disk drivers

Dear all,

I am a newcomer to the windows driver world. I am trying to write a disk
level encryptor.

There was some discussion regarding the same a few days back, as far as I
remember, that developer was trying to attach his driver above disk.sys and
was filtering READ nd WRITE IRPs. All of you told him to attach the driver
as a lower filter instead of an upper filter, as IOCTL calls would be
difficult to handle.

Can some one please explain the same to me in detail. What I do not
understand is, since my driver is filtering all calls to the disk in READ
and WRITE *do i need* to put in taps in otehr functions also? Why should I?
As a disk level driver should essentially only understand READS and WRITES
and not very high level information.

Madhu.


Beautiful Vienna. http://www.coxandkings.com Only with Cox & Kings

If you filter above DISK.SYS you have to realize that DISK.SYS will perform
reads and writes for several things that will not come in a IRP_MJ_READ or
IRP_MJ_WRITE. These things include reads and writes of partition data for
its own use, and many IOCTL’s.

So trying to encrypt sectors above DISK.SYS will cause you all kinds of
problems, since the driver itself and the various IOCTL’s use data you have
not encrypted. Of course if you add a filter to encrypt below DISK.SYS you
have the problem, that much of startup will not pass through your filter,
also the crash dump and hybernation I/O will not pass through your filter.

For these reasons, it is best to encrypt at the file level with a file
system filter, or in the disk hardware.


Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply

“madhu Singh” wrote in message news:xxxxx@ntdev…
> Dear all,
>
> I am a newcomer to the windows driver world. I am trying to write a disk
> level encryptor.
>
> There was some discussion regarding the same a few days back, as far as I
> remember, that developer was trying to attach his driver above disk.sys
> and
> was filtering READ nd WRITE IRPs. All of you told him to attach the driver
> as a lower filter instead of an upper filter, as IOCTL calls would be
> difficult to handle.
>
> Can some one please explain the same to me in detail. What I do not
> understand is, since my driver is filtering all calls to the disk in READ
> and WRITE do i need to put in taps in otehr functions also? Why should
> I?
> As a disk level driver should essentially only understand READS and WRITES
> and not very high level information.
>
> Madhu.
>
> _________________________________________________________________
> Beautiful Vienna. http://www.coxandkings.com Only with Cox & Kings
>
>

> Of course if you add a filter to encrypt below DISK.SYS you

have the problem, that much of startup will not pass through your filter

don can u explain this further please.

also the crash dump and hybernation I/O will not pass through your filter.

AFAAK hibernation and c dump has it’s own stack and doesn’t go through
disk.sys at all. They use the driver diskdump.sys instead, please
correct me if I am wrong.

-Developer

don,

thanks for the prompt help. well, as far as i know, DDK sample does have a
sample disk.sys implementaion. This implementation handles all the IOCTLs
that pass through it. So, is it not possible to tap the read write requests
there and do the encryption and decryption there also?

Below disk.sys all I get is IRP_MJ_INTERNAL_DEVICE_CONTROL (which is
#defined as IRP_MJ_SCSI). I don’t think there is any sample code to show me
the implementaiton of that IRP. Also, in that level I need to distinguish
between, control codes for the firmware which need not be touched and the
codes for the disk sectors, which needs my attention.

Please help.

Madhu

From: “Don Burn”
>Reply-To: “Windows System Software Devs Interest List”
>
>To: “Windows System Software Devs Interest List”
>Subject: Re:[ntdev] disk drivers
>Date: Mon, 8 Aug 2005 07:53:41 -0400
>
>If you filter above DISK.SYS you have to realize that DISK.SYS will perform
>reads and writes for several things that will not come in a IRP_MJ_READ or
>IRP_MJ_WRITE. These things include reads and writes of partition data for
>its own use, and many IOCTL’s.
>
>So trying to encrypt sectors above DISK.SYS will cause you all kinds of
>problems, since the driver itself and the various IOCTL’s use data you have
>not encrypted. Of course if you add a filter to encrypt below DISK.SYS
>you
>have the problem, that much of startup will not pass through your filter,
>also the crash dump and hybernation I/O will not pass through your filter.
>
>For these reasons, it is best to encrypt at the file level with a file
>system filter, or in the disk hardware.
>
>
>
>–
>Don Burn (MVP, Windows DDK)
>Windows 2k/XP/2k3 Filesystem and Driver Consulting
>Remove StopSpam from the email to reply
>
>
>
>“madhu Singh” wrote in message
>news:xxxxx@ntdev…
> > Dear all,
> >
> > I am a newcomer to the windows driver world. I am trying to write a disk
> > level encryptor.
> >
> > There was some discussion regarding the same a few days back, as far as
>I
> > remember, that developer was trying to attach his driver above disk.sys
> > and
> > was filtering READ nd WRITE IRPs. All of you told him to attach the
>driver
> > as a lower filter instead of an upper filter, as IOCTL calls would be
> > difficult to handle.
> >
> > Can some one please explain the same to me in detail. What I do not
> > understand is, since my driver is filtering all calls to the disk in
>READ
> > and WRITE do i need to put in taps in otehr functions also? Why should
> > I?
> > As a disk level driver should essentially only understand READS and
>WRITES
> > and not very high level information.
> >
> > Madhu.
> >
> >
> > Beautiful Vienna. http://www.coxandkings.com Only with Cox & Kings
> >
> >
>
>
>
>—
>Questions? First check the Kernel Driver FAQ at
>http://www.osronline.com/article.cfm?id=256
>
>You are currently subscribed to ntdev as: xxxxx@hotmail.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com


Formula One fan? http://server1.msn.co.in/sp05/tataracing/ Get news,
wallpapers and photos of Narain Karthikeyan.

