Identifying the driver stack for a specific device

I have to write a upper filter driver for an audio driver, and I’d like to get a driver stack representation of the default playback device. For example, in my system, through Device Manager, I can see that the following drivers are currently being used by my sound card:

dmk.sys
HDAudio.sys
ksthunk.sys
portcls.sys
SysFxUI.dll
WMALFXGFXDSP.dll

My question is, how do I programmatically find out which ones are the lower and upper level drivers, the PDO, FDO, FiDO etc.?

I have no idea whether this is done in user or kernel mode. I’ve done an extensive search but nothing useful came up.

Thanks in advance.

Why do you think you need this? Or to put it another way, what problem are
you trying to solve? Filter drivers for the most part don’t care what
stack they are in.

Don Burn
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Monday, April 28, 2014 12:44 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Identifying the driver stack for a specific device

I have to write a upper filter driver for an audio driver, and I’d like to
get a driver stack representation of the default playback device. For
example, in my system, through Device Manager, I can see that the following
drivers are currently being used by my sound card:

dmk.sys
HDAudio.sys
ksthunk.sys
portcls.sys
SysFxUI.dll
WMALFXGFXDSP.dll

My question is, how do I programmatically find out which ones are the lower
and upper level drivers, the PDO, FDO, FiDO etc.?

I have no idea whether this is done in user or kernel mode. I’ve done an
extensive search but nothing useful came up.

Thanks in advance.


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

I need to know which device I have to attach to with IoAttachDeviceToDeviceStack(). In my system, for example, I don’t know which one of the above drivers I posted I’d have to feed to IoAttachDeviceToDeviceStack().

I don’t know if I am doing this right, but my initial idea is to somehow get the default endpoint device for audio playback, get the device stack associated with this endpoint and then attach my upper filter to this top driver.

In Vista+ for DRMed audio you cannot write audio filter drivers.

You need to write APO or sAPO, this is the user-mode add-on to the audiodg.exe audio server process.

wrote in message news:xxxxx@ntdev…
>I have to write a upper filter driver for an audio driver, and I’d like to get a driver stack representation of the default playback device. For example, in my system, through Device Manager, I can see that the following drivers are currently being used by my sound card:
>
> dmk.sys
> HDAudio.sys
> ksthunk.sys
> portcls.sys
> SysFxUI.dll
> WMALFXGFXDSP.dll
>
> My question is, how do I programmatically find out which ones are the lower and upper level drivers, the PDO, FDO, FiDO etc.?
>
> I have no idea whether this is done in user or kernel mode. I’ve done an extensive search but nothing useful came up.
>
> Thanks in advance.
>
>
>

xxxxx@gmail.com wrote:

I need to know which device I have to attach to with IoAttachDeviceToDeviceStack(). In my system, for example, I don’t know which one of the above drivers I posted I’d have to feed to IoAttachDeviceToDeviceStack().

I don’t know if I am doing this right, but my initial idea is to somehow get the default endpoint device for audio playback, get the device stack associated with this endpoint and then attach my upper filter to this top driver.

No, you’re not doing this right. You can’t attach a driver in the
middle of an existing stack. You can only attach to whatever the top is
when your filter driver loads. You don’t get to choose. You can check
out the actual filter relationships in the registry, in the UpperFilters
and LowerFilters key in the CurrentControlSet/Enum registry entry for
your device.

HDAudio.sys along with Portcls.sys (they are a port/miniport pair) is
the primary driver for your device. ksthunk.sys is an upper filter to
that. Drmk.sys is the digital rights management library; it is a DLL
used by Portcls.sys. SysFxUI.dll and WmaLfxGfxDsp.dll are both
user-mode DLLs handling the system effects APOs.

What is it that you want to do to the audio data?


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

Tim:
I need a way to id the default endpoint audio playback’s FiDO, something like “\Device\00000055” (or some other along this device stack), then I can feed it to IoGetDeviceObjectPointer() which gives back a pointer to the top object in the device object’s stack. With this pointer, then I can attach my filter.

In this registry location, there is only “FUNC_01&VEN_10EC&DEV_0900&SUBSYS_18491151&REV_1000” under HDAUDIO, but there are no keys such as LowerFilters and UpperFilters. There is a Properties entry but the access is denied even as admin.

I want to intercept the audio data and route ti to somewhere else… (I know, it’s very difficult).

Maxim:
The audio is not DRMed.

xxxxx@gmail.com wrote:

I need a way to id the default endpoint audio playback’s FiDO, something like “\Device\00000055” (or some other along this device stack), then I can feed it to IoGetDeviceObjectPointer() which gives back a pointer to the top object in the device object’s stack. With this pointer, then I can attach my filter.

In this registry location, there is only “FUNC_01&VEN_10EC&DEV_0900&SUBSYS_18491151&REV_1000” under HDAUDIO, but there are no keys such as LowerFilters and UpperFilters. There is a Properties entry but the access is denied even as admin.

I want to intercept the audio data and route ti to somewhere else… (I know, it’s very difficult).

It’s more than difficult. It’s impossible. With an HDAudio device, the
streaming audio data does not flow into kernel mode at all. The Audio
Engine in user mode copies the data directly into the hardware circular
buffers. There are no kernel transitions, and no IRPs.

You need to learn about the Audio Engine. Things are done very
differently now. An Audio Engine client can capture the audio stream
from a rendering endpoint, using “loopback mode”. That may do what you
want:
http://msdn.microsoft.com/en-us/library/windows/desktop/dd316551.aspx

If not, you might be able to implement what you ask by writing a GFX
APO. That is a DLL that runs in the Audio Engine process that gets
called as one of the last filters in the audio graph. This can be
difficult to install, because a GFX APO is considered to be part of the
hardware. You can’t install a generic GFX APO.


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

I’m afraid “loopback recording” might pose a very high latency for what I want, I need close to zero latency, that’s why I was trying to intercept kernel streams.

I’ll learn more about GFX APO you mentioned.

Thanks a lot, Tim.

xxxxx@gmail.com wrote:

I’m afraid “loopback recording” might pose a very high latency for what I want, I need close to zero latency, that’s why I was trying to intercept kernel streams.

You’re just guessing. The loopback stream is handled by the audio
engine, in the same process that is writing data to the circular buffers.

You need to read about the new audio architecture. Really.


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

Hi Tim,

Are there any external reference for the audio architecture? or is it only
msdn?

Regards,
Carlos

2014-04-28 16:25 GMT-05:00 Tim Roberts :

> xxxxx@gmail.com wrote:
> > I’m afraid “loopback recording” might pose a very high latency for what
> I want, I need close to zero latency, that’s why I was trying to intercept
> kernel streams.
>
> You’re just guessing. The loopback stream is handled by the audio
> engine, in the same process that is writing data to the circular buffers.
>
> You need to read about the new audio architecture. Really.
>
> –
> Tim Roberts, xxxxx@probo.com
> Providenza & Boekelheide, Inc.
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

Carlos Guillermo Valdez Castilla wrote:

Are there any external reference for the audio architecture? or is it
only msdn?

As far as I know, only MSDN, but the documentation is pretty good. This
might be a good start:
http://msdn.microsoft.com/en-us/library/windows/hardware/ff536376.aspx


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.