Filter driver to change disk id

Hey,

I’ve got an interesting situation where I have a windows xp embedded device
running on a cf card using ewf to prevent changes being written to flash
which uses two caddy drive based disks to store video data. Now these disks
should be able to be swapped with other disks in the set without modifying
the xp embedded image. However what I’m finding is happening is that because
the swapped disks have partitions with different IDs, then the mount manager
takes a certain amount of time at boot to reassign the volume GUIDs (and
therefore drive letters) to all the partitions (the disks have 10 partitions
each) during which time the disks are not accesible. However due to ewf, no
changes are commited to flash, so once this occurs it will happen at every
boot until an new ewf image is created with the swapped disks, this is not
acceptable.

Now I’ve discovered that the partition id is a 12 byte number, the first 4
bytes being the MBR signature and the second and third bytes being the
offset and length of the partition. As each disk is identical in size, then
if all disks had a constant MBR signature they would have a constant GUID in
all machines solving the problem. However as the device supports two disks
then if they both had the same signature then there would be several sets of
two partitions with the same GUID which I belive would totally screw up the
mount manager. So I would like to write a filter driver that overides the
mbr signature of the top drive to be one constant 4 byte number and the
bottom driver to be a different constant 4 byte number irrespective of the
actual mbr signature of the drives. I am, however, new to driver
development. Can anyone give me a basic run down of how to do this? The
partition id is returned by the diskqueryid function in pnp.c of the disk
class storage driver.

Thanks,
Jared Holzman
MRX Technologies

Step #1 - determine if your version of xp supports the filter manager.
Normal XP SP2 does this. Check by looking for the fltmgr driver (or is
it a service?). If that’s there, you’re gonna get off easy. (Easy-er,
anyway :slight_smile:

Step # - Purchase the IFS DDK (Installable File System Devicedriver
Development Kit) from Microsoft for $100.

Step #3 - Create a mini-filter to do what you need done. I’ve never
messed with volume IDs so I’ll let someone else help out there.

Regards,
Mickey.

Jared Holzman wrote:

Hey,

I’ve got an interesting situation where I have a windows xp embedded device
running on a cf card using ewf to prevent changes being written to flash
which uses two caddy drive based disks to store video data. Now these disks
should be able to be swapped with other disks in the set without modifying
the xp embedded image. However what I’m finding is happening is that because
the swapped disks have partitions with different IDs, then the mount manager
takes a certain amount of time at boot to reassign the volume GUIDs (and
therefore drive letters) to all the partitions (the disks have 10 partitions
each) during which time the disks are not accesible. However due to ewf, no
changes are commited to flash, so once this occurs it will happen at every
boot until an new ewf image is created with the swapped disks, this is not
acceptable.

Now I’ve discovered that the partition id is a 12 byte number, the first 4
bytes being the MBR signature and the second and third bytes being the
offset and length of the partition. As each disk is identical in size, then
if all disks had a constant MBR signature they would have a constant GUID in
all machines solving the problem. However as the device supports two disks
then if they both had the same signature then there would be several sets of
two partitions with the same GUID which I belive would totally screw up the
mount manager. So I would like to write a filter driver that overides the
mbr signature of the top drive to be one constant 4 byte number and the
bottom driver to be a different constant 4 byte number irrespective of the
actual mbr signature of the drives. I am, however, new to driver
development. Can anyone give me a basic run down of how to do this? The
partition id is returned by the diskqueryid function in pnp.c of the disk
class storage driver.

Thanks,
Jared Holzman
MRX Technologies


Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@earthlink.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

Hmmm so in other words your advice is the following:

  1. Find out if you can do it
  2. Buy what you need to do it
  3. Do It

I was hoping for a few more details than that. I have the DDK already, what’s this
IFS DDK business? AFAIK This has less to do with the file system and more to do with
the disk driver, I think the volume GUIDs are assigned irrespective of file system so
I’m not sure if I actually need this IFS DDK, but I do need advice from someone who
is either willing to look at the disk driver or has already looked at it and would
know which functions to override in the filter driver and which ones to pass down the
stack in order to acheive what I want to do.

Mickey Lane wrote:

Step #1 - determine if your version of xp supports the filter manager.
Normal XP SP2 does this. Check by looking for the fltmgr driver (or is
it a service?). If that’s there, you’re gonna get off easy. (Easy-er,
anyway :slight_smile:

Step # - Purchase the IFS DDK (Installable File System Devicedriver
Development Kit) from Microsoft for $100.

