLocation->Parameters.DeviceIoControl.IoControlCode);
	DbgPrint("Input received from userland: %s", (char*)_Irp->AssociatedIrp.SystemBuffer);

	DbgPrint("Input bufferlength: %ld", inBufLength);

	//inBuf = (BYTE*)_Irp->AssociatedIrp.SystemBuffer;
	outBuf = (char*)_Irp->AssociatedIrp.SystemBuffer;
	//CAudioDataRingbuffer::getRingBufferInstance()->RingBuffer_Write(CAudioDataRingbuffer::getRingBufferInstance()->m_global_buffer_struct,
		//(SHORT*)_Irp->AssociatedIrp.SystemBuffer,4096);
	_Irp->IoStatus.Information = 0;// strlen(messageFromKernel);
	_Irp->IoStatus.Status = ntstatus;

	RtlCopyBytes(outBuf, data, outBufLength);
	_Irp->IoStatus.Information = (outBufLength < datalen ? outBufLength : datalen);
	//DbgPrint("Sending to userland: %s", messageFromKernel);
	//RtlCopyMemory(Irp->AssociatedIrp.SystemBuffer, messageFromKernel, strlen(Irp->AssociatedIrp.SystemBuffer));

	IoCompleteRequest(_Irp, IO_NO_INCREMENT);

	return ntstatus;
}
ntstatus = PcDispatchIrp(_DeviceObject, _Irp);
return ntstatus;

}
}

inside WriteBytes i do,

ULONG bufferOffset = m_ullLinearPosition % m_ulDmaBufferSize;

// Normally this will loop no more than once for a single wrap, but if
// many bytes have been displaced then this may loops many times.
while (ByteDisplacement > 0)
{
	ULONG runWrite = min(ByteDisplacement, m_ulDmaBufferSize - bufferOffset);
	SIZE_T actuallyWritten;
	
	RingBuffer::GetRingBufferInstance()->Take(m_pDmaBuffer + bufferOffset, runWrite, &actuallyWritten);
	if (actuallyWritten < runWrite)
	{
		RtlZeroMemory(m_pDmaBuffer + bufferOffset + actuallyWritten, runWrite - actuallyWritten);
	}
	DbgPrint("bytes read : %ld", ByteDisplacement);
	bufferOffset = (bufferOffset + runWrite) % m_ulDmaBufferSize;
	ByteDisplacement -= runWrite;
}

Plz do let me know if u need any other part of code inorder to understand my issue.

What do you mean by “noise”? Do you mean you get garbage static, or do you mean it’s mostly OK but with lots of clicks? How often are you feeding the circular buffer, and how much data are you sending? There’s no throttling here, so if you write 10,000 bytes and your circular buffer only holds 4096, you’ll drop data. Your feeding application has to do careful timing to make sure you’re feeding data at the same rate that the microphone is pulling it. You don’t want to overflow, and you don’t want WriteBytes to go dry.

I see you’re using METHOD_IN_DIRECT (based on the ioctl name), but you’re using the first buffer (mistakenly called the “input” buffer). Remember that in a direct I/O IRP, the first buffer is always copied into kernel mode, but the second buffer (mistakenly called the “output” buffer) is directly mapped, not copied. If you’re sending less than a couple of pages at a time, it’s fine, but if you are sending more than that, you should switch to using the second buffer in the DeviceIoControl call, and get your data from Irp->MdlAddress.

1 Like

@Tim_Roberts said:
What do you mean by “noise”? Do you mean you get garbage static, or do you mean it’s mostly OK but with lots of clicks? How often are you feeding the circular buffer, and how much data are you sending? There’s no throttling here, so if you write 10,000 bytes and your circular buffer only holds 4096, you’ll drop data. Your feeding application has to do careful timing to make sure you’re feeding data at the same rate that the microphone is pulling it. You don’t want to overflow, and you don’t want WriteBytes to go dry.

I see you’re using METHOD_IN_DIRECT (based on the ioctl name), but you’re using the first buffer (mistakenly called the “input” buffer). Remember that in a direct I/O IRP, the first buffer is always copied into kernel mode, but the second buffer (mistakenly called the “output” buffer) is directly mapped, not copied. If you’re sending less than a couple of pages at a time, it’s fine, but if you are sending more than that, you should switch to using the second buffer in the DeviceIoControl call, and get your data from Irp->MdlAddress.

