A interesting problem about DeviceIoControl

Hi, all:
I writed a virtual disk driver. This driver can image a file to a
drive. The driver will create a symbolic link (for example H:) when it
receive a IO control code( MOUNT_IMAGE).

When I send the MOUNT_IMAGE io control code from UM, this driver
work fine. I can access the virtual drive(H:) by explorer. If I send
the MOUNT_IMAGE io control code from KM, just like below code:

status = IoGetDeviceObjectPointer(&name, FILE_READ_DATA,
&FileObject, &DeviceObject);

KeInitializeEvent(&event, NotificationEvent, FALSE);
irp = IoBuildDeviceIoControlRequest(…);

status = IoCallDriver(…);

if (status == STATUS_PENDING) {
KeWaitForSingleObject(…);
status = IoStatus.status);
}

The driver can also create the symbolic link, but I can not access
the virtual drive by explorer or other means. It return
STATUS_INVALID_PARAMETER error when I try to open the drive!

Your advise is very very important for me, thanks for all reply.

-L

Download WinObj from System Internals web and check where your symbolic link is created. I’d bet you create it in logon session (system) folder and that’s why it isn’t accessible from user process. Do we speak about XP or w2k3 or w2k with terminal services, right?

Hint: don’t mount image from kernel mode (what’s the reason?) or create symbolic link via DefineDosDevice() from user mode.

Best regards,

Michal Vodicka
UPEK, Inc.
[xxxxx@upek.com, http://www.upek.com]


From: xxxxx@lists.osr.com[SMTP:xxxxx@lists.osr.com] on behalf of Leo[SMTP:xxxxx@gmail.com]
Reply To: Windows System Software Devs Interest List
Sent: Monday, June 27, 2005 11:02 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] A interesting problem about DeviceIoControl

Hi, all:
I writed a virtual disk driver. This driver can image a file to a
drive. The driver will create a symbolic link (for example H:) when it
receive a IO control code( MOUNT_IMAGE).

When I send the MOUNT_IMAGE io control code from UM, this driver
work fine. I can access the virtual drive(H:) by explorer. If I send
the MOUNT_IMAGE io control code from KM, just like below code:

status = IoGetDeviceObjectPointer(&name, FILE_READ_DATA,
&FileObject, &DeviceObject);

KeInitializeEvent(&event, NotificationEvent, FALSE);
irp = IoBuildDeviceIoControlRequest(…);

status = IoCallDriver(…);

if (status == STATUS_PENDING) {
KeWaitForSingleObject(…);
status = IoStatus.status);
}

The driver can also create the symbolic link, but I can not access
the virtual drive by explorer or other means. It return
STATUS_INVALID_PARAMETER error when I try to open the drive!

Your advise is very very important for me, thanks for all reply.

-L


Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

I meant “…in WRONG logon session (system) folder…”. BTW, system related logon sessions have IDs < 1000 i.e. 0x3e7 and lower.

Best regards,

Michal Vodicka
UPEK, Inc.
[xxxxx@upek.com, http://www.upek.com]


From: xxxxx@lists.osr.com[SMTP:xxxxx@lists.osr.com] on behalf of Michal Vodicka[SMTP:xxxxx@upek.com]
Reply To: Windows System Software Devs Interest List
Sent: Tuesday, June 28, 2005 3:33 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] A interesting problem about DeviceIoControl

Download WinObj from System Internals web and check where your symbolic link is created. I’d bet you create it in logon session (system) folder and that’s why it isn’t accessible from user process. Do we speak about XP or w2k3 or w2k with terminal services, right?

Hint: don’t mount image from kernel mode (what’s the reason?) or create symbolic link via DefineDosDevice() from user mode.