Step #3 - Create a mini-filter to do what you need done. I’ve never
messed with volume IDs so I’ll let someone else help out there.

Regards,
Mickey.

Jared Holzman wrote:

>Hey,
>
>I’ve got an interesting situation where I have a windows xp embedded device
>running on a cf card using ewf to prevent changes being written to flash
>which uses two caddy drive based disks to store video data. Now these disks
>should be able to be swapped with other disks in the set without modifying
>the xp embedded image. However what I’m finding is happening is that because
>the swapped disks have partitions with different IDs, then the mount manager
>takes a certain amount of time at boot to reassign the volume GUIDs (and
>therefore drive letters) to all the partitions (the disks have 10 partitions
>each) during which time the disks are not accesible. However due to ewf, no
>changes are commited to flash, so once this occurs it will happen at every
>boot until an new ewf image is created with the swapped disks, this is not
>acceptable.
>
>Now I’ve discovered that the partition id is a 12 byte number, the first 4
>bytes being the MBR signature and the second and third bytes being the
>offset and length of the partition. As each disk is identical in size, then
>if all disks had a constant MBR signature they would have a constant GUID in
>all machines solving the problem. However as the device supports two disks
>then if they both had the same signature then there would be several sets of
>two partitions with the same GUID which I belive would totally screw up the
>mount manager. So I would like to write a filter driver that overides the
>mbr signature of the top drive to be one constant 4 byte number and the
>bottom driver to be a different constant 4 byte number irrespective of the
>actual mbr signature of the drives. I am, however, new to driver
>development. Can anyone give me a basic run down of how to do this? The
>partition id is returned by the diskqueryid function in pnp.c of the disk
>class storage driver.
>
>
>Thanks,
>Jared Holzman
>MRX Technologies
>
>
>—
>Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: xxxxx@earthlink.net
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>

You probably don’t need the IFS Kit except that having the source to
fastfat.sys might help understand how one of the file systems handles the
partition IDs. Disk Manager is where the drives are controlled by the
admin. The drives then have volumes that the file systems mount. The
storage stack exposes both drives and volumes via various interactions with
the partition manager and the mount manager. Properly responding to those
is the job of the disk class driver, disk.sys & classpnp.sys. The disk
class driver has to ask those drivers to work with them and they have to
respond properly.

The storage drivers have to provide the sectors on the drive when requested
by those drivers above them. If you want to ‘muck’ with the IDs that
Windows puts on them, you need to understand what, where, and when it is
retrieved and how to fake it out. You have started, but good luck. You
could write a lower filter to disk.sys unless any of your devices use their
own disk class driver.

