We are trying to make a WDM filter driver for Win XP that will intercept
read and write data from and into a disk drive.
What we did first was to try to make a Hock routine for IRP_MJ_READ creating
a new Irp as suggested somewhere in this list. The following example code
shows a sample function we are working on: A hock routine that
sweeps a new IRP(ipr2) in front of the original Irp passed by as
an argument.
we could not find an example code that gives us enough information
for implementing what we want to implement.
Our questions are:
-
Is there a good sample code available out there?
-
Our code shuts down the OS and makes it show a blue screen
with error messages:
Technical information
***stop: 0xC0000005, 0xF655ACE3, 0XF3D6AB0C, 0x00000000
Fastfat.sys Address F655ACE3 base at F655A000, Date stamp 3b7de38a
We cannot figure out how to set nextIrpStack. Could someone give us an
advice? also we are wondering if we need to handle the exit status
for the Irp passed by for such as pending, cancel, or normal status.
We very appreciate if someone could point problems out for us.
We are using DO_DIRECT_IO mode for the sample code.
Thanks in advance. 
Yosuke
//----------------------------------------------------------------------
// DriverObject->MajorFunction[IRP_MJ_READ] = Hock2x2;
// Hock2x2
//
// This routine is the main hook routine for IRP_MJ_READ !
//
//----------------------------------------------------------------------
NTSTATUS
Hock2x2(
PDEVICE_OBJECT HookDevice,
IN PIRP Irp
)
{
PIO_STACK_LOCATION currentIrpStack;
PIO_STACK_LOCATION nextIrpStack;
PHOOK_EXTENSION hookExt;
NTSTATUS sts;
KEVENT event;
IO_STATUS_BLOCK iosb;
PDEVICE_OBJECT topOfStack;
PIRP irp2;
PUCHAR addr;
PUCHAR addr2;
currentIrpStack = IoGetCurrentIrpStackLocation(Irp);
nextIrpStack = IoGetNextIrpStackLocation(Irp);
hookExt = HookDevice->DeviceExtension;
sts = STATUS_SEVERITY_ERROR;
if( hookExt->Hooked ) {
switch( currentIrpStack->MajorFunction ) {
case IRP_MJ_READ:
KeInitializeEvent(&event,
SynchronizationEvent/*NotificationEvent??*/, FALSE);
topOfStack = IoGetAttachedDeviceReference(HookDevice);
addr2 = ExAllocatePoolWithTag( NonPagedPool ,
currentIrpStack->Parameters.Read.Length,
‘tLcK’ );
if( addr2==NULL ) {
break;
}
irp2 = IoBuildSynchronousFsdRequest( IRP_MJ_READ,
topOfStack,
addr2,
currentIrpStack->Parameters.Read.Length,
¤tIrpStack->Parameters.Read.ByteOffset,
&event,
&iosb);
if( irp2==NULL ) {
break;
}
//currentIrpStack = IoGetCurrentIrpStackLocation(irp2);
*nextIrpStack = *currentIrpStack;
sts = IoCallDriver( hookExt->FileSystem, irp2 );
if( sts==STATUS_SUCCESS ) {
// DO_DIRECT_IO mode only !!!
addr = MmGetSystemAddressForMdlSafe(Irp->MdlAddress,
NormalPagePriority);
RtlCopyMemory( addr, addr2,
currentIrpStack->Parameters.Read.Length );
}
ExFreePool(addr2); // Free
addr2 = 0;
ObDereferenceObject(topOfStack); // Free
topOfStack = 0;
break;
default:
*nextIrpStack = *currentIrpStack;
sts = IoCallDriver( hookExt->FileSystem, Irp );
break;
}
}
return( sts );
}