Hey , whats the actual difference between the two when it comes to
- Handling : IOCTLs are handled by the DeviceObject.DriverObject.Majorfunction[IRP_MJ_DEVICE_CONTROL] you are sending it to, what FSCTLs are handled by ?
- IOCTLs are sent to a specific device, can one send FSCTL to a sepcific device or do they always travel the file system device stack?
- to send a message from UM to a filter communication port you can use FilterSendMessage - under the hood it sends NtfsControlFile with specific control code and the following
- handle to the port (which is actually a handle to a file object with DeviceObject fltmsg of the filter manager , as well as FsContext2.CCB that points to the actual port object
- input / out buffers
Now usually with how IOCTLs work the handle is used to locate the driver object dispatch routine to be called, and the handle is not needed in the actual dispatch rotuine . in this case tho since the filter manager need to know which port to direct the message to i assume the handle needs to be passed to the dispatch routine of the FSCTL? what is the prototype of a FSCTL handler?
without the handle to the file object thereโs no wat the filter manager can tell which port the message should be sent to right?