Beginner Question - Driver Communication

NTDEV
1

Hi, Sorry if this is stupid question but I’ve seen some drivers create
device name and have dispatch callback (exactly IRP_MJ_DEVICE_CONTROL,
not INTERNAL) but they don’t create a symbolic name for the device, is
it possible to open this device just by device name from user-mode and
send IOCLT codes to it?

Beside that, how I can communicate with a driver? Despite the shared
memory, WMI, dispatch callback or FLT port. Thanks, Darren

2

I think this might help…

https://www.osr.com/nt-insider/2013-issue1/inverted-call-model-kmdf/
http://www.osronline.com/article.cfm?id=94.

Cheers !!!

3

Thanks for the reply, but the driver I’m dealing with is WDM driver with
a IRP_MJ_DEVICE_CONTROL callback and no symbolic name. Is it possible to
send it any IOCTL in the usual way?

Thanks,
Darren

On 8/8/2016 2:43 PM, xxxxx@gmail.com wrote:

I think this might help…

https://www.osr.com/nt-insider/2013-issue1/inverted-call-model-kmdf/
http://www.osronline.com/article.cfm?id=94.

Cheers !!!

NTDEV is sponsored by OSR

Visit the list online at: http:
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at http:
></http:></http:></http:>

4

If it does not have a symbolic link, it may have a device interface, see
IoRegisterDeviceInterface(). You can open a device by its interface.

Don Burn
Windows Driver Consulting
Website: http://www.windrvr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Darren Aronofsky
Sent: Monday, August 08, 2016 6:26 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Beginner Question - Driver Communication

Thanks for the reply, but the driver I’m dealing with is WDM driver with a
IRP_MJ_DEVICE_CONTROL callback and no symbolic name. Is it possible to send
it any IOCTL in the usual way?

Thanks,
Darren

On 8/8/2016 2:43 PM, xxxxx@gmail.com wrote:
> I think this might help…
>
> https://www.osr.com/nt-insider/2013-issue1/inverted-call-model-kmdf/
> http://www.osronline.com/article.cfm?id=94.
>
> Cheers !!!
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at:
> http:
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at
> http:
>

—
NTDEV is sponsored by OSR

Visit the list online at:
http:

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software
drivers!
Details at http:

To unsubscribe, visit the List Server section of OSR Online at
http:</http:></http:></http:></http:></http:></http:>

5

Thanks Don,

just to be sure, there is no other way than IoRegisterDeviceInterface
or a dos device name to open a driver?

Darren

On 8/8/2016 2:59 PM, Don Burn wrote:

If it does not have a symbolic link, it may have a device interface, see
IoRegisterDeviceInterface(). You can open a device by its interface.

Don Burn
Windows Driver Consulting
Website: http://www.windrvr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Darren Aronofsky
Sent: Monday, August 08, 2016 6:26 AM
To: Windows System Software Devs Interest List
> Subject: Re: [ntdev] Beginner Question - Driver Communication
>
> Thanks for the reply, but the driver I’m dealing with is WDM driver with a
> IRP_MJ_DEVICE_CONTROL callback and no symbolic name. Is it possible to send
> it any IOCTL in the usual way?
>
> Thanks,
> Darren
>
>
> On 8/8/2016 2:43 PM, xxxxx@gmail.com wrote:
>> I think this might help…
>>
>> https://www.osr.com/nt-insider/2013-issue1/inverted-call-model-kmdf/
>> http://www.osronline.com/article.cfm?id=94.
>>
>> Cheers !!!
>>
>> —
>> NTDEV is sponsored by OSR
>>
>> Visit the list online at:
>> http:
>>
>> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
>> Details at http:
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http:
>>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at:
> http:
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and software
> drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at
> http:
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at: http:
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at http:
></http:></http:></http:></http:></http:></http:></http:></http:></http:>

6

Those are it from user space.

Don Burn
Windows Driver Consulting
Website: http://www.windrvr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Darren Aronofsky
Sent: Monday, August 08, 2016 6:34 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Beginner Question - Driver Communication

Thanks Don,

just to be sure, there is no other way than IoRegisterDeviceInterface or a
dos device name to open a driver?

