IOCTL_IDE_PASS_THROUGH

NTDEV
1

Hi,

From other OSR posts and informatin I see that IOCTL_IDE_PASS_THROUGH is undocumented. I am trying to see if there is a way to find out the command buffer structure. Is that documented anywhere?

Thanks,
Sonia.

2

Use IOCTL_ATA_PASS_THROUGH and its DIRECT sibling.

Phil

Not speaking for LogRhythm
Phil Barila | Senior Software Engineer
720.881.5364 (w)
LogRhythm, Inc.
A LEADER in the 2013 SIEM Magic Quadrant
Perfect 5-Star Rating in SC Magazine for 5 Consecutive Years

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@symantec.com
Sent: Wednesday, November 13, 2013 1:20 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] IOCTL_IDE_PASS_THROUGH

Hi,

From other OSR posts and informatin I see that IOCTL_IDE_PASS_THROUGH is undocumented. I am trying to see if there is a way to find out the command buffer structure. Is that documented anywhere?

Thanks,
Sonia.

NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

Hi,

Thanks for your reply. I will look at the same. Are there any use cases when IDE_PASS_THROUGH would work and ATA_PASS_THROUGH would not work?

Thanks,
Sonia.

4

I don’t know of any.

What is your fascination with an undocumented, unreliable, and unsupported relic of Windows 2000?

Google still knows what you are looking for, but what in the world could have convinced you that you need it?

Phil

Not speaking for LogRhythm
Phil Barila | Senior Software Engineer
720.881.5364 (w)
LogRhythm, Inc.
A LEADER in the 2013 SIEM Magic Quadrant
Perfect 5-Star Rating in SC Magazine for 5 Consecutive Years

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@symantec.com
Sent: Wednesday, November 13, 2013 1:27 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] IOCTL_IDE_PASS_THROUGH

Hi,

Thanks for your reply. I will look at the same. Are there any use cases when IDE_PASS_THROUGH would work and ATA_PASS_THROUGH would not work?

Thanks,
Sonia.

NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

5

Hi,

Thanks so much for your input. There is a legacy binary that has this IOCTL that I need to emulate.
I was trying to figure out if the ATA substitution would cause anything to break. I see the buffer in windbg. I just am not sure how to map it to a struct in my code.

Thanks,
Sonia.

6

Hi,

The following code

HANDLE handle;
UCHAR buffer[sizeof(ATA_PASS_THROUGH)-1 + 512];
memset(&buffer,0,sizeof(ATA_PASS_THROUGH)-1 + 512);
ATA_PASS_THROUGH *buf = reinterpret_cast<ata_pass_through>(&buffer);
DWORD num_out;
const unsigned char magic = 0xcf;
buf->IdeReg.bFeaturesReg = 0;
buf->IdeReg.bSectorCountReg= 0x01;
buf->IdeReg.bSectorNumberReg= 0x01;
buf->IdeReg.bDriveHeadReg = 0xE0;
buf->IdeReg.bCommandReg = 0x20;
buf->DataBufferSize = 512;
//buf->DataBuffer[0] = magic;

int ioControlCode = IOCTL_IDE_PASS_THROUGH;
handle= CreateFile(L"\\.\PhysicalDrive0",GENERIC_READ|GENERIC_WRITE,FILE_SHARE_READ | FILE_SHARE_WRITE,NULL,OPEN_EXISTING,0,NULL);

printf(“\n Error = %d”, GetLastError());

DWORD bytescopied = 0;

if(handle)

{

if( DeviceIoControl(

handle,

ioControlCode,

buffer,

sizeof(ATA_PASS_THROUGH)-1 + 512 ,

buffer,

sizeof(ATA_PASS_THROUGH)-1 + 512 ,

&bytescopied,

NULL //not an overlapped operation

) )
{

printf(“\n status is %d”,buf->IdeReg.bCommandReg);

printf(“\n Error = %d”, GetLastError());
PrintDataBuffer(buf->DataBuffer, 512);
}

}
CloseHandle(handle); does not return an error but always fails. Is there any obvious reason?

Thanks,
Sonia.</ata_pass_through>