Until you reach the point that the final storage stack exists, which is
after the boot drivers are all loaded, and most are initialized, the system
uses a variety of ways to access the disk. In partucular on boot it will
either use the BIOS or a supplied miniport driver to access data, and load
the initial set of files. This set of files can be quite extensive, yet
during this time, you have no ability to encrypt of decrypt disk sectors.

Yes dump and hibernation use their own stack, and it will not include your
filter.


Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply

“Developer” wrote in message news:xxxxx@ntdev…
> Of course if you add a filter to encrypt below DISK.SYS you
> have the problem, that much of startup will not pass through your filter

don can u explain this further please.

> also the crash dump and hybernation I/O will not pass through your filter.

AFAAK hibernation and c dump has it’s own stack and doesn’t go through
disk.sys at all. They use the driver diskdump.sys instead, please
correct me if I am wrong.

-Developer

don, lets forget boot disk encryption. lets take the simple data
partition example. For a data partition, which I think doesn’t involve
too much initialisation at boot time, except may be the explorer and
the system testing it’'s integrity and the mount manager mounting it,
by the time these things happen Madhu’s driver would be in place.

Yes, I agree IOCTL handling is a big issue, as most of the drive
initialisation is going to be through IOCTLs.only.

-Developer

On 8/8/05, Don Burn wrote:
> Until you reach the point that the final storage stack exists, which is
> after the boot drivers are all loaded, and most are initialized, the system
> uses a variety of ways to access the disk. In partucular on boot it will
> either use the BIOS or a supplied miniport driver to access data, and load
> the initial set of files. This set of files can be quite extensive, yet
> during this time, you have no ability to encrypt of decrypt disk sectors.
>
> Yes dump and hibernation use their own stack, and it will not include your
> filter.
>
>
> –
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> Remove StopSpam from the email to reply
>
>
>
> “Developer” wrote in message news:xxxxx@ntdev…
> > Of course if you add a filter to encrypt below DISK.SYS you
> > have the problem, that much of startup will not pass through your filter
>
> don can u explain this further please.
>
>
> > also the crash dump and hybernation I/O will not pass through your filter.
>
> AFAAK hibernation and c dump has it’s own stack and doesn’t go through
> disk.sys at all. They use the driver diskdump.sys instead, please
> correct me if I am wrong.
>
>
> -Developer
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>



- Developer

>AFAAK hibernation and c dump has it’s own stack and doesn’t go through

what is AFAAK ?


Try the new MSN Desktop Search Toolbar.
http://server1.msn.co.in/sp05/msntoolbar/index.asp Just answer 3 simple
questions.

Well, the concept of a data partition is an interesting one, how do you
force things to be a data only partition? If it is on a hard disk and of
reasonable size, there is always the possibility that someone comes along
and tries to install an OS. Yes you can do this stuff, for things like USB
memory sticks, but even there you need to do it below disk.sys, since
otherwise disk.sys will read encrypted data and crash.


Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply

“Developer” wrote in message news:xxxxx@ntdev…
don, lets forget boot disk encryption. lets take the simple data
partition example. For a data partition, which I think doesn’t involve
too much initialisation at boot time, except may be the explorer and
the system testing it’'s integrity and the mount manager mounting it,
by the time these things happen Madhu’s driver would be in place.

Yes, I agree IOCTL handling is a big issue, as most of the drive
initialisation is going to be through IOCTLs.only.

-Developer

On 8/8/05, Don Burn wrote:
> Until you reach the point that the final storage stack exists, which is
> after the boot drivers are all loaded, and most are initialized, the
> system
> uses a variety of ways to access the disk. In partucular on boot it will
> either use the BIOS or a supplied miniport driver to access data, and load
> the initial set of files. This set of files can be quite extensive, yet
> during this time, you have no ability to encrypt of decrypt disk sectors.
>
> Yes dump and hibernation use their own stack, and it will not include your
> filter.
>
>
> –
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> Remove StopSpam from the email to reply
>
>
>
> “Developer” wrote in message news:xxxxx@ntdev…
> > Of course if you add a filter to encrypt below DISK.SYS you
> > have the problem, that much of startup will not pass through your filter
>
> don can u explain this further please.
>
>
> > also the crash dump and hybernation I/O will not pass through your
> > filter.
>
> AFAAK hibernation and c dump has it’s own stack and doesn’t go through
> disk.sys at all. They use the driver diskdump.sys instead, please
> correct me if I am wrong.
>
>
> -Developer
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>



- Developer

don, developer,

if you have seen the disk.c code in the sample you will see that in some of
the ioctls it creates an IRP_MJ_READ and sends it down ( see attached code
below), but as far as i know, below disk.sys there is no IRP_MJ_READ, so
what is the use of doing so?

case IOCTL_STORAGE_PREDICT_FAILURE : {

PSTORAGE_PREDICT_FAILURE checkFailure;
STORAGE_FAILURE_PREDICT_STATUS diskSmartStatus;