Best regards,

Michal Vodicka
UPEK, Inc.
[xxxxx@upek.com, http://www.upek.com]

> ----------
> From: xxxxx@lists.osr.com[SMTP:xxxxx@lists.osr.com] on behalf of Leo[SMTP:xxxxx@gmail.com]
> Reply To: Windows System Software Devs Interest List
> Sent: Monday, June 27, 2005 11:02 AM
> To: Windows System Software Devs Interest List
> Subject: [ntdev] A interesting problem about DeviceIoControl
>
> Hi, all:
> I writed a virtual disk driver. This driver can image a file to a
> drive. The driver will create a symbolic link (for example H:) when it
> receive a IO control code( MOUNT_IMAGE).
>
> When I send the MOUNT_IMAGE io control code from UM, this driver
> work fine. I can access the virtual drive(H:) by explorer. If I send
> the MOUNT_IMAGE io control code from KM, just like below code:
>
> status = IoGetDeviceObjectPointer(&name, FILE_READ_DATA,
> &FileObject, &DeviceObject);
>
> KeInitializeEvent(&event, NotificationEvent, FALSE);
> irp = IoBuildDeviceIoControlRequest(…);
>
> status = IoCallDriver(…);
>
> if (status == STATUS_PENDING) {
> KeWaitForSingleObject(…);
> status = IoStatus.status);
> }
> …
>
> The driver can also create the symbolic link, but I can not access
> the virtual drive by explorer or other means. It return
> STATUS_INVALID_PARAMETER error when I try to open the drive!
>
> Your advise is very very important for me, thanks for all reply.
>
> -L
>
> —
> Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>


Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Yet another note: logon session used depends on current process context when symbolic link is created so you have to ensure current process falls to interractive logon session. The easiest way is to call the IOCTL from process started by the user. Another way is to create global symbolic link which is usually wrong because all logged users would be able to use it. Imagine Fast User Switching is used.

Best regards,

Michal Vodicka
UPEK, Inc.
[xxxxx@upek.com, http://www.upek.com]


From: xxxxx@lists.osr.com[SMTP:xxxxx@lists.osr.com] on behalf of Michal Vodicka[SMTP:xxxxx@upek.com]
Reply To: Windows System Software Devs Interest List
Sent: Tuesday, June 28, 2005 3:37 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] A interesting problem about DeviceIoControl

I meant “…in WRONG logon session (system) folder…”. BTW, system related logon sessions have IDs < 1000 i.e. 0x3e7 and lower.

Best regards,

Michal Vodicka
UPEK, Inc.
[xxxxx@upek.com, http://www.upek.com]

> ----------
> From: xxxxx@lists.osr.com[SMTP:xxxxx@lists.osr.com] on behalf of Michal Vodicka[SMTP:xxxxx@upek.com]
> Reply To: Windows System Software Devs Interest List
> Sent: Tuesday, June 28, 2005 3:33 AM
> To: Windows System Software Devs Interest List
> Subject: RE: [ntdev] A interesting problem about DeviceIoControl
>
> Download WinObj from System Internals web and check where your symbolic link is created. I’d bet you create it in logon session (system) folder and that’s why it isn’t accessible from user process. Do we speak about XP or w2k3 or w2k with terminal services, right?
>
> Hint: don’t mount image from kernel mode (what’s the reason?) or create symbolic link via DefineDosDevice() from user mode.
>
> Best regards,
>
> Michal Vodicka
> UPEK, Inc.
> [xxxxx@upek.com, http://www.upek.com]
>
>
> > ----------
> > From: xxxxx@lists.osr.com[SMTP:xxxxx@lists.osr.com] on behalf of Leo[SMTP:xxxxx@gmail.com]
> > Reply To: Windows System Software Devs Interest List
> > Sent: Monday, June 27, 2005 11:02 AM
> > To: Windows System Software Devs Interest List
> > Subject: [ntdev] A interesting problem about DeviceIoControl
> >
> > Hi, all:
> > I writed a virtual disk driver. This driver can image a file to a
> > drive. The driver will create a symbolic link (for example H:) when it
> > receive a IO control code( MOUNT_IMAGE).
> >
> > When I send the MOUNT_IMAGE io control code from UM, this driver
> > work fine. I can access the virtual drive(H:) by explorer. If I send
> > the MOUNT_IMAGE io control code from KM, just like below code:
> >
> > status = IoGetDeviceObjectPointer(&name, FILE_READ_DATA,
> > &FileObject, &DeviceObject);
> >
> > KeInitializeEvent(&event, NotificationEvent, FALSE);
> > irp = IoBuildDeviceIoControlRequest(…);
> >
> > status = IoCallDriver(…);
> >
> > if (status == STATUS_PENDING) {
> > KeWaitForSingleObject(…);
> > status = IoStatus.status);
> > }
> > …
> >
> > The driver can also create the symbolic link, but I can not access
> > the virtual drive by explorer or other means. It return
> > STATUS_INVALID_PARAMETER error when I try to open the drive!
> >
> > Your advise is very very important for me, thanks for all reply.
> >
> > -L
> >
> > —
> > Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
> —
> Questions? First check the Kernel Driver FAQ at > http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>


Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Thank Mickal.

I have found the reason. I use
status = IoGetDeviceObjectPointer(&name, FILE_READ_DATA,
&FileObject, &DeviceObject);
to get the device object. When I add
ObDereferenceObejct(FileObject);
to my program below IO control completed code, it seems to work. I can
access the virtual drive by type drive letter in explorer.

But it cause anthor problem, when I send anthor IO control to my
driver, I got a BSOD ( FAT_FILE_SYSTEM(23) ),
ExceptionAddress: (nt!IoIsOperationSynchronous+0x0000000a).

I am a newbie for Device Driver Development. So I am very confuse with
this probelm now. The UM DeviceIoControl can work well, but the KM
DeviceIoControl will cause the BSOD. why ?

thanks for all reply.

On 6/28/05, Michal Vodicka wrote:
> Yet another note: logon session used depends on current process context when symbolic link is created so you have to ensure current process falls to interractive logon session. The easiest way is to call the IOCTL from process started by the user. Another way is to create global symbolic link which is usually wrong because all logged users would be able to use it. Imagine Fast User Switching is used.
>
> Best regards,
>
> Michal Vodicka
> UPEK, Inc.
> [xxxxx@upek.com, http://www.upek.com]
>
>
> > ----------
> > From: xxxxx@lists.osr.com[SMTP:xxxxx@lists.osr.com] on behalf of Michal Vodicka[SMTP:xxxxx@upek.com]
> > Reply To: Windows System Software Devs Interest List
> > Sent: Tuesday, June 28, 2005 3:37 AM
> > To: Windows System Software Devs Interest List
> > Subject: RE: [ntdev] A interesting problem about DeviceIoControl
> >
> > I meant “…in WRONG logon session (system) folder…”. BTW, system related logon sessions have IDs < 1000 i.e. 0x3e7 and lower.
> >
> > Best regards,
> >
> > Michal Vodicka
> > UPEK, Inc.
> > [xxxxx@upek.com, http://www.upek.com]
> >
> >
> > > ----------
> > > From: xxxxx@lists.osr.com[SMTP:xxxxx@lists.osr.com] on behalf of Michal Vodicka[SMTP:xxxxx@upek.com]
> > > Reply To: Windows System Software Devs Interest List
> > > Sent: Tuesday, June 28, 2005 3:33 AM
> > > To: Windows System Software Devs Interest List
> > > Subject: RE: [ntdev] A interesting problem about DeviceIoControl
> > >
> > > Download WinObj from System Internals web and check where your symbolic link is created. I’d bet you create it in logon session (system) folder and that’s why it isn’t accessible from user process. Do we speak about XP or w2k3 or w2k with terminal services, right?
> > >
> > > Hint: don’t mount image from kernel mode (what’s the reason?) or create symbolic link via DefineDosDevice() from user mode.
> > >
> > > Best regards,
> > >
> > > Michal Vodicka
> > > UPEK, Inc.
> > > [xxxxx@upek.com, http://www.upek.com]
> > >
> > >
> > > > ----------
> > > > From: xxxxx@lists.osr.com[SMTP:xxxxx@lists.osr.com] on behalf of Leo[SMTP:xxxxx@gmail.com]
