Hi all,
I found that no irp could be intercepted by diskperf when
hibernating, does it perform disk io in real mode(call bios disk
interrupt)? or directly access port(1F0 or 170)?
thanks in advance!
protale
No, hibernation uses DiskDump interface which calls the storage miniport’s
routines directly.
Resume uses the NTLDR’s disk access - int 13h for multi(0)… ARC name,
NTBootDd.sys for scsi(0)… ARC name.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
----- Original Message -----
From: “protale”
To: “Windows System Software Devs Interest List”
Sent: Thursday, September 25, 2003 6:16 AM
Subject: [ntdev] Does it perform disk io in real mode when hibernating?
> Hi all,
>
> I found that no irp could be intercepted by diskperf when
> hibernating, does it perform disk io in real mode(call bios disk
> interrupt)? or directly access port(1F0 or 170)?
>
> thanks in advance!
> protale
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
> No, hibernation uses DiskDump interface which calls the storage miniport’s
routines directly.
Resume uses the NTLDR’s disk access - int 13h for multi(0)… ARC name,
NTBootDd.sys for scsi(0)… ARC name.
Oh, you are great! Does it mean that eventually hibernation uses int 13h to
access disk?(hibernation->diskdump->miniport driver->int13)
Just if so, Could the disk i/o be able to be intercepted if I write a tsr
to hook int13? I tried it, and found that the tsr would be removed after
logon, but the information I saved in 0:0-0:400 were kept original. Did you
have any ideas about it?
Best regards,
protale
----- Original Message -----
From: “Maxim S. Shatskih”
To: “Windows System Software Devs Interest List”
Sent: Thursday, September 25, 2003 11:54 PM
Subject: [ntdev] Re: Does it perform disk io in real mode when hibernating?
> No, hibernation uses DiskDump interface which calls the storage miniport’s
> routines directly.
>
> Resume uses the NTLDR’s disk access - int 13h for multi(0)… ARC name,
> NTBootDd.sys for scsi(0)… ARC name.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
> ----- Original Message -----
> From: “protale”
> To: “Windows System Software Devs Interest List”
> Sent: Thursday, September 25, 2003 6:16 AM
> Subject: [ntdev] Does it perform disk io in real mode when hibernating?
>
>
> > Hi all,
> >
> > I found that no irp could be intercepted by diskperf when
> > hibernating, does it perform disk io in real mode(call bios disk
> > interrupt)? or directly access port(1F0 or 170)?
> >
> > thanks in advance!
> > protale
> >
> >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@21cn.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
Why on earth would you want to do this? We’re finally running modern
operating systems, with modern device architectures. Why would anyone
want to inflict real-mode INT hooking, and all that DOS madness, on
themselves or any other living thing?
– arlie
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of protale
Sent: Thursday, September 25, 2003 10:17 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Re: Does it perform disk io in real mode when
hibernating?
No, hibernation uses DiskDump interface which calls the storage
miniport’s routines directly.Resume uses the NTLDR’s disk access - int 13h for multi(0)… ARC
name, NTBootDd.sys for scsi(0)… ARC name.
Oh, you are great! Does it mean that eventually hibernation uses int
13h to access disk?(hibernation->diskdump->miniport driver->int13)
Just if so, Could the disk i/o be able to be intercepted if I write a
tsr
to hook int13? I tried it, and found that the tsr would be removed after
logon, but the information I saved in 0:0-0:400 were kept original. Did
you have any ideas about it?
Best regards,
protale
oh, maybe you are right, but nothing can be forbidden in programming.
The real reson between a man and an animal is just the man would think all
things that he feel curiously.
and didn’t you know anything about the origin of Newton’s “the law of
gravity”?
----- Original Message -----
From: “Arlie Davis”
To: “Windows System Software Devs Interest List”
Sent: Friday, September 26, 2003 10:27 AM
Subject: [ntdev] Re: Does it perform disk io in real mode when hibernating?
> Why on earth would you want to do this? We’re finally running modern
> operating systems, with modern device architectures. Why would anyone
> want to inflict real-mode INT hooking, and all that DOS madness, on
> themselves or any other living thing?
>
> – arlie
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of protale
> Sent: Thursday, September 25, 2003 10:17 PM
> To: Windows System Software Devs Interest List
> Subject: [ntdev] Re: Does it perform disk io in real mode when
> hibernating?
>
>
>
> > No, hibernation uses DiskDump interface which calls the storage
> > miniport’s routines directly.
> >
> > Resume uses the NTLDR’s disk access - int 13h for multi(0)… ARC
> > name, NTBootDd.sys for scsi(0)… ARC name.
>
> Oh, you are great! Does it mean that eventually hibernation uses int
> 13h to access disk?(hibernation->diskdump->miniport driver->int13)
> Just if so, Could the disk i/o be able to be intercepted if I write a
> tsr
> to hook int13? I tried it, and found that the tsr would be removed after
> logon, but the information I saved in 0:0-0:400 were kept original. Did
> you have any ideas about it?
>
> Best regards,
> protale
>
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@21cn.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
Because, even on these “modern” operating systems, it is the only way
to implement full disk (sector level) encryption (at least if you
want to include the boot drive). And it’s not DOS at all, it’s the
BIOS that’s being hooked.
Shaun
Friday, September 26, 2003, 3:27:23 AM, you wrote:
AD> Why on earth would you want to do this? We’re finally running modern
AD> operating systems, with modern device architectures. Why would anyone
AD> want to inflict real-mode INT hooking, and all that DOS madness, on
AD> themselves or any other living thing?