DebugPrint((2, “IOCTL_STORAGE_PREDICT_FAILURE to device %p through
irp %p\n”,
DeviceObject, Irp));
DebugPrint((2, “Device is a%s.\n”,
commonExtension->IsFdo ? “n fdo” : " pdo"));

checkFailure =
(PSTORAGE_PREDICT_FAILURE)Irp->AssociatedIrp.SystemBuffer;

if (irpStack->Parameters.DeviceIoControl.OutputBufferLength <
sizeof(STORAGE_PREDICT_FAILURE)) {

status = STATUS_BUFFER_TOO_SMALL;
Irp->IoStatus.Status = sizeof(STORAGE_PREDICT_FAILURE);
break;
}

if(!commonExtension->IsFdo) {

//
// Pdo should issue this request to the lower device object
//

ClassReleaseRemoveLock(DeviceObject, Irp);
ExFreePool(srb);
SendToFdo(DeviceObject, Irp, status);
return status;
}

//
// See if the disk is predicting failure
//

if (diskData->FailurePredictionCapability == FailurePredictionSense)
{
ULONG readBufferSize;
PUCHAR readBuffer;
PIRP readIrp;
IO_STATUS_BLOCK ioStatus;
PDEVICE_OBJECT topOfStack;

KeInitializeEvent(&event, SynchronizationEvent, FALSE);

topOfStack = IoGetAttachedDeviceReference(DeviceObject);

//
// SCSI disks need to have a read sent down to provoke any
// failures to be reported.
//
// Issue a normal read operation. The error-handling code in
// classpnp will take care of a failure prediction by logging
the
// correct event.
//

readBufferSize = fdoExtension->DiskGeometry.BytesPerSector;
readBuffer = ExAllocatePoolWithTag(NonPagedPool,
readBufferSize,
DISK_TAG_SMART);

if (readBuffer != NULL) {
LARGE_INTEGER offset;

offset.QuadPart = 0;
readIrp = IoBuildSynchronousFsdRequest(
IRP_MJ_READ,
topOfStack,
readBuffer,
readBufferSize,
&offset,
&event,
&ioStatus);

if (readIrp != NULL) {
status = IoCallDriver(topOfStack, readIrp);
if (status == STATUS_PENDING) {
KeWaitForSingleObject(&event, Executive, KernelMode,
FALSE, NULL);
status = ioStatus.Status;
}
}

ExFreePool(readBuffer);
}
ObDereferenceObject(topOfStack);
}

  • madhu

From: “madhu Singh”
>Reply-To: “Windows System Software Devs Interest List”
>
>To: “Windows System Software Devs Interest List”
>Subject: Re:[ntdev] disk drivers
>Date: Mon, 08 Aug 2005 17:38:07 +0530
>
>don,
>
>thanks for the prompt help. well, as far as i know, DDK sample does have a
>sample disk.sys implementaion. This implementation handles all the IOCTLs
>that pass through it. So, is it not possible to tap the read write requests
>there and do the encryption and decryption there also?
>
>Below disk.sys all I get is IRP_MJ_INTERNAL_DEVICE_CONTROL (which is
>#defined as IRP_MJ_SCSI). I don’t think there is any sample code to show me
>the implementaiton of that IRP. Also, in that level I need to distinguish
>between, control codes for the firmware which need not be touched and the
>codes for the disk sectors, which needs my attention.
>
>Please help.
>
>Madhu
>
>
>
>
>>From: “Don Burn”
>>Reply-To: “Windows System Software Devs Interest List”
>>
>>To: “Windows System Software Devs Interest List”
>>Subject: Re:[ntdev] disk drivers
>>Date: Mon, 8 Aug 2005 07:53:41 -0400
>>
>>If you filter above DISK.SYS you have to realize that DISK.SYS will
>>perform
>>reads and writes for several things that will not come in a IRP_MJ_READ or
>>IRP_MJ_WRITE. These things include reads and writes of partition data for
>>its own use, and many IOCTL’s.
>>
>>So trying to encrypt sectors above DISK.SYS will cause you all kinds of
>>problems, since the driver itself and the various IOCTL’s use data you
>>have
>>not encrypted. Of course if you add a filter to encrypt below DISK.SYS
>>you
>>have the problem, that much of startup will not pass through your filter,
>>also the crash dump and hybernation I/O will not pass through your filter.
>>
>>For these reasons, it is best to encrypt at the file level with a file
>>system filter, or in the disk hardware.
>>
>>
>>
>>–
>>Don Burn (MVP, Windows DDK)
>>Windows 2k/XP/2k3 Filesystem and Driver Consulting
>>Remove StopSpam from the email to reply
>>
>>
>>
>>“madhu Singh” wrote in message
>>news:xxxxx@ntdev…
>> > Dear all,
>> >
>> > I am a newcomer to the windows driver world. I am trying to write a
>>disk
>> > level encryptor.
>> >
>> > There was some discussion regarding the same a few days back, as far as
>>I
>> > remember, that developer was trying to attach his driver above disk.sys
>> > and
>> > was filtering READ nd WRITE IRPs. All of you told him to attach the
>>driver
>> > as a lower filter instead of an upper filter, as IOCTL calls would be
>> > difficult to handle.
>> >
>> > Can some one please explain the same to me in detail. What I do not
>> > understand is, since my driver is filtering all calls to the disk in
>>READ
>> > and WRITE do i need to put in taps in otehr functions also? Why
>>should
>> > I?
>> > As a disk level driver should essentially only understand READS and
>>WRITES
>> > and not very high level information.
>> >
>> > Madhu.
>> >
>> >
>> > Beautiful Vienna. http://www.coxandkings.com Only with Cox & Kings
>> >
>> >
>>
>>
>>
>>—
>>Questions? First check the Kernel Driver FAQ at
>>http://www.osronline.com/article.cfm?id=256
>>
>>You are currently subscribed to ntdev as: xxxxx@hotmail.com
>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

>Formula One fan? http://server1.msn.co.in/sp05/tataracing/ Get news,
>wallpapers and photos of Narain Karthikeyan.
>
>
>—
>Questions? First check the Kernel Driver FAQ at
>http://www.osronline.com/article.cfm?id=256
>
>You are currently subscribed to ntdev as: xxxxx@hotmail.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com

_________________________________________________________________
Try the new MSN Desktop Search Toolbar.
http://server1.msn.co.in/sp05/msntoolbar/index.asp Just answer 3 simple
questions.

