How to call functions in the sys file?

Dear Sirs,
How does one driver call functions in another sys file? Can anyone help me?(It is said that there are several methods to do this task, can you list them?)
Thank you for your reading and answering.

Why not search for articles on osronline.com concerning the subject? In
reality all drivers are kernel mode DLLs with regards to the OS. Why do you
think you have to fill in the driver extension with the addresses of the
routines you want to handle unload, cleanup, etc.? If you mean that you
want to call some function you see in the publics of a driver such as
NTFS.sys when you don’t have the ability to create the driver from source
code, then you are out of luck and any hack will be interesting to
accomplish and probably beyond your current skill level.

wrote in message news:xxxxx@ntdev…
> Dear Sirs,
> How does one driver call functions in another sys file? Can anyone
> help me?(It is said that there are several methods to do this task, can
> you list them?)
> Thank you for your reading and answering.
>

The following are the common methods:

  1. Use the IoCallDriver interface and call the other drivers dispatch
    routines - This is limited to a well known set of interfaces, but works in
    all cases.

  2. Use a DeviceInterface (see IoRegisterDeviceInterface and and
    IoRegisterPlugPlayNotification) to get a device interface which is a data
    structure of function pointers. The requires the driver providing the
    functions must be PnP, has the advantage it works well with PnP which the
    following options do not always do.

  3. Use an IOCTL to create to request a data structure of function pointers.
    Has the advantage it works for non-PNP drivers.

  4. Create a kernel mode DLL.


Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

wrote in message news:xxxxx@ntdev…
> Dear Sirs,
> How does one driver call functions in another sys file? Can anyone
> help me?(It is said that there are several methods to do this task, can
> you list them?)
> Thank you for your reading and answering.
>

Dear Don Burn,
Thank you very much. I have found your 4th answer for a while. Can you give me more detailed information? (I want to know how to do in this way. for example: step1,step2,…)
Thank you again.

An old by excellent and still accurate article by one of our esteemed
list members:

http://www.wd-3.com/archive/KernelDlls.htm

Of course, there’s always MSDN:

http://msdn2.microsoft.com/en-us/library/aa489613.aspx

You can export a function or data from an driver using
__declspecl(dllexport) (in build DECLSPEC_EXPORT).

A very important thing to keep in my mind is that, while export drivers
can be unloaded under Windows 2000 and after, that only happens when all
drivers that import from are unloaded first. In practice this can be
difficult, and this often means that during development, everytime you
rebuild you have to reboot.

There are ways to mitigate some of these issues. What do you want to
accomplish? My personal opinion is that at least for the purposes of
development, a private interface is much more flexibile. If it’s all
you stuff and you work out the communication between your modules, you
might not have to unload everything this way, provided you are very
careful, and of course during development only.

Good luck,

mm

xxxxx@gmail.com wrote:

Dear Don Burn,
Thank you very much. I have found your 4th answer for a while. Can you give me more detailed information? (I want to know how to do in this way. for example: step1,step2,…)
Thank you again.

Don Burn wrote:


2. Use a DeviceInterface (see IoRegisterDeviceInterface and and
IoRegisterPlugPlayNotification) to get a device interface which is a data
structure of function pointers.

For posterity’s sake, it is IRP_MN_QUERY_INTERFACE that provides this
functionality. IoRegisterDeviceInterface might provide a way to FIND
the driver, but it isn’t involved in the function pointers. Those two
uses of the word “interface” are entirely different.


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

xxxxx@gmail.com wrote:

Thank you very much. I have found your 4th answer for a while. Can you give me more detailed information? (I want to know how to do in this way. for example: step1,step2,…)

You need to describe exactly what you want to do. And that doesn’t mean
“how to call functions in a sys file”, it means a higher-level
description of what you want to do. It might be that a kernel DLL is
not the best answer.


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

Using IoCallDriver, or using function pointer table exchange or callback
registration via IOCTL, or using exports/imports.


Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

wrote in message news:xxxxx@ntdev…
> Dear Sirs,
> How does one driver call functions in another sys file? Can anyone help
me?(It is said that there are several methods to do this task, can you list
them?)
> Thank you for your reading and answering.
>

> 2. Use a DeviceInterface (see IoRegisterDeviceInterface and and

IoRegisterPlugPlayNotification) to get a device interface which is a data
structure of function pointers.

No, IoRegisterDeviceInterface has nothing to do with function pointers, it is
another notion of “device interface” (WDM has 2 of them).

IoRegisterDeviceInterface registers an openable device object name as “yet
another device providing this GUID-named functionality”, registers in a way so
that both kernel (IoRegisterPlugPlayNotification) and user
(SetupDiGetClassDevs) mode code can enumerate all such names by GUID.


Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

Max,

Your description is correct but incomplete. The interface can contain
a block of function pointers plus a context that can be used for exactly
what I said. I have been using this model for 6 years after learning it a
WinHEC so I assure you it is valid.


Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

“Maxim S. Shatskih” wrote in message
news:xxxxx@ntdev…
>> 2. Use a DeviceInterface (see IoRegisterDeviceInterface and and
>> IoRegisterPlugPlayNotification) to get a device interface which is a data
>> structure of function pointers.
>
> No, IoRegisterDeviceInterface has nothing to do with function pointers, it
> is
> another notion of “device interface” (WDM has 2 of them).
>
> IoRegisterDeviceInterface registers an openable device object name as “yet
> another device providing this GUID-named functionality”, registers in a
> way so
> that both kernel (IoRegisterPlugPlayNotification) and user
> (SetupDiGetClassDevs) mode code can enumerate all such names by GUID.
>
> –
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>

Sorry Don, but what parameters to IoRegisterDeviceInterface are used for
this?

IoRegisterDeviceInterface has only PDO, GUID and parameters related to
naming.

IoSetDeviceInterfaceState has only name and BOOLEAN on/off parameter.

How can you provide the function pointer table to these calls?


Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

“Don Burn” wrote in message news:xxxxx@ntdev…
> Max,
>
> Your description is correct but incomplete. The interface can contain
> a block of function pointers plus a context that can be used for exactly
> what I said. I have been using this model for 6 years after learning it a
> WinHEC so I assure you it is valid.
>
>
> –
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> Website: http://www.windrvr.com
> Blog: http://msmvps.com/blogs/WinDrvr
> Remove StopSpam to reply
>
>
> “Maxim S. Shatskih” wrote in message
> news:xxxxx@ntdev…
> >> 2. Use a DeviceInterface (see IoRegisterDeviceInterface and and
> >> IoRegisterPlugPlayNotification) to get a device interface which is a data
> >> structure of function pointers.
> >
> > No, IoRegisterDeviceInterface has nothing to do with function pointers, it
> > is
> > another notion of “device interface” (WDM has 2 of them).
> >
> > IoRegisterDeviceInterface registers an openable device object name as “yet
> > another device providing this GUID-named functionality”, registers in a
> > way so
> > that both kernel (IoRegisterPlugPlayNotification) and user
> > (SetupDiGetClassDevs) mode code can enumerate all such names by GUID.
> >
> > –
> > Maxim Shatskih, Windows DDK MVP
> > StorageCraft Corporation
> > xxxxx@storagecraft.com
> > http://www.storagecraft.com
> >
> >
>
>
>

Ok, techincally it is the query interface that does it, when it retuns the
interface it returns the block of pointers, but IpRegisterDeviceInterface is
the starting point and the place in the documentation that has the links to
the rest of the stuff you need.


Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

“Maxim S. Shatskih” wrote in message
news:xxxxx@ntdev…
> Sorry Don, but what parameters to IoRegisterDeviceInterface are used
> for
> this?
>
> IoRegisterDeviceInterface has only PDO, GUID and parameters related to
> naming.
>
> IoSetDeviceInterfaceState has only name and BOOLEAN on/off parameter.
>
> How can you provide the function pointer table to these calls?
>
> –
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
> “Don Burn” wrote in message news:xxxxx@ntdev…
>> Max,
>>
>> Your description is correct but incomplete. The interface can
>> contain
>> a block of function pointers plus a context that can be used for exactly
>> what I said. I have been using this model for 6 years after learning it
>> a
>> WinHEC so I assure you it is valid.
>>
>>
>> –
>> Don Burn (MVP, Windows DDK)
>> Windows 2k/XP/2k3 Filesystem and Driver Consulting
>> Website: http://www.windrvr.com
>> Blog: http://msmvps.com/blogs/WinDrvr
>> Remove StopSpam to reply
>>
>>
>> “Maxim S. Shatskih” wrote in message
>> news:xxxxx@ntdev…
>> >> 2. Use a DeviceInterface (see IoRegisterDeviceInterface and and
>> >> IoRegisterPlugPlayNotification) to get a device interface which is a
>> >> data
>> >> structure of function pointers.
>> >
>> > No, IoRegisterDeviceInterface has nothing to do with function pointers,
>> > it
>> > is
>> > another notion of “device interface” (WDM has 2 of them).
>> >
>> > IoRegisterDeviceInterface registers an openable device object name as
>> > “yet
>> > another device providing this GUID-named functionality”, registers in a
>> > way so
>> > that both kernel (IoRegisterPlugPlayNotification) and user
>> > (SetupDiGetClassDevs) mode code can enumerate all such names by GUID.
>> >
>> > –
>> > Maxim Shatskih, Windows DDK MVP
>> > StorageCraft Corporation
>> > xxxxx@storagecraft.com
>> > http://www.storagecraft.com
>> >
>> >
>>
>>
>>
>
>

Yes but these really are two separate mechanisms, neither requires the
other, and their linkage in the docs plus their unfortunate name
similarities just causes the confusion seen in this thread. The ‘export a
function call interface’ mechanism is exposed through IRP_MN_QUERY_INTERFACE
and one way to get a device object to send this IRP to is through the
unfortunately named IoGetDeviceInterfaces.

On Jan 13, 2008 11:44 AM, Don Burn wrote:

> Ok, techincally it is the query interface that does it, when it retuns the
> interface it returns the block of pointers, but IpRegisterDeviceInterface
> is
> the starting point and the place in the documentation that has the links
> to
> the rest of the stuff you need.
>
>
> –
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> Website: http://www.windrvr.com
> Blog: http://msmvps.com/blogs/WinDrvr
> Remove StopSpam to reply
>
>
> “Maxim S. Shatskih” wrote in message
> news:xxxxx@ntdev…
> > Sorry Don, but what parameters to IoRegisterDeviceInterface are used
> > for
> > this?
> >
> > IoRegisterDeviceInterface has only PDO, GUID and parameters related
> to
> > naming.
> >
> > IoSetDeviceInterfaceState has only name and BOOLEAN on/off parameter.
> >
> > How can you provide the function pointer table to these calls?
> >
> > –
> > Maxim Shatskih, Windows DDK MVP
> > StorageCraft Corporation
> > xxxxx@storagecraft.com
> > http://www.storagecraft.com
> >
> > “Don Burn” wrote in message news:xxxxx@ntdev…
> >> Max,
> >>
> >> Your description is correct but incomplete. The interface can
> >> contain
> >> a block of function pointers plus a context that can be used for
> exactly
> >> what I said. I have been using this model for 6 years after learning
> it
> >> a
> >> WinHEC so I assure you it is valid.
> >>
> >>
> >> –
> >> Don Burn (MVP, Windows DDK)
> >> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> >> Website: http://www.windrvr.com
> >> Blog: http://msmvps.com/blogs/WinDrvr
> >> Remove StopSpam to reply
> >>
> >>
> >> “Maxim S. Shatskih” wrote in message
> >> news:xxxxx@ntdev…
> >> >> 2. Use a DeviceInterface (see IoRegisterDeviceInterface and and
> >> >> IoRegisterPlugPlayNotification) to get a device interface which is a
> >> >> data
> >> >> structure of function pointers.
> >> >
> >> > No, IoRegisterDeviceInterface has nothing to do with function
> pointers,
> >> > it
> >> > is
> >> > another notion of “device interface” (WDM has 2 of them).
> >> >
> >> > IoRegisterDeviceInterface registers an openable device object name as
> >> > “yet
> >> > another device providing this GUID-named functionality”, registers in
> a
> >> > way so
> >> > that both kernel (IoRegisterPlugPlayNotification) and user
> >> > (SetupDiGetClassDevs) mode code can enumerate all such names by GUID.
> >> >
> >> > –
> >> > Maxim Shatskih, Windows DDK MVP
> >> > StorageCraft Corporation
> >> > xxxxx@storagecraft.com
> >> > http://www.storagecraft.com
> >> >
> >> >
> >>
> >>
> >>
> >
> >
>
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>


