Enumerating Volume on Windows 2000

NTFSD
1

I am writing a filter driver that can be used without rebooting. My
problem is that I dont know how to enumarate
all the volume device on Win 2000. The IFS contain sample on how to do
it on XP and up but nothing on
Win 2000. I though about trying all the \Device\HarddiskVolume[number]
but I was wondering if there was a
cleaner way to do it.

Regards,

Benjamin Lauzi?re

2

> I though about trying all the \Device\HarddiskVolume[number]

but I was wondering if there was a cleaner way to do it.

This is not a good idea. You cannot be sure that the volume
will always have the same naming. E.g. Windows NT surely name
the volumes another way.

I’m thinking about the same problem, and I found one possible
solution - to get the device object of the file system driver and
pass through the device list. It seems to me that file
system drivers create one device object for itself and one
device object for each volume mounted.

Another possible solution is to open the symbolic link
(e.g. “??\C:”, but this wull fail if the drive is not there
(e.g. CD-ROMs)

L.

3

Ladislav Zezula wrote:

This is not a good idea. You cannot be sure that the volume
will always have the same naming. E.g. Windows NT surely name
the volumes another way.

I’m thinking about the same problem, and I found one possible
solution - to get the device object of the file system driver and
pass through the device list. It seems to me that file
system drivers create one device object for itself and one
device object for each volume mounted.

Could you give me more information on this method ? (ex API to use…)

Another possible solution is to open the symbolic link
(e.g. “??\C:”, but this wull fail if the drive is not there
(e.g. CD-ROMs)

Yeah, I though about this one too but I rejected it because can volume
could be mounted
in a directory of another volume.

Thanks for your help,

Benjamin Lauzi?re

4

> Could you give me more information on this method ? (ex API to use…)

NTSTATUS AttachToFileSystemByName(PUNICODE_STRING FileSystemName)
{
PDEVICE_OBJECT FsDeviceObject = NULL;
PDRIVER_OBJECT FsDriverObject = NULL;
NTSTATUS Status = STATUS_SUCCESS;

// Reference object by name
if(NT_SUCCESS(Status))
{
Status = ObReferenceObjectByName(FileSystemName,
OBJ_CASE_INSENSITIVE,
NULL,
0,
*IoDriverObjectType,
KernelMode,
NULL,
&FsDriverObject);
}

// If success, attach to all devices owned by the file system driver
if(NT_SUCCESS(Status))
{
for(FsDeviceObject = FsDriverObject->DeviceObject;
FsDeviceObject != NULL;
FsDeviceObject = FsDeviceObject->NextDevice)
{
if(FsDeviceObject->DeviceType == FILE_DEVICE_CD_ROM_FILE_SYSTEM
||
FsDeviceObject->DeviceType == FILE_DEVICE_DISK_FILE_SYSTEM
||
FsDeviceObject->DeviceType == FILE_DEVICE_FILE_SYSTEM ||
FsDeviceObject->DeviceType ==
FILE_DEVICE_NETWORK_FILE_SYSTEM)
{
Status = AttachToFileSystem(FsDeviceObject);
}
}
}

// Dereference the object pointer
if(FsDeviceObject != NULL)
ObDereferenceObject(FsDeviceObject);
return Status;
}

UNICODE_STRING FsName;
RtlInitUnicodeString(&FsName, L"\FileSystem\FastFat");
AttachToFileSystemByName(&FsName);

I don’t say that this method is perfect.
If you have any critics, write them.

L.

5

Ladislav Zezula wrote:

NTSTATUS AttachToFileSystemByName(PUNICODE_STRING FileSystemName)
{
PDEVICE_OBJECT FsDeviceObject = NULL;
PDRIVER_OBJECT FsDriverObject = NULL;
NTSTATUS Status = STATUS_SUCCESS;

// Reference object by name
if(NT_SUCCESS(Status))
{
Status = ObReferenceObjectByName(FileSystemName,
OBJ_CASE_INSENSITIVE,
NULL,
0,
*IoDriverObjectType,
KernelMode,
NULL,
&FsDriverObject);
}

// If success, attach to all devices owned by the file system driver
if(NT_SUCCESS(Status))
{
for(FsDeviceObject = FsDriverObject->DeviceObject;
FsDeviceObject != NULL;
FsDeviceObject = FsDeviceObject->NextDevice)
{
if(FsDeviceObject->DeviceType == FILE_DEVICE_CD_ROM_FILE_SYSTEM
||
FsDeviceObject->DeviceType == FILE_DEVICE_DISK_FILE_SYSTEM
||
FsDeviceObject->DeviceType == FILE_DEVICE_FILE_SYSTEM ||
FsDeviceObject->DeviceType ==
FILE_DEVICE_NETWORK_FILE_SYSTEM)
{
Status = AttachToFileSystem(FsDeviceObject);
}
}
}

// Dereference the object pointer
if(FsDeviceObject != NULL)
ObDereferenceObject(FsDeviceObject);
return Status;
}

UNICODE_STRING FsName;
RtlInitUnicodeString(&FsName, L"\FileSystem\FastFat");
AttachToFileSystemByName(&FsName);

I don’t say that this method is perfect.
If you have any critics, write them.

L.

Thanks, I did not know about ObReferenceObjectByName().

Benjamin Lauzi?re