This is what debuggers are for, build disk.sys and start understanding what
is happening. If this is more than you want, fellow MVP Mark Roddy has a
lower filter for disk.sys on his site http://www.hollistech.com/ I am sure
for the correct sum of $$$ Mark would sell you a copy of the source. Also,
there are a number of consultants, including myself that will do the work
for you.

I am not trying to be flippant, but at some point you are basically going
from asking a specific question, to please give me a design for free.
Bottom line is that is what I and a number of the active members of this
group do for a living, and we do not do that for free.


Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply

“madhu Singh” wrote in message news:xxxxx@ntdev…
> don,
>
> thanks for the prompt help. well, as far as i know, DDK sample does have a
> sample disk.sys implementaion. This implementation handles all the IOCTLs
> that pass through it. So, is it not possible to tap the read write
> requests there and do the encryption and decryption there also?
>
> Below disk.sys all I get is IRP_MJ_INTERNAL_DEVICE_CONTROL (which is
> #defined as IRP_MJ_SCSI). I don’t think there is any sample code to show
> me the implementaiton of that IRP. Also, in that level I need to
> distinguish between, control codes for the firmware which need not be
> touched and the codes for the disk sectors, which needs my attention.
>
> Please help.
>
> Madhu
>
>
>
>
>>From: “Don Burn”
>>Reply-To: “Windows System Software Devs Interest List”
>>
>>To: “Windows System Software Devs Interest List”
>>Subject: Re:[ntdev] disk drivers
>>Date: Mon, 8 Aug 2005 07:53:41 -0400
>>
>>If you filter above DISK.SYS you have to realize that DISK.SYS will
>>perform
>>reads and writes for several things that will not come in a IRP_MJ_READ or
>>IRP_MJ_WRITE. These things include reads and writes of partition data for
>>its own use, and many IOCTL’s.
>>
>>So trying to encrypt sectors above DISK.SYS will cause you all kinds of
>>problems, since the driver itself and the various IOCTL’s use data you
>>have
>>not encrypted. Of course if you add a filter to encrypt below DISK.SYS
>>you
>>have the problem, that much of startup will not pass through your filter,
>>also the crash dump and hybernation I/O will not pass through your filter.
>>
>>For these reasons, it is best to encrypt at the file level with a file
>>system filter, or in the disk hardware.
>>
>>
>>
>>–
>>Don Burn (MVP, Windows DDK)
>>Windows 2k/XP/2k3 Filesystem and Driver Consulting
>>Remove StopSpam from the email to reply
>>
>>
>>
>>“madhu Singh” wrote in message
>>news:xxxxx@ntdev…
>> > Dear all,
>> >
>> > I am a newcomer to the windows driver world. I am trying to write a
>> > disk
>> > level encryptor.
>> >
>> > There was some discussion regarding the same a few days back, as far as
>>I
>> > remember, that developer was trying to attach his driver above disk.sys
>> > and
>> > was filtering READ nd WRITE IRPs. All of you told him to attach the
>>driver
>> > as a lower filter instead of an upper filter, as IOCTL calls would be
>> > difficult to handle.
>> >
>> > Can some one please explain the same to me in detail. What I do not
>> > understand is, since my driver is filtering all calls to the disk in
>>READ
>> > and WRITE do i need to put in taps in otehr functions also? Why
>> > should
>> > I?
>> > As a disk level driver should essentially only understand READS and
>>WRITES
>> > and not very high level information.
>> >
>> > Madhu.
>> >
>> >
>> > Beautiful Vienna. http://www.coxandkings.com Only with Cox & Kings
>> >
>> >
>>
>>
>>
>>—
>>Questions? First check the Kernel Driver FAQ at
>>http://www.osronline.com/article.cfm?id=256
>>
>>You are currently subscribed to ntdev as: xxxxx@hotmail.com
>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

> Formula One fan? http://server1.msn.co.in/sp05/tataracing/ Get news,
> wallpapers and photos of Narain Karthikeyan.
>
>

Have you ever used compusec? it loads above disk.sys and has all these
features.

I used device tree to see it’s architecture.