> > > > Reply To: Windows System Software Devs Interest List
> > > > Sent: Monday, June 27, 2005 11:02 AM
> > > > To: Windows System Software Devs Interest List
> > > > Subject: [ntdev] A interesting problem about DeviceIoControl
> > > >
> > > > Hi, all:
> > > > I writed a virtual disk driver. This driver can image a file to a
> > > > drive. The driver will create a symbolic link (for example H:) when it
> > > > receive a IO control code( MOUNT_IMAGE).
> > > >
> > > > When I send the MOUNT_IMAGE io control code from UM, this driver
> > > > work fine. I can access the virtual drive(H:) by explorer. If I send
> > > > the MOUNT_IMAGE io control code from KM, just like below code:
> > > >
> > > > status = IoGetDeviceObjectPointer(&name, FILE_READ_DATA,
> > > > &FileObject, &DeviceObject);
> > > >
> > > > KeInitializeEvent(&event, NotificationEvent, FALSE);
> > > > irp = IoBuildDeviceIoControlRequest(…);
> > > >
> > > > status = IoCallDriver(…);
> > > >
> > > > if (status == STATUS_PENDING) {
> > > > KeWaitForSingleObject(…);
> > > > status = IoStatus.status);
> > > > }
> > > > …
> > > >
> > > > The driver can also create the symbolic link, but I can not access
> > > > the virtual drive by explorer or other means. It return
> > > > STATUS_INVALID_PARAMETER error when I try to open the drive!
> > > >
> > > > Your advise is very very important for me, thanks for all reply.
> > > >
> > > > -L
> > > >
> > > > —
> > > > Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
> > > >
> > > > You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
> > > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> > > >
> > >
> > > —
> > > Questions? First check the Kernel Driver FAQ at > http://www.osronline.com/article.cfm?id=256
> > >
> > > You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
> > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
> —
> Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

Don’t forget to fill the NextLoc->FileObject field in the IRP before
sending it down.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Leo”
To: “Windows System Software Devs Interest List”
Sent: Tuesday, June 28, 2005 7:29 AM
Subject: Re: [ntdev] A interesting problem about DeviceIoControl

Thank Mickal.

I have found the reason. I use
status = IoGetDeviceObjectPointer(&name, FILE_READ_DATA,
&FileObject, &DeviceObject);
to get the device object. When I add
ObDereferenceObejct(FileObject);
to my program below IO control completed code, it seems to work. I can
access the virtual drive by type drive letter in explorer.

But it cause anthor problem, when I send anthor IO control to my
driver, I got a BSOD ( FAT_FILE_SYSTEM(23) ),
ExceptionAddress: (nt!IoIsOperationSynchronous+0x0000000a).

I am a newbie for Device Driver Development. So I am very confuse with
this probelm now. The UM DeviceIoControl can work well, but the KM
DeviceIoControl will cause the BSOD. why ?

thanks for all reply.

