Hi all,
I ve developed a filter driver for CD writter. I want to intercept the write
operation with this. How can I proceed further?
While writing to the cd/DVD i am not able to get IRP_MJ_WRITE response. But for
all other operations I am able to get the response.
Wen this major function get called?
Where i need to write code for skipping the write request? Which major/minor
function request I should handle for this?
Or any other way to set this drive as read only while adding this filter driver
to the device stack?
Plz help me.
Thanks in advance,
Soumya
> I ve developed a filter driver for CD writter. I want to intercept the
write
operation with this. How can I proceed further?
Depend on utility which is used for disks burning and the place of your
filter in a device stack.
The possible requests are
- IRP_MJ_DEVICE_CONTROL with IOCTL_SCSI_PASS_THROUGH or
IOCTL_SCSI_PASS_THROUGH_DIRECT
- IRP_MJ_SCSI
- Direct SCSI request to a PDO ( you can’t intercept this )
–
Slava Imameyev, xxxxx@hotmail.com
wrote in message news:xxxxx@ntfsd…
> Hi all,
>
> I ve developed a filter driver for CD writter. I want to intercept the
> write
> operation with this. How can I proceed further?
>
> While writing to the cd/DVD i am not able to get IRP_MJ_WRITE response.
> But for
> all other operations I am able to get the response.
>
> Wen this major function get called?
>
> Where i need to write code for skipping the write request? Which
> major/minor
> function request I should handle for this?
> Or any other way to set this drive as read only while adding this filter
> driver
> to the device stack?
>
> Plz help me.
>
> Thanks in advance,
> Soumya
>
>
>
Quoting Slava Imameyev :
> > I ve developed a filter driver for CD writter. I want to intercept the
> > write
> > operation with this. How can I proceed further?
>
> Depend on utility which is used for disks burning and the place of your
> filter in a device stack.
> The possible requests are
> 1) IRP_MJ_DEVICE_CONTROL with IOCTL_SCSI_PASS_THROUGH or
> IOCTL_SCSI_PASS_THROUGH_DIRECT
> 2) IRP_MJ_SCSI
> 3) Direct SCSI request to a PDO ( you can’t intercept this )
You can intercept requests in (3).
3a) Hook the port driver entry structure. Anybody who does this deserves to
burn in the 1394 device driver hells.
3b) Write a bus filter. When anything sends IRP_MJ_PNP
IRP_MN_QUERY_DEVICE_RELATIONS BusRelations adjust the ‘real’ potential PDO’s
with devices we create ourselves. The PNP system never sees the real PDOs the
only drivers that know about them are the port driver and the filter.
Everything else sees our substitute PDOs as the real thing. This is a non
trivial task several orders of magnitude more complicated that a straight
forward device filter.
Except that there are a few of the CD burning tools I have encountered
that call the PDO directly. So short of patching the dispatch handlers
for the bus driver, which I do not condone, you can not catch all write
requests to the underlying device.
As well, for some of the tools, that have a proprietary IOCtl interface
that they call from their user mode application down into their class
filter driver for the scsi_passthrough data. Then the class filter
driver calls the PDO directly with this data. So, if you are a class
filter you miss the IOCtl calls and then since they break the call
chain, you miss the PDO requests.
Pete
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
(303)546-0300
xxxxx@dsl.pipex.com wrote:
Quoting Slava Imameyev :
>
>>> I ve developed a filter driver for CD writter. I want to intercept the
>>> write
>>> operation with this. How can I proceed further?
>> Depend on utility which is used for disks burning and the place of your
>> filter in a device stack.
>> The possible requests are
>> 1) IRP_MJ_DEVICE_CONTROL with IOCTL_SCSI_PASS_THROUGH or
>> IOCTL_SCSI_PASS_THROUGH_DIRECT
>> 2) IRP_MJ_SCSI
>> 3) Direct SCSI request to a PDO ( you can’t intercept this )
>
> You can intercept requests in (3).
>
> 3a) Hook the port driver entry structure. Anybody who does this deserves to
> burn in the 1394 device driver hells.
> 3b) Write a bus filter. When anything sends IRP_MJ_PNP
> IRP_MN_QUERY_DEVICE_RELATIONS BusRelations adjust the ‘real’ potential PDO’s
> with devices we create ourselves. The PNP system never sees the real PDOs the
> only drivers that know about them are the port driver and the filter.
> Everything else sees our substitute PDOs as the real thing. This is a non
> trivial task several orders of magnitude more complicated that a straight
> forward device filter.
>
>
>
> —
> Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
> 3) Direct SCSI request to a PDO ( you can’t intercept this )
… but we can hook them all, can’t we?
[Hooking is bad, but…]
A pro po, if anyone knows, does alcohol’s sptd.sys check the validity of its dispatch routines’
addresses? In other words, is it hook-protected?
I don’t know the answer but my guess would be that it does so that it would not tolerate (simple-minded, func_ptr replacement-based) hooking.
-------------- Original message --------------
From: “Slava Imameyev”
> > I ve developed a filter driver for CD writter. I want to intercept the
> > write
> > operation with this. How can I proceed further?
>
> Depend on utility which is used for disks burning and the place of your
> filter in a device stack.
> The possible requests are
> 1) IRP_MJ_DEVICE_CONTROL with IOCTL_SCSI_PASS_THROUGH or
> IOCTL_SCSI_PASS_THROUGH_DIRECT
> 2) IRP_MJ_SCSI
> 3) Direct SCSI request to a PDO ( you can’t intercept this )
>
> –
> Slava Imameyev, xxxxx@hotmail.com
>
>
> wrote in message news:xxxxx@ntfsd…
> > Hi all,
> >
> > I ve developed a filter driver for CD writter. I want to intercept the
> > write
> > operation with this. How can I proceed further?
> >
> > While writing to the cd/DVD i am not able to get IRP_MJ_WRITE response.
> > But for
> > all other operations I am able to get the response.
> >
> > Wen this major function get called?
> >
> > Where i need to write code for skipping the write request? Which
> > major/minor
> > function request I should handle for this?
> > Or any other way to set this drive as read only while adding this filter
> > driver
> > to the device stack?
> >
> > Plz help me.
> >
> > Thanks in advance,
> > Soumya
> >
> >
> >
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@comcast.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com