Communicating with storport.sys driver from usermode

NTDEV
1

How can I communicate with storport.sys driver from user mode win32 application using DeviceIoControl API . I want to use a specific IOCTL CODE of the driver?

Thanks

2

See SRB_FUNCTION_IO_CONTROL and IOCTL_SCSI_MINIPORT (ntddscsi.h) - Windows drivers | Microsoft Learn

3

Thanks. But Still I am getting Error code 0x1. I want to use this IOCTL routine RaUnitStorageGetIdlePowerUpReason having IOCTL CODE 0x2d1c84.

image
image861×191 11 KB

#include <Windows.h>
#include <stdio.h>

#include <ntddscsi.h>

int main()
{
	HANDLE hDevice = CreateFile(
		L"\\\\.\\Scsi0:",
		GENERIC_READ | GENERIC_WRITE,
		FILE_SHARE_READ | FILE_SHARE_WRITE,
		NULL,
		OPEN_EXISTING,
		FILE_ATTRIBUTE_NORMAL,
		NULL);

	if (hDevice == INVALID_HANDLE_VALUE)
	{
		printf("[-] Failed to open handle to Scsi0 (0x%x)", GetLastError());
		exit(-1);
	}

	DWORD BytesReturned = 0;

	SRB_IO_CONTROL srbctrl = { 0 };
	SRB_IO_CONTROL newsrbctrl = { 0 };

	srbctrl.HeaderLength = sizeof(SRB_IO_CONTROL);
	memcpy((void*)srbctrl.Signature, "TEST", 4);
	srbctrl.ControlCode = 0x2d1c84;

	BOOL ret = DeviceIoControl(
		hDevice,
		IOCTL_SCSI_MINIPORT,
		&srbctrl, sizeof(SRB_IO_CONTROL),
		&newsrbctrl, sizeof(SRB_IO_CONTROL),
		&BytesReturned,
		NULL);

	if (!ret)
	{
		printf("[-] DeviceIoControl API failed (0x%x)", GetLastError());
		CloseHandle(hDevice);
		exit(-1);
	}

	CloseHandle(hDevice);
	return 0;
}

Thanks.

4

IOCTL_SCSI_MINIPORT has the value 0x0004d008. If you think you need 0x2d1c84, which would be in the IOCTL_STORAGE_xxx range, then why aren't you sending that?

5

The SRB_IO_CONTROL ControlCode values are vendor specific. The mechanism is intended to be vendor specific.

As the vendor's adapter driver is unlikely to support this request, it is going to return an error, and ERROR_INVALID_FUNCTION maps to STATUS_INVALID_DEVICE_REQUEST (and other NTSTATUS values.)

The LSI sample driver, for example, does this for an unrecognized SRB_IO_CONTROL:

Srb->SrbStatus = SRB_STATUS_INVALID_REQUEST;

Offhand I don't recall the mapping from SRB_STATUS_* to NTSTATUS, but again STATUS_INVALID_DEVICE_REQUEST seems appropriate.

@windowsuser : you should try this with a valid vendor specific control code and signature, anything else is going to return an error. While the control code might be valid for your adapter, the signature looks wrong.

6

To be more Clear
This is the windows system- specific driver storport.sys not any third party vendor driver.
I have a shared virtual disk in hyper-v , I got his device path using Winobj as HarddiskVolume4 . I cannot send any IOCTL to that handle , every IOCTL gives error code 1.

int main()
{
	HANDLE hDevice = CreateFile(
		L"\\\\.\\HarddiskVolume4",
		GENERIC_READ | GENERIC_WRITE,
		FILE_SHARE_READ | FILE_SHARE_WRITE,
		NULL,
		OPEN_EXISTING,
		0,
		NULL);

	if (hDevice == INVALID_HANDLE_VALUE)
	{
		printf("[-] Failed to open handle to HarddiskVolume (0x%x)", GetLastError());
		exit(-1);
	}

	DWORD BytesReturned = 0;

	char InBuf[256] = { 0 };
	char outBuf[256] = { 0 };

	BOOL ret = DeviceIoControl(
		hDevice,
		0x2d1c84,
		&InBuf, 256,
		&outBuf, 256,
		&BytesReturned,
		NULL);

	if (!ret)
	{
		printf("[-] DeviceIoControl API failed (0x%x)", GetLastError());
		CloseHandle(hDevice);
		exit(-1);
	}

	CloseHandle(hDevice);
	return 0;
}

@Tim_Roberts , IOCTL_STORAGE_XXX is not documented , so I have sent the IOCTL code directly 0x2d1c84, but it stills gives error code 1.

I think I have some error in opening file , please can anyone verify it . Thanks

7

IOCTL_STORAGE_XXX is not documented

Of course it's not, what I meant is that number is in the range of IOCTL_STORAGE ioctls.

Do you know what this code is supposed to be? If not, why on earth would you be endangering your computer by sending it into the kernel?

8

I’ll try to be clearer. IOCTL_SCSI_MINIPORT can only be sent to an adapter device, not a disk device, and only supports vendor specific control codes and signatures.

9

storport.sys is the port driver for all storport based adapter devices. It 'contains' the miniport vendor specific device driver.

You cannot send IOCTL_STORAGE_GET_IDLE_POWERUP_REASON or any other IOCTL_STORAGE_* ioctls to volume devices, and L"\\.\HarddiskVolume4" is a volume device, a partition on a physical disk device, not a disk device. You want something like \.\PhysicalDrive0.

Your IOCTL is defined in ntddstor.h.

10

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.