IoGetDeviceAttachmentBaseRef vs FileObject->DeviceObject

NTFSD
1

Hi all,

Is there any way of getting different device objects from these two methods?
In summary, is there any chance of this ASSERT fail?

pDevObj = IoGetDeviceAttachmentBaseRef(pFileObj);
ASSERT(pDevObj == pFileObj->DeviceObject);

I'm also confusing about the IoGetDeviceAttachmentBaseRef help that says:

"If the given device object is not attached to a driver stack, IoGetDeviceAttachmentBaseRef returns NULL."

Assuming a device stack comprised by only one device object, the one that completes the IRP_MJ_CREATE, how could this routine return NULL?

Regards,

Fernando Roberto da Silva
DriverEntry Kernel Development
http://www.driverentry.com.br/en

2

Hi Fernando,

IoGetDeviceAttachmentBaseRef doesn’t take a PFILE_OBJECT parameter, but a
PDEVICE_OBJECT.

I think the documentation is wrong. AFAIK this function will always return a
DEVICE_OBJECT, either the one that passed in as a parameter or the lowest
one in the stack, if the device that was passed in is attached to a stack.

Thanks,
Alex.

3

Perhaps it returns NULL for software only drivers.

IIRC, IoGetDeviceAttachmentBaseRef surf DeviceExtension to reach the DO of the bottommost driver. Which means someone should put it there as first place. May be the code which copies it to the device extension only execute for device driver and FS stack.