The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
We have a minifilter/filter driver that uses both the minifilter instance setup callback and filter driver's AddDevice to monitor USB connections and block some of them.
The problem is that on some cases, for example when the user connects its mobile phone to the USB port, when we send IOCTL_STORAGE_QUERY_PROPERTY to the corresponding device in either the minifilter instance setup callback or the filter driver AddDevice, it returns BusTypeSas instead of BusTypeUsb?
Although so far we only have witnessed this in VMware VMs, but are not sure if its related to VMware or the USB device? We also have tried to send the IOCTL_STORAGE_QUERY_PROPERTY to different devices on the stack (pdo, fdo, etc) but all of them return BusTypeSas.
And we get the hardwareID of the corresponding device object using IoGetDeviceProperty, we get something that starts with SCSI\VMware..
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!|
|Writing WDF Drivers||12 September 2022||Live, Online|
|Internals & Software Drivers||23 October 2022||Live, Online|
|Kernel Debugging||14 November 2022||Live, Online|
|Developing Minifilters||5 December 2022||Live, Online|