From: “madhu Singh”
>Reply-To: “Windows System Software Devs Interest List”
>
>To: “Windows System Software Devs Interest List”
>Subject: Re:[ntdev] disk drivers
>Date: Mon, 08 Aug 2005 17:38:07 +0530
>
>don,
>
>thanks for the prompt help. well, as far as i know, DDK sample does have a
>sample disk.sys implementaion. This implementation handles all the IOCTLs
>that pass through it. So, is it not possible to tap the read write requests
>there and do the encryption and decryption there also?
>
>Below disk.sys all I get is IRP_MJ_INTERNAL_DEVICE_CONTROL (which is
>#defined as IRP_MJ_SCSI). I don’t think there is any sample code to show me
>the implementaiton of that IRP. Also, in that level I need to distinguish
>between, control codes for the firmware which need not be touched and the
>codes for the disk sectors, which needs my attention.
>
>Please help.
>
>Madhu
>
>
>
>
>>From: “Don Burn”
>>Reply-To: “Windows System Software Devs Interest List”
>>
>>To: “Windows System Software Devs Interest List”
>>Subject: Re:[ntdev] disk drivers
>>Date: Mon, 8 Aug 2005 07:53:41 -0400
>>
>>If you filter above DISK.SYS you have to realize that DISK.SYS will
>>perform
>>reads and writes for several things that will not come in a IRP_MJ_READ or
>>IRP_MJ_WRITE. These things include reads and writes of partition data for
>>its own use, and many IOCTL’s.
>>
>>So trying to encrypt sectors above DISK.SYS will cause you all kinds of
>>problems, since the driver itself and the various IOCTL’s use data you
>>have
>>not encrypted. Of course if you add a filter to encrypt below DISK.SYS
>>you
>>have the problem, that much of startup will not pass through your filter,
>>also the crash dump and hybernation I/O will not pass through your filter.
>>
>>For these reasons, it is best to encrypt at the file level with a file
>>system filter, or in the disk hardware.
>>
>>
>>
>>–
>>Don Burn (MVP, Windows DDK)
>>Windows 2k/XP/2k3 Filesystem and Driver Consulting
>>Remove StopSpam from the email to reply
>>
>>
>>
>>“madhu Singh” wrote in message
>>news:xxxxx@ntdev…
>> > Dear all,
>> >
>> > I am a newcomer to the windows driver world. I am trying to write a
>>disk
>> > level encryptor.
>> >
>> > There was some discussion regarding the same a few days back, as far as
>>I
>> > remember, that developer was trying to attach his driver above disk.sys
>> > and
>> > was filtering READ nd WRITE IRPs. All of you told him to attach the
>>driver
>> > as a lower filter instead of an upper filter, as IOCTL calls would be
>> > difficult to handle.
>> >
>> > Can some one please explain the same to me in detail. What I do not
>> > understand is, since my driver is filtering all calls to the disk in
>>READ
>> > and WRITE do i need to put in taps in otehr functions also? Why
>>should
>> > I?
>> > As a disk level driver should essentially only understand READS and
>>WRITES
>> > and not very high level information.
>> >
>> > Madhu.
>> >
>> >
>> > Beautiful Vienna. http://www.coxandkings.com Only with Cox & Kings
>> >
>> >
>>
>>
>>
>>—
>>Questions? First check the Kernel Driver FAQ at
>>http://www.osronline.com/article.cfm?id=256
>>
>>You are currently subscribed to ntdev as: xxxxx@hotmail.com
>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

>Formula One fan? http://server1.msn.co.in/sp05/tataracing/ Get news,
>wallpapers and photos of Narain Karthikeyan.
>
>
>—
>Questions? First check the Kernel Driver FAQ at
>http://www.osronline.com/article.cfm?id=256
>
>You are currently subscribed to ntdev as: xxxxx@hotmail.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com

_________________________________________________________________
Try the new MSN Desktop Search Toolbar.
http://server1.msn.co.in/sp05/msntoolbar/index.asp Just answer 3 simple
questions.

> Well, the concept of a data partition is an interesting one, how do you

force things to be a data only partition? If it is on a hard disk and of
reasonable size, there is always the possibility that someone comes along
and tries to install an OS.

true, very true, what i meant was some partion that *as of now*
doesn’t have system files.

Yes you can do this stuff, for things like USB
memory sticks, but even there you need to do it below disk.sys, since
otherwise disk.sys will read encrypted data and crash.

It still doesn’t work, I tried it, IOCTLs are a big problem.

  • Developer

madhu,

may be I am wrong (DOn please correct me if I am)…

if (readIrp != NULL) {
status = IoCallDriver(topOfStack, readIrp);

but IoCallDriver is called with topOfStack, I don’t know what that
variable is, but I *DO* think that it points to the TOP OF THE STACK.

-Developer

are u absolutely sure compusec attaches itself above disk.sys? How
exactly did you find that out.

