filtering cd/dvd burn events

NTDEV
1

Hi Folks,

I would like to implement a filter driver that monitors the cd/dvd burn events coming from mostly roxio and nero software and pass them to an application. I do not want to block or make the cd/dvd read only. (Reposting this on NTDEV list as folks at NTFSD adviced me so)

This particular question has come up a lot of time on this mailing list and I have spent 2 complete days going over each one of them. I realize that it is not easy to implement such thing also I realize different softwares perform burn differently that is why I want to limit my implementation to roxio and nero. Let me explain what I have done so far and then I’ll post the question.

I wrote a simple filter driver and installed it as a lower class filter for CDROM class (4D36E965-E325-11CE-BFC1-08002BE10318). I see when I burn something on cd I get a lot of IRP_MJ_INTERNAL_DEVICE_IO_CONTROL. I am looking for IOCTL_SCSI_PASS_THROUGH/DIRECT through IRP_MJ_DEVICE_IO_CONTROL but I never get this. I added the checks for above IRPs/IOCTLs by looking at the several post to similar issues. I really don’t know what I’ll do when I get them.

Questions:

  1. Am i on the right path? I am not sure whether I should be writing a class driver or miniport driver or something else.
    If I am on the right path then:
  2. Which event will inform me about the write events?
  3. What do I do when I get PASS_THROUGH and DIRECT ioctls? e.g. when i get IRP_MJ_WRITE I know what I can do with the parameters.
  4. What are SRBs and CDBs? when will I get them?

I am going through www.t10.org to get some information on SRBs and CDBs.

Any help is much appreciated.

Thanks,
/R

2

What you are seeing are the SCSI commands (SRBs). IRP_MJ_SCSI is a synonym for IRP_MJ_INTERNAL_DEVICE_IO_CONTROL. I know enough about storage to believe that’s what I’d expect for traffic through a lower class filter.

You should be getting write SRBs when you have to write- but there’s also going to be more than that, IIRC- these device classes have some specific SRBs that should also help clue you in.

I’m sure you’ll get better answers to the rest of this soon enough, though…

3

Much of the CD burning software out there doesn’t bother to send SCSI commands through the device stack so your filter isn’t going to see anything for these cases.

4

>to be more than that, IIRC- these device classes have some specific SRBs that

should also help clue you in.

Correct, and all these SCSI commands are described in MMC-5 spec on www.t10.org

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com