“Jared” wrote in message news:xxxxx@ntfsd…
> Hmmm so in other words your advice is the following:
>
> 1) Find out if you can do it
> 2) Buy what you need to do it
> 3) Do It
>
> I was hoping for a few more details than that. I have the DDK already,
> what’s this
> IFS DDK business? AFAIK This has less to do with the file system and more
> to do with
> the disk driver, I think the volume GUIDs are assigned irrespective of
> file system so
> I’m not sure if I actually need this IFS DDK, but I do need advice from
> someone who
> is either willing to look at the disk driver or has already looked at it
> and would
> know which functions to override in the filter driver and which ones to
> pass down the
> stack in order to acheive what I want to do.
>
>
> Mickey Lane wrote:
>
>> Step #1 - determine if your version of xp supports the filter manager.
>> Normal XP SP2 does this. Check by looking for the fltmgr driver (or is
>> it a service?). If that’s there, you’re gonna get off easy. (Easy-er,
>> anyway :slight_smile:
>>
>> Step # - Purchase the IFS DDK (Installable File System Devicedriver
>> Development Kit) from Microsoft for $100.
>>
>> Step #3 - Create a mini-filter to do what you need done. I’ve never
>> messed with volume IDs so I’ll let someone else help out there.
>>
>> Regards,
>> Mickey.
>>
>> Jared Holzman wrote:
>>
>> >Hey,
>> >
>> >I’ve got an interesting situation where I have a windows xp embedded
>> >device
>> >running on a cf card using ewf to prevent changes being written to flash
>> >which uses two caddy drive based disks to store video data. Now these
>> >disks
>> >should be able to be swapped with other disks in the set without
>> >modifying
>> >the xp embedded image. However what I’m finding is happening is that
>> >because
>> >the swapped disks have partitions with different IDs, then the mount
>> >manager
>> >takes a certain amount of time at boot to reassign the volume GUIDs (and
>> >therefore drive letters) to all the partitions (the disks have 10
>> >partitions
>> >each) during which time the disks are not accesible. However due to ewf,
>> >no
>> >changes are commited to flash, so once this occurs it will happen at
>> >every
>> >boot until an new ewf image is created with the swapped disks, this is
>> >not
>> >acceptable.
>> >
>> >Now I’ve discovered that the partition id is a 12 byte number, the first
>> >4
>> >bytes being the MBR signature and the second and third bytes being the
>> >offset and length of the partition. As each disk is identical in size,
>> >then
>> >if all disks had a constant MBR signature they would have a constant
>> >GUID in
>> >all machines solving the problem. However as the device supports two
>> >disks
>> >then if they both had the same signature then there would be several
>> >sets of
>> >two partitions with the same GUID which I belive would totally screw up
>> >the
>> >mount manager. So I would like to write a filter driver that overides
>> >the
>> >mbr signature of the top drive to be one constant 4 byte number and the
>> >bottom driver to be a different constant 4 byte number irrespective of
>> >the
>> >actual mbr signature of the drives. I am, however, new to driver
>> >development. Can anyone give me a basic run down of how to do this? The
>> >partition id is returned by the diskqueryid function in pnp.c of the
>> >disk
>> >class storage driver.
>> >
>> >
>> >Thanks,
>> >Jared Holzman
>> >MRX Technologies
>> >
>> >
>> >—
>> >Questions? First check the IFS FAQ at
>> >https://www.osronline.com/article.cfm?id=17
>> >
>> >You are currently subscribed to ntfsd as: xxxxx@earthlink.net
>> >To unsubscribe send a blank email to xxxxx@lists.osr.com
>> >
>> >
>> >
>
>

Make your caddy drive a removable-media device (the flag in SCSI INQUIRY
data). This is the correct solution, it will defeat the whole partitioning
stuff and make it like, say, a MO drive.

You cannot filter the MBR reads from the disk driver, this is a known bug
in XP (at least pre-SP2) and older OSes. IoReadPartitionTable bypasses the
filters.

You can filter below Disk though - the SCSI CDBs or READ with zero offset.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Jared Holzman”
To: “Windows File Systems Devs Interest List”
Cc:
Sent: Friday, August 19, 2005 12:57 PM
Subject: [ntfsd] Filter driver to change disk id

> Hey,
>
> I’ve got an interesting situation where I have a windows xp embedded device
> running on a cf card using ewf to prevent changes being written to flash
> which uses two caddy drive based disks to store video data. Now these disks
> should be able to be swapped with other disks in the set without modifying
> the xp embedded image. However what I’m finding is happening is that because
> the swapped disks have partitions with different IDs, then the mount manager
> takes a certain amount of time at boot to reassign the volume GUIDs (and
> therefore drive letters) to all the partitions (the disks have 10 partitions
> each) during which time the disks are not accesible. However due to ewf, no
> changes are commited to flash, so once this occurs it will happen at every
> boot until an new ewf image is created with the swapped disks, this is not
> acceptable.
>
> Now I’ve discovered that the partition id is a 12 byte number, the first 4
> bytes being the MBR signature and the second and third bytes being the
> offset and length of the partition. As each disk is identical in size, then
> if all disks had a constant MBR signature they would have a constant GUID in
> all machines solving the problem. However as the device supports two disks
> then if they both had the same signature then there would be several sets of
> two partitions with the same GUID which I belive would totally screw up the
> mount manager. So I would like to write a filter driver that overides the
> mbr signature of the top drive to be one constant 4 byte number and the
> bottom driver to be a different constant 4 byte number irrespective of the
> actual mbr signature of the drives. I am, however, new to driver
> development. Can anyone give me a basic run down of how to do this? The
> partition id is returned by the diskqueryid function in pnp.c of the disk
> class storage driver.
>
>
> Thanks,
> Jared Holzman
> MRX Technologies
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com