“noise” means some crackling noise which comes along with actual audio, my ring buffer size is 14112 bytes, and on each call of IOCTL i am sending 4096 bytes which gets stored in ring buffer and later pulled by WriteBytes…

But what I observed is If i increase the input audio packet size from 4096 to some 6000 bytes then the crackling noise is less even though the audio quality degrades. is my buffer underflowing?

@Tim_Roberts said:
What do you mean by “noise”? Do you mean you get garbage static, or do you mean it’s mostly OK but with lots of clicks? How often are you feeding the circular buffer, and how much data are you sending? There’s no throttling here, so if you write 10,000 bytes and your circular buffer only holds 4096, you’ll drop data. Your feeding application has to do careful timing to make sure you’re feeding data at the same rate that the microphone is pulling it. You don’t want to overflow, and you don’t want WriteBytes to go dry.

I see you’re using METHOD_IN_DIRECT (based on the ioctl name), but you’re using the first buffer (mistakenly called the “input” buffer). Remember that in a direct I/O IRP, the first buffer is always copied into kernel mode, but the second buffer (mistakenly called the “output” buffer) is directly mapped, not copied. If you’re sending less than a couple of pages at a time, it’s fine, but if you are sending more than that, you should switch to using the second buffer in the DeviceIoControl call, and get your data from Irp->MdlAddress.

“noise” means some crackling noise which comes along with actual audio, my ring buffer size is 12000 bytes, and on each call of IOCTL i am sending 4096 bytes which gets stored in ring buffer and later pulled by WriteBytes…

But what I observed is If i increase the input audio packet size from 4096 to some 6000 bytes then the crackling noise is less even though the audio quality degrades. is my buffer underflowing???

Dear Tim,

Currently I am using command prompt to install my driver,want to do it programatically ,could you please suggest how to do that, I wrote below code

HINF HInf;
LPCSTR szSourceFileName = “C:\Users\test\Desktop\virtual_mic_sumit_poc\wdm\exe\RemotePCVad.inf”;
UINT ErrorLine;
HInf = SetupOpenInfFile(szSourceFileName, NULL, INF_STYLE_WIN4, &ErrorLine);
PVOID Context = NULL;
PBOOL FileWasInUse = FALSE;
if (SetupInstallFileEx(HInf, NULL, “RemotePCVad.sys”, “C:\Users\test\Desktop\virtual_mic_sumit_poc\wdm\exe”,
“C:\Users\test\Desktop\virtual_mic_sumit_poc\wdm\exe\RemotePCVad.sys”, SP_COPY_NEWER_OR_SAME, NULL, Context, (FileWasInUse)) == 0) {
DWORD dwVal = GetLastError();
printf(“\nsetup null: %d”, dwVal);
}

I am getting 87 as value of GetlastError, need some help on this

There are three rather large problems here.

First, all of your strings have a tab character in them (“\t”). You have to double all the backslashes in a constant string. I’m not sure how a Windows programmer would not know that.

Second, it is a horrible practice to embed absolute paths in an application of any kind. Such an application will not work on any other computer. Put the files in the same directory as the executable, and run the program from there. Or, fetch the name of your executable and extract the path from there.

Third, you can’t install drivers using SetupInstallFileEx. That’s only for applications. You have to create a fake device, then pre-install your driver package, then tell PnP to load your driver on that new device.

Now, I wish I could speak authoritatively about this, but the process has changed in Windows 10, and I’m unsure. If you look in the devcon source code for the “devcon install” command, you’ll see they use use SetupDiCreateDeviceInfo to create the new device, then UpdateDriverForPlugAndPlayDevices to load the driver package. On Win 10, however, this often results in two fake devices. As I understand it, Device Manager will now create a fake device automatically in some cases.

Using the “pnputil -i -a” command does not result in two devices, but I’m not sure which APIs it uses, and we don’t have source code for it. It looks like it uses SetupCopyOEMInf and DiInstallDriver, so maybe that’s enough. Hopefully, someone else will respond.

Dear Tim,

Now I am able to install driver programmatically, But In one use case i am stuck.

Based on some condition i have to hide Virtual mic from sound control panel , but need to keep in device manager.

how to achieve this, can I achieve using ioctl if yes then what i have to do in driver class.

Thanks.