Mark Roddy

> Yes but these really are two separate mechanisms, neither requires the other,

and their linkage in the docs plus their unfortunate name similarities just
causes the confusion seen in this thread.

IIRC, WDK description of either IoRegisterDeviceInterface() or IRP_MN_QUERY_INTERFACE
(or, maybe, even of both) *explicitly* says that, despite their name similarities, these are two totally unrelated things that should not be confused with one another…

Anton Bassov

Actually the documentation here is a mess. They do explicity say not to
confuse the two then explicitly mention the common approach which is to use
IoRegisterPlugPlayNofitication to get the interface. Of course to send that
interface notification the driver offering the interface must do an
IoRegisterDeviceInterface so yes they are connected, even though the
documentation indicates they are not.


Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

wrote in message news:xxxxx@ntdev…
>> Yes but these really are two separate mechanisms, neither requires the
>> other,
>> and their linkage in the docs plus their unfortunate name similarities
>> just
>> causes the confusion seen in this thread.
>
> IIRC, WDK description of either IoRegisterDeviceInterface() or
> IRP_MN_QUERY_INTERFACE
> (or, maybe, even of both) explicitly says that, despite their name
> similarities, these are two totally unrelated things that should not be
> confused with one another…
>
> Anton Bassov
>

There are two distinct use cases for IRP_MN_QUERY_INTERFACE.

  1. same stack - already has the target device object certainly doesn’t need
    to call IoRegisterAnything. (For example, the bus driver function call
    interface for fetching PCI config space data.)

  2. different stack - needs to get the target device object in order to send
    IRP_MN_QUERY_INTERFACE and the best way to do that is IoRegisterWhatever.

The docs ought to mention both use cases. That would actually clear things
up.

On Jan 13, 2008 1:34 PM, Don Burn wrote:

> Actually the documentation here is a mess. They do explicity say not to
> confuse the two then explicitly mention the common approach which is to
> use
> IoRegisterPlugPlayNofitication to get the interface. Of course to send
> that
> interface notification the driver offering the interface must do an
> IoRegisterDeviceInterface so yes they are connected, even though the
> documentation indicates they are not.
>
>
> –
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> Website: http://www.windrvr.com
> Blog: http://msmvps.com/blogs/WinDrvr
> Remove StopSpam to reply
>
>
>
> wrote in message news:xxxxx@ntdev…
> >> Yes but these really are two separate mechanisms, neither requires the
> >> other,
> >> and their linkage in the docs plus their unfortunate name similarities
> >> just
> >> causes the confusion seen in this thread.
> >
> > IIRC, WDK description of either IoRegisterDeviceInterface() or
> > IRP_MN_QUERY_INTERFACE
> > (or, maybe, even of both) explicitly says that, despite their name
> > similarities, these are two totally unrelated things that should not be
> > confused with one another…
> >
> > Anton Bassov
> >
>
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>


Mark Roddy