On 8/8/05, madhu Singh wrote:
> Have you ever used compusec? it loads above disk.sys and has all these
> features.
>
> I used device tree to see it’s architecture.
>
>
>
>
>
>
> >From: “madhu Singh”
> >Reply-To: “Windows System Software Devs Interest List”
> >
> >To: “Windows System Software Devs Interest List”
> >Subject: Re:[ntdev] disk drivers
> >Date: Mon, 08 Aug 2005 17:38:07 +0530
> >
> >don,
> >
> >thanks for the prompt help. well, as far as i know, DDK sample does have a
> >sample disk.sys implementaion. This implementation handles all the IOCTLs
> >that pass through it. So, is it not possible to tap the read write requests
> >there and do the encryption and decryption there also?
> >
> >Below disk.sys all I get is IRP_MJ_INTERNAL_DEVICE_CONTROL (which is
> >#defined as IRP_MJ_SCSI). I don’t think there is any sample code to show me
> >the implementaiton of that IRP. Also, in that level I need to distinguish
> >between, control codes for the firmware which need not be touched and the
> >codes for the disk sectors, which needs my attention.
> >
> >Please help.
> >
> >Madhu
> >
> >
> >
> >
> >>From: “Don Burn”
> >>Reply-To: “Windows System Software Devs Interest List”
> >>
> >>To: “Windows System Software Devs Interest List”
> >>Subject: Re:[ntdev] disk drivers
> >>Date: Mon, 8 Aug 2005 07:53:41 -0400
> >>
> >>If you filter above DISK.SYS you have to realize that DISK.SYS will
> >>perform
> >>reads and writes for several things that will not come in a IRP_MJ_READ or
> >>IRP_MJ_WRITE. These things include reads and writes of partition data for
> >>its own use, and many IOCTL’s.
> >>
> >>So trying to encrypt sectors above DISK.SYS will cause you all kinds of
> >>problems, since the driver itself and the various IOCTL’s use data you
> >>have
> >>not encrypted. Of course if you add a filter to encrypt below DISK.SYS
> >>you
> >>have the problem, that much of startup will not pass through your filter,
> >>also the crash dump and hybernation I/O will not pass through your filter.
> >>
> >>For these reasons, it is best to encrypt at the file level with a file
> >>system filter, or in the disk hardware.
> >>
> >>
> >>
> >>–
> >>Don Burn (MVP, Windows DDK)
> >>Windows 2k/XP/2k3 Filesystem and Driver Consulting
> >>Remove StopSpam from the email to reply
> >>
> >>
> >>
> >>“madhu Singh” wrote in message
> >>news:xxxxx@ntdev…
> >> > Dear all,
> >> >
> >> > I am a newcomer to the windows driver world. I am trying to write a
> >>disk
> >> > level encryptor.
> >> >
> >> > There was some discussion regarding the same a few days back, as far as
> >>I
> >> > remember, that developer was trying to attach his driver above disk.sys
> >> > and
> >> > was filtering READ nd WRITE IRPs. All of you told him to attach the
> >>driver
> >> > as a lower filter instead of an upper filter, as IOCTL calls would be
> >> > difficult to handle.
> >> >
> >> > Can some one please explain the same to me in detail. What I do not
> >> > understand is, since my driver is filtering all calls to the disk in
> >>READ
> >> > and WRITE do i need to put in taps in otehr functions also? Why
> >>should
> >> > I?
> >> > As a disk level driver should essentially only understand READS and
> >>WRITES
> >> > and not very high level information.
> >> >
> >> > Madhu.
> >> >
> >> >
> >> > Beautiful Vienna. http://www.coxandkings.com Only with Cox & Kings
> >> >
> >> >
> >>
> >>
> >>
> >>—
> >>Questions? First check the Kernel Driver FAQ at
> >>http://www.osronline.com/article.cfm?id=256
> >>
> >>You are currently subscribed to ntdev as: xxxxx@hotmail.com
> >>To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >

> >Formula One fan? http://server1.msn.co.in/sp05/tataracing/ Get news,
> >wallpapers and photos of Narain Karthikeyan.
> >
> >
> >—
> >Questions? First check the Kernel Driver FAQ at
> >http://www.osronline.com/article.cfm?id=256
> >
> >You are currently subscribed to ntdev as: xxxxx@hotmail.com
> >To unsubscribe send a blank email to xxxxx@lists.osr.com
>
> _________________________________________________________________
> Try the new MSN Desktop Search Toolbar.
> http://server1.msn.co.in/sp05/msntoolbar/index.asp Just answer 3 simple
> questions.
>
>
> —
> Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>



- Developer

ofcourse, haven’t u ever used devfilter.exe developer? it clearly shows that
compusec attaches it self above disk.sys, if they can do it, i think it is
possible.

also, I have a copy od safeboot that also does the same thing.