Darren

On 8/8/2016 2:59 PM, Don Burn wrote:
> If it does not have a symbolic link, it may have a device interface,
> see IoRegisterDeviceInterface(). You can open a device by its interface.
>
>
> Don Burn
> Windows Driver Consulting
> Website: http://www.windrvr.com
>
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Darren
> Aronofsky
> Sent: Monday, August 08, 2016 6:26 AM
> To: Windows System Software Devs Interest List
> Subject: Re: [ntdev] Beginner Question - Driver Communication
>
> Thanks for the reply, but the driver I’m dealing with is WDM driver
> with a IRP_MJ_DEVICE_CONTROL callback and no symbolic name. Is it
> possible to send it any IOCTL in the usual way?
>
> Thanks,
> Darren
>
>
> On 8/8/2016 2:43 PM, xxxxx@gmail.com wrote:
>> I think this might help…
>>
>> https://www.osr.com/nt-insider/2013-issue1/inverted-call-model-kmdf/
>> http://www.osronline.com/article.cfm?id=94.
>>
>> Cheers !!!
>>
>> —
>> NTDEV is sponsored by OSR
>>
>> Visit the list online at:
>> http:
>>
>> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
>> Details at http:
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http:
>>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at:
> http:
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at
> http:
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at:
> http:
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at
> http:
>

—
NTDEV is sponsored by OSR

Visit the list online at:
http:

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software
drivers!
Details at http:

To unsubscribe, visit the List Server section of OSR Online at
http:</http:></http:></http:></http:></http:></http:></http:></http:></http:></http:></http:></http:>

7

I also meant user-mode, Thanks Don.

On 8/8/2016 3:08 PM, Don Burn wrote:

Those are it from user space.

Don Burn
Windows Driver Consulting
Website: http://www.windrvr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Darren Aronofsky
Sent: Monday, August 08, 2016 6:34 AM
To: Windows System Software Devs Interest List
> Subject: Re: [ntdev] Beginner Question - Driver Communication
>
> Thanks Don,
>
> just to be sure, there is no other way than IoRegisterDeviceInterface or a
> dos device name to open a driver?
>
>
> Darren
>
> On 8/8/2016 2:59 PM, Don Burn wrote:
>> If it does not have a symbolic link, it may have a device interface,
>> see IoRegisterDeviceInterface(). You can open a device by its interface.
>>
>>
>> Don Burn
>> Windows Driver Consulting
>> Website: http://www.windrvr.com
>>
>>
>>
>> -----Original Message-----
>> From: xxxxx@lists.osr.com
>> [mailto:xxxxx@lists.osr.com] On Behalf Of Darren
>> Aronofsky
>> Sent: Monday, August 08, 2016 6:26 AM
>> To: Windows System Software Devs Interest List
>> Subject: Re: [ntdev] Beginner Question - Driver Communication
>>
>> Thanks for the reply, but the driver I’m dealing with is WDM driver
>> with a IRP_MJ_DEVICE_CONTROL callback and no symbolic name. Is it
>> possible to send it any IOCTL in the usual way?
>>
>> Thanks,
>> Darren
>>
>>
>> On 8/8/2016 2:43 PM, xxxxx@gmail.com wrote:
>>> I think this might help…
>>>
>>> https://www.osr.com/nt-insider/2013-issue1/inverted-call-model-kmdf/
>>> http://www.osronline.com/article.cfm?id=94.
>>>
>>> Cheers !!!
>>>
>>> —
>>> NTDEV is sponsored by OSR
>>>
>>> Visit the list online at:
>>> http:
>>>
>>> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>> software drivers!
>>> Details at http:
>>>
>>> To unsubscribe, visit the List Server section of OSR Online at
>>> http:
>>>
>>
>> —
>> NTDEV is sponsored by OSR
>>
>> Visit the list online at:
>> http:
>>
>> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>> software drivers!
>> Details at http:
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http:
>>
>>
>> —
>> NTDEV is sponsored by OSR
>>
>> Visit the list online at:
>> http:
>>
>> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
>> Details at http:
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http:
>>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at:
> http:
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and software
> drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at
> http:
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at: http:
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at http:
></http:></http:></http:></http:></http:></http:></http:></http:></http:></http:></http:></http:></http:></http:></http:>

8

Win32 applications can use DefineDosDevice() to create their own symlink.

Applications can also call NtCreateFile() directly, and open the device using
it’s kernel namespace name (e.g. Device\foobar).

I wouldn’t recommend either approach.

On 8/8/2016 12:41 AM, Darren Aronofsky wrote:

Hi, Sorry if this is stupid question but I’ve seen some drivers create device
name and have dispatch callback (exactly IRP_MJ_DEVICE_CONTROL, not INTERNAL)
but they don’t create a symbolic name for the device, is it possible to open
this device just by device name from user-mode and send IOCTL codes to it?

Beside that, how I can communicate with a driver? Despite the shared memory,
WMI, dispatch callback or FLT port. Thanks, Darren