On 6/28/05, Michal Vodicka wrote:
> Yet another note: logon session used depends on current process context when
symbolic link is created so you have to ensure current process falls to
interractive logon session. The easiest way is to call the IOCTL from process
started by the user. Another way is to create global symbolic link which is
usually wrong because all logged users would be able to use it. Imagine Fast
User Switching is used.
>
> Best regards,
>
> Michal Vodicka
> UPEK, Inc.
> [xxxxx@upek.com, http://www.upek.com]
>
>
> > ----------
> > From:
xxxxx@lists.osr.com[SMTP:xxxxx@lists.osr.com] on
behalf of Michal Vodicka[SMTP:xxxxx@upek.com]
> > Reply To: Windows System Software Devs Interest List
> > Sent: Tuesday, June 28, 2005 3:37 AM
> > To: Windows System Software Devs Interest List
> > Subject: RE: [ntdev] A interesting problem about DeviceIoControl
> >
> > I meant “…in WRONG logon session (system) folder…”. BTW, system related
logon sessions have IDs < 1000 i.e. 0x3e7 and lower.
> >
> > Best regards,
> >
> > Michal Vodicka
> > UPEK, Inc.
> > [xxxxx@upek.com, http://www.upek.com]
> >
> >
> > > ----------
> > > From:
xxxxx@lists.osr.com[SMTP:xxxxx@lists.osr.com] on
behalf of Michal Vodicka[SMTP:xxxxx@upek.com]
> > > Reply To: Windows System Software Devs Interest List
> > > Sent: Tuesday, June 28, 2005 3:33 AM
> > > To: Windows System Software Devs Interest List
> > > Subject: RE: [ntdev] A interesting problem about DeviceIoControl
> > >
> > > Download WinObj from System Internals web and check where your symbolic
link is created. I’d bet you create it in logon session (system) folder and
that’s why it isn’t accessible from user process. Do we speak about XP or w2k3
or w2k with terminal services, right?
> > >
> > > Hint: don’t mount image from kernel mode (what’s the reason?) or create
symbolic link via DefineDosDevice() from user mode.
> > >
> > > Best regards,
> > >
> > > Michal Vodicka
> > > UPEK, Inc.
> > > [xxxxx@upek.com, http://www.upek.com]
> > >
> > >
> > > > ----------
> > > > From:
xxxxx@lists.osr.com[SMTP:xxxxx@lists.osr.com] on
behalf of Leo[SMTP:xxxxx@gmail.com]
> > > > Reply To: Windows System Software Devs Interest List
> > > > Sent: Monday, June 27, 2005 11:02 AM
> > > > To: Windows System Software Devs Interest List
> > > > Subject: [ntdev] A interesting problem about DeviceIoControl
> > > >
> > > > Hi, all:
> > > > I writed a virtual disk driver. This driver can image a file to a
> > > > drive. The driver will create a symbolic link (for example H:) when it
> > > > receive a IO control code( MOUNT_IMAGE).
> > > >
> > > > When I send the MOUNT_IMAGE io control code from UM, this driver
> > > > work fine. I can access the virtual drive(H:) by explorer. If I send
> > > > the MOUNT_IMAGE io control code from KM, just like below code:
> > > >
> > > > status = IoGetDeviceObjectPointer(&name, FILE_READ_DATA,
> > > > &FileObject, &DeviceObject);
> > > >
> > > > KeInitializeEvent(&event, NotificationEvent, FALSE);
> > > > irp = IoBuildDeviceIoControlRequest(…);
> > > >
> > > > status = IoCallDriver(…);
> > > >
> > > > if (status == STATUS_PENDING) {
> > > > KeWaitForSingleObject(…);
> > > > status = IoStatus.status);
> > > > }
> > > > …
> > > >
> > > > The driver can also create the symbolic link, but I can not access
> > > > the virtual drive by explorer or other means. It return
> > > > STATUS_INVALID_PARAMETER error when I try to open the drive!
> > > >
> > > > Your advise is very very important for me, thanks for all reply.
> > > >
> > > > -L
> > > >
> > > > —
> > > > Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
> > > >
> > > > You are currently subscribed to ntdev as: unknown lmsubst tag argument:
‘’
> > > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> > > >
> > >
> > > —
> > > Questions? First check the Kernel Driver FAQ at >
http://www.osronline.com/article.cfm?id=256
> > >
> > > You are currently subscribed to ntdev as: unknown lmsubst tag argument:
‘’
> > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com