From: “Don Burn”
>Reply-To: “Windows System Software Devs Interest List”
>
>To: “Windows System Software Devs Interest List”
>Subject: Re:[ntdev] Re:disk drivers
>Date: Mon, 8 Aug 2005 08:27:52 -0400
>
>This is what debuggers are for, build disk.sys and start understanding what
>is happening. If this is more than you want, fellow MVP Mark Roddy has a
>lower filter for disk.sys on his site http://www.hollistech.com/ I am sure
>for the correct sum of $$$ Mark would sell you a copy of the source. Also,
>there are a number of consultants, including myself that will do the work
>for you.
>
>I am not trying to be flippant, but at some point you are basically going
>from asking a specific question, to please give me a design for free.
>Bottom line is that is what I and a number of the active members of this
>group do for a living, and we do not do that for free.
>
>
>–
>Don Burn (MVP, Windows DDK)
>Windows 2k/XP/2k3 Filesystem and Driver Consulting
>Remove StopSpam from the email to reply
>
>
>
>“madhu Singh” wrote in message
>news:xxxxx@ntdev…
> > don,
> >
> > thanks for the prompt help. well, as far as i know, DDK sample does have
>a
> > sample disk.sys implementaion. This implementation handles all the
>IOCTLs
> > that pass through it. So, is it not possible to tap the read write
> > requests there and do the encryption and decryption there also?
> >
> > Below disk.sys all I get is IRP_MJ_INTERNAL_DEVICE_CONTROL (which is
> > #defined as IRP_MJ_SCSI). I don’t think there is any sample code to show
> > me the implementaiton of that IRP. Also, in that level I need to
> > distinguish between, control codes for the firmware which need not be
> > touched and the codes for the disk sectors, which needs my attention.
> >
> > Please help.
> >
> > Madhu
> >
> >
> >
> >
> >>From: “Don Burn”
> >>Reply-To: “Windows System Software Devs Interest List”
> >>
> >>To: “Windows System Software Devs Interest List”
> >>Subject: Re:[ntdev] disk drivers
> >>Date: Mon, 8 Aug 2005 07:53:41 -0400
> >>
> >>If you filter above DISK.SYS you have to realize that DISK.SYS will
> >>perform
> >>reads and writes for several things that will not come in a IRP_MJ_READ
>or
> >>IRP_MJ_WRITE. These things include reads and writes of partition data
>for
> >>its own use, and many IOCTL’s.
> >>
> >>So trying to encrypt sectors above DISK.SYS will cause you all kinds of
> >>problems, since the driver itself and the various IOCTL’s use data you
> >>have
> >>not encrypted. Of course if you add a filter to encrypt below DISK.SYS
> >>you
> >>have the problem, that much of startup will not pass through your
>filter,
> >>also the crash dump and hybernation I/O will not pass through your
>filter.
> >>
> >>For these reasons, it is best to encrypt at the file level with a file
> >>system filter, or in the disk hardware.
> >>
> >>
> >>
> >>–
> >>Don Burn (MVP, Windows DDK)
> >>Windows 2k/XP/2k3 Filesystem and Driver Consulting
> >>Remove StopSpam from the email to reply
> >>
> >>
> >>
> >>“madhu Singh” wrote in message
> >>news:xxxxx@ntdev…
> >> > Dear all,
> >> >
> >> > I am a newcomer to the windows driver world. I am trying to write a
> >> > disk
> >> > level encryptor.
> >> >
> >> > There was some discussion regarding the same a few days back, as far
>as
> >>I
> >> > remember, that developer was trying to attach his driver above
>disk.sys
> >> > and
> >> > was filtering READ nd WRITE IRPs. All of you told him to attach the
> >>driver
> >> > as a lower filter instead of an upper filter, as IOCTL calls would be
> >> > difficult to handle.
> >> >
> >> > Can some one please explain the same to me in detail. What I do not
> >> > understand is, since my driver is filtering all calls to the disk in
> >>READ
> >> > and WRITE do i need to put in taps in otehr functions also? Why
> >> > should
> >> > I?
> >> > As a disk level driver should essentially only understand READS and
> >>WRITES
> >> > and not very high level information.
> >> >
> >> > Madhu.
> >> >
> >> >
> >> > Beautiful Vienna. http://www.coxandkings.com Only with Cox & Kings
> >> >
> >> >
> >>
> >>
> >>
> >>—
> >>Questions? First check the Kernel Driver FAQ at
> >>http://www.osronline.com/article.cfm?id=256
> >>
> >>You are currently subscribed to ntdev as: xxxxx@hotmail.com
> >>To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >

> > Formula One fan? http://server1.msn.co.in/sp05/tataracing/ Get news,
> > wallpapers and photos of Narain Karthikeyan.
> >
> >
>
>
>
>—
>Questions? First check the Kernel Driver FAQ at
>http://www.osronline.com/article.cfm?id=256
>
>You are currently subscribed to ntdev as: xxxxx@hotmail.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com

_________________________________________________________________
Try the new MSN Desktop Search Toolbar.
http://server1.msn.co.in/sp05/msntoolbar/index.asp Just answer 3 simple
questions.

Don,

sorry, but that was not my point. I didn’t want a design from you. Just as I
am new to drivers I needed some help.