AD> – arlie
AD> -----Original Message-----
AD> From: xxxxx@lists.osr.com
AD> [mailto:xxxxx@lists.osr.com] On Behalf Of protale
AD> Sent: Thursday, September 25, 2003 10:17 PM
AD> To: Windows System Software Devs Interest List
AD> Subject: [ntdev] Re: Does it perform disk io in real mode when
AD> hibernating?
> No, hibernation uses DiskDump interface which calls the storage
> miniport’s routines directly.
>
> Resume uses the NTLDR’s disk access - int 13h for multi(0)… ARC
> name, NTBootDd.sys for scsi(0)… ARC name.
AD> Oh, you are great! Does it mean that eventually hibernation uses int
AD> 13h to access disk?(hibernation->diskdump->miniport driver->int13)
AD> Just if so, Could the disk i/o be able to be intercepted if I write a
AD> tsr
AD> to hook int13? I tried it, and found that the tsr would be removed after
AD> logon, but the information I saved in 0:0-0:400 were kept original. Did
AD> you have any ideas about it?
AD> Best regards,
AD> protale
AD> —
AD> Questions? First check the Kernel Driver FAQ at
AD> http://www.osronline.com/article.cfm?id=256
AD> You are currently subscribed to ntdev as: xxxxx@sdlabs.net
AD> To unsubscribe send a blank email to
AD> xxxxx@lists.osr.com
> Oh, you are great! Does it mean that eventually hibernation uses int 13h to
access disk?(hibernation->diskdump->miniport driver->int13)
“Resuming Windows…” uses int 13h, as NTLDR also does. Hibernation does not.
The miniport accesses the hardware directly.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
No, it isn’t a DOS TSR, usually it consist of three parts: boot loader,
driver and win32 program. To maintain data consistency, we need do the same
thing between “TSR” and driver. But if we can’t intercept the hibernation in
driver, we should also pass down the request on hiberfil.sys in TSR.
----- Original Message -----
From: “Roddy, Mark”
To: “Windows System Software Devs Interest List”
Sent: Friday, September 26, 2003 11:32 PM
Subject: [ntdev] Re: Does it perform disk io in real mode when hiberna ting?
> Well I suppose, but this is not exactlu a DOS TSR, is it? It would have to
> be more like a custom boot loader program.
>
>
> =====================
> Mark Roddy
>
>
> > -----Original Message-----
> > From: Shaun [mailto:xxxxx@sdlabs.net]
> > Sent: Friday, September 26, 2003 3:50 AM
> > To: Windows System Software Devs Interest List
> > Subject: [ntdev] Re: Does it perform disk io in real mode
> > when hibernating?
> >
> >
> > Because, even on these “modern” operating systems, it is the
> > only way to implement full disk (sector level) encryption (at
> > least if you want to include the boot drive). And it’s not
> > DOS at all, it’s the BIOS that’s being hooked.
> >
> > Shaun
> >
> > Friday, September 26, 2003, 3:27:23 AM, you wrote:
> >
> > AD> Why on earth would you want to do this? We’re finally running
> > AD> modern operating systems, with modern device architectures. Why
> > AD> would anyone want to inflict real-mode INT hooking, and
> > all that DOS
> > AD> madness, on themselves or any other living thing?
> >
> > AD> – arlie
> >
> >
> > AD> -----Original Message-----
> > AD> From: xxxxx@lists.osr.com
> > AD> [mailto:xxxxx@lists.osr.com] On Behalf Of protale
> > AD> Sent: Thursday, September 25, 2003 10:17 PM
> > AD> To: Windows System Software Devs Interest List
> > AD> Subject: [ntdev] Re: Does it perform disk io in real mode when
> > AD> hibernating?
> >
> >
> >
> > >> No, hibernation uses DiskDump interface which calls the storage
> > >> miniport’s routines directly.
> > >>
> > >> Resume uses the NTLDR’s disk access - int 13h for multi(0)… ARC
> > >> name, NTBootDd.sys for scsi(0)… ARC name.
> >
> > AD> Oh, you are great! Does it mean that eventually hibernation uses
> > AD> int 13h to access disk?(hibernation->diskdump->miniport
> > driver->int13)
> > AD> Just if so, Could the disk i/o be able to be
> > intercepted if I write a
> > AD> tsr
> > AD> to hook int13? I tried it, and found that the tsr would
> > be removed
> > AD> after logon, but the information I saved in 0:0-0:400 were kept
> > AD> original. Did you have any ideas about it?
> >
> > AD> Best regards,
> > AD> protale
> >
> >
> > AD> —
> > AD> Questions? First check the Kernel Driver FAQ at
> > AD> http://www.osronline.com/article.cfm?id=256
> >
> > AD> You are currently subscribed to ntdev as: xxxxx@sdlabs.net To
> > AD> unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@stratus.com To
> unsubscribe send a blank email to xxxxx@lists.osr.com
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@21cn.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
Thanks for your response. I’m sorry for my poor english reading skill, I
incorrectly think that “resume” means restore disk I/O mode to int13, now, I
understand the real meaning and use a file system filter to solve the
problem.
Best regards,
protale
----- Original Message -----
From: “Maxim S. Shatskih”
To: “Windows System Software Devs Interest List”
Sent: Friday, September 26, 2003 5:31 PM
Subject: [ntdev] Re: Does it perform disk io in real mode when hibernating?
> > Oh, you are great! Does it mean that eventually hibernation uses int
13h to
> > access disk?(hibernation->diskdump->miniport driver->int13)
>
> “Resuming Windows…” uses int 13h, as NTLDR also does. Hibernation does
not.
> The miniport accesses the hardware directly.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@21cn.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>