UpperFilter Device Object

Hi everyone.
I hope you’re doing well.

I’ve written an UpperFilter DO for many device type preventing them from starting at “IRP_MN_START_DEVICE”. According to MSDN the ClassGuid “GUID_DEVCLASS_NET” is for both Wireless and Ethernet Device/Interface, if I wasn’t wrong.
So, Please let me know how I can distinguish between Wireless and Ethernet at “IRP_MN_START_DEVICE” ?
And is there any way to know any devices are “External” or “Internal” ?

Thank you so much for your help

There is no possible way for any software to know the difference between ‘internal’ or ‘external’ devices.

There is no possible way

You’re sure of that? You’ve tried it?

Because I’m not so sure. Seems like you should be able to suss this out with some sort of query. But, never having done this (though I may need to soon), I passed on answering.

Peter

I’m pretty sure a proper ndis filter can figure this out, but the op is limited to ‘things one can query during START_DEVICE’, and that is a pretty short list.

I am very sure because I have done crazy things like building machines with external SCSI cables and internal USB devices. Hardware can report ‘internal’ versus ‘external’ status, and one can make inferences based on the bus type or other characteristics of the device, but there is no definitive test that software can make.

external SCSI cables and internal USB devices

Sure, that’s not so crazy at all.

SCSI is, indeed, a good one. No telling there, for sure.

ISTR that there’s a proxy/heuristic specifically for internal USB devices…ah, perhaps the “removable” attribute?

Anyhow, it’s an interesting problem.

Hi again,

Guys I was studying MSDN and I’m not sure but, Can I use “DEVICE_REMOVAL_POLICY” to determine if one device is “external” or “internal” ? For ex: “External WIFI” or “Internal LAN” ?

Just for more information, I extract device information at “Add Device” and store them in “device extension” and at “IRP PNP | MN Start” I will match and prevent devices from starting.

Tnx for your help and guidance

Well, ANYthing like that is going to be an heuristic, and not necessarily definitive. So, you simply need to try it on a bunch of systems to see how accurate it is.

In ANY case, Mr. Bond is certainly correct that there’s no in-built feature in Windows that definitively tells you “this device is internal” – And, as he so aptly demonstrated by the SCSI case, in at least some cases it’s absolutely impossible to know what’s IN the machine and what’s NOT in the machine.

Peter

It should also be noted that the newer SAS and NVMe protocols also have extensive families of internal and external hardware and thunderbolt is external PCIe.

If you change your question, and ask is a device removable or not, then yes you can get an answer. Understanding of course that some external devices are not marked as removable and some internal devices are.

On a test machine that I have, Windows boots from an external drive, but the CPU is marked as removable.

Thank everyone for help.

@MBond2 , About “removable device”, Do you mean “IOCTL_STORAGE_QUERY_PROPERTY”? And does it only work for “Storage Devices” such as “USB Flash Memory” ? Could you give me a little more information please?

About my first question, “Distinguish between wireless or ethernet”, Do you think there is any way for me to distinguish them here?

Only for more information: I found all parents of device and queried “IRP_MN_QUERY_BUS_INFORMATION” but unfortunately it didn’t work and some devices didn’t handle this query.