Thanks for your help. and you too developer,

Madhu

From: “Don Burn”
>Reply-To: “Windows System Software Devs Interest List”
>
>To: “Windows System Software Devs Interest List”
>Subject: Re:[ntdev] Re:disk drivers
>Date: Mon, 8 Aug 2005 08:27:52 -0400
>
>This is what debuggers are for, build disk.sys and start understanding what
>is happening. If this is more than you want, fellow MVP Mark Roddy has a
>lower filter for disk.sys on his site http://www.hollistech.com/ I am sure
>for the correct sum of $$$ Mark would sell you a copy of the source. Also,
>there are a number of consultants, including myself that will do the work
>for you.
>
>I am not trying to be flippant, but at some point you are basically going
>from asking a specific question, to please give me a design for free.
>Bottom line is that is what I and a number of the active members of this
>group do for a living, and we do not do that for free.
>
>
>–
>Don Burn (MVP, Windows DDK)
>Windows 2k/XP/2k3 Filesystem and Driver Consulting
>Remove StopSpam from the email to reply
>
>
>
>“madhu Singh” wrote in message
>news:xxxxx@ntdev…
> > don,
> >
> > thanks for the prompt help. well, as far as i know, DDK sample does have
>a
> > sample disk.sys implementaion. This implementation handles all the
>IOCTLs
> > that pass through it. So, is it not possible to tap the read write
> > requests there and do the encryption and decryption there also?
> >
> > Below disk.sys all I get is IRP_MJ_INTERNAL_DEVICE_CONTROL (which is
> > #defined as IRP_MJ_SCSI). I don’t think there is any sample code to show
> > me the implementaiton of that IRP. Also, in that level I need to
> > distinguish between, control codes for the firmware which need not be
> > touched and the codes for the disk sectors, which needs my attention.
> >
> > Please help.
> >
> > Madhu
> >
> >
> >
> >
> >>From: “Don Burn”
> >>Reply-To: “Windows System Software Devs Interest List”
> >>
> >>To: “Windows System Software Devs Interest List”
> >>Subject: Re:[ntdev] disk drivers
> >>Date: Mon, 8 Aug 2005 07:53:41 -0400
> >>
> >>If you filter above DISK.SYS you have to realize that DISK.SYS will
> >>perform
> >>reads and writes for several things that will not come in a IRP_MJ_READ
>or
> >>IRP_MJ_WRITE. These things include reads and writes of partition data
>for
> >>its own use, and many IOCTL’s.
> >>
> >>So trying to encrypt sectors above DISK.SYS will cause you all kinds of
> >>problems, since the driver itself and the various IOCTL’s use data you
> >>have
> >>not encrypted. Of course if you add a filter to encrypt below DISK.SYS
> >>you
> >>have the problem, that much of startup will not pass through your
>filter,
> >>also the crash dump and hybernation I/O will not pass through your
>filter.
> >>
> >>For these reasons, it is best to encrypt at the file level with a file
> >>system filter, or in the disk hardware.
> >>
> >>
> >>
> >>–
> >>Don Burn (MVP, Windows DDK)
> >>Windows 2k/XP/2k3 Filesystem and Driver Consulting
> >>Remove StopSpam from the email to reply
> >>
> >>
> >>
> >>“madhu Singh” wrote in message
> >>news:xxxxx@ntdev…
> >> > Dear all,
> >> >
> >> > I am a newcomer to the windows driver world. I am trying to write a
> >> > disk
> >> > level encryptor.
> >> >
> >> > There was some discussion regarding the same a few days back, as far
>as
> >>I
> >> > remember, that developer was trying to attach his driver above
>disk.sys
> >> > and
> >> > was filtering READ nd WRITE IRPs. All of you told him to attach the
> >>driver
> >> > as a lower filter instead of an upper filter, as IOCTL calls would be
> >> > difficult to handle.
> >> >
> >> > Can some one please explain the same to me in detail. What I do not
> >> > understand is, since my driver is filtering all calls to the disk in
> >>READ
> >> > and WRITE do i need to put in taps in otehr functions also? Why
> >> > should
> >> > I?
> >> > As a disk level driver should essentially only understand READS and
> >>WRITES
> >> > and not very high level information.
> >> >
> >> > Madhu.
> >> >
> >> >
> >> > Beautiful Vienna. http://www.coxandkings.com Only with Cox & Kings
> >> >
> >> >
> >>
> >>
> >>
> >>—
> >>Questions? First check the Kernel Driver FAQ at
> >>http://www.osronline.com/article.cfm?id=256
> >>
> >>You are currently subscribed to ntdev as: xxxxx@hotmail.com
> >>To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >

> > Formula One fan? http://server1.msn.co.in/sp05/tataracing/ Get news,
> > wallpapers and photos of Narain Karthikeyan.
> >
> >
>
>
>
>—
>Questions? First check the Kernel Driver FAQ at
>http://www.osronline.com/article.cfm?id=256
>
>You are currently subscribed to ntdev as: xxxxx@hotmail.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com

_________________________________________________________________
NRIs, does your family in India need money urgently?
http://creative.mediaturf.net/creatives/icicibank/ICICI_NRI_ERA.htm Open an
ICICI Bank NRI savings A/c

A misspelled AFAIK, As Far As I Know.

Using such purely English mnemonics, or lazy shorthand, can lead to
obfuscation and misunderstanding, At best it will take more time and
bandwidth to request clarification, at worse it can cause errors in what is
being communicated. They may be really neat and kewl for teenagers abusing
their mommy-and-daddy provided cell phone, but in this forum, with loads of
non-English speaking folks, I think they should de avoided. Now that, my
personal opinion, and 2.50 MIGHT buy you a cup of Starbucks bad coffee.
!Personal opinion>


The personal opinion of
Gary G. Little

“madhu Singh” wrote in message news:xxxxx@ntdev…
> >AFAAK hibernation and c dump has it’s own stack and doesn’t go through
>
> what is AFAAK ?
>
> _________________________________________________________________
> Try the new MSN Desktop Search Toolbar.
> http://server1.msn.co.in/sp05/msntoolbar/index.asp Just answer 3 simple
> questions.
>
>

TopOfStack must be the pointer to the DEVICE_OBJECT of the lower driver that
is about to be called. It may in deed be the “top of something that is
called a stack” … storage stack, widget stack, etc. stack.


The personal opinion of
Gary G. Little

“Developer” wrote in message news:xxxxx@ntdev…
madhu,

may be I am wrong (DOn please correct me if I am)…

> if (readIrp != NULL) {
> status = IoCallDriver(topOfStack, readIrp);

but IoCallDriver is called with topOfStack, I don’t know what that
variable is, but I DO think that it points to the TOP OF THE STACK.

-Developer

Well, heeding my own advice, perhaps that should be “etcetera stack”.


The personal opinion of
Gary G. Little

“Gary G. Little” wrote in message news:xxxxx@ntdev…
> TopOfStack must be the pointer to the DEVICE_OBJECT of the lower driver
> that is about to be called. It may in deed be the “top of something that
> is called a stack” … storage stack, widget stack, etc. stack.
>
> –
> The personal opinion of
> Gary G. Little
>
> “Developer” wrote in message news:xxxxx@ntdev…
> madhu,
>
> may be I am wrong (DOn please correct me if I am)…
>
>> if (readIrp != NULL) {
>> status = IoCallDriver(topOfStack, readIrp);
>
>
> but IoCallDriver is called with topOfStack, I don’t know what that
> variable is, but I DO think that it points to the TOP OF THE STACK.
>
> -Developer
>
>
>