Parsing SRB In IRP_MJ_SCSI request using WDF filter driver

NTDEV
1

Hi,

I am trying to parse SRB by sitting below Disk.sys. I am able to receive request in InternalIODeviceControl function. But if I check SRB parameters , it looks like corrupted / wrong.

By sitting above disk.sys read and write prints are seen. Below IOinternaldevicecontrol prints are see but SRB_FUNCTION_EXECUTE_SCSI is not received at all.

Any mistake in the below code.

DbgPrint(“Entered FilterEvtIoInternalDeviceControl\n”);

device = WdfIoQueueGetDevice(Queue);

filterExt = FilterGetData(device);

WDF_REQUEST_PARAMETERS_INIT(&Parameters);
switch (IoControlCode)
{

case 0:
    //DbgPrint("IRP_MJ_SCSI Received -------->\n");
    pIRPReceived = WdfRequestWdmGetIrp(Request);
    nextStack = IoGetCurrentIrpStackLocation(pIRPReceived);

    WdfRequestGetParameters(Request, &Parameters);

    Srb = nextStack->Parameters.Scsi.Srb;
    if(Srb && Srb->Function == SRB_FUNCTION_EXECUTE_SCSI)
    DbgPrint(" Srb Flags , Function %x %x , LUN %x\n", Srb->SrbFlags,Srb->Function,Srb->Lun);
    break;

}
}

Thanks

2

Moving to NTDEV

You need to also handle SRB_FUNCTION_STORAGE_REQUEST_BLOCK. See the Storage Class drivers source on GitHub (they’re the ones that build the SRBs):

https://github.com/microsoft/Windows-driver-samples/tree/main/storage/class

1 Like