I am using filespy and analyzing it code and found that if someone changes
the drive letter for any volume through computer management, the logs
continues to show the old drive name correponding to the irps for that
volume. I know there is mapping stored in device extension object that
maintains the mapping between volume and drive letter. now if we change the
drive letter through computer management, that mapping remains unchanged.
Below are the lines from some previous post
You would call
IoRegisterPlugPlayNotification(EventCategoryTargetDeviceChange); and pass in
the volume object for the third parameter. Then you should get all the
custom event notifications for that volume. Look for
GUID_IO_VOLUME_NAME_CHANGE to detect drive letter changes. When the
((PPLUGPLAY_NOTIFICATION_HEADER)NotificationStructure)->Event GUID is a
custom GUID, the NotificationStructure the callback received is actually a
TARGET_DEVICE_CUSTOM_NOTIFICATION structure, and the FileObject field
contains the file object the caller passed in to the corresponding call to
IoRegisterPlugPlayNotification (the third parameter mentioned).
I want to do exactly same thing . but my problem is that i am not able to
find out the third parameter for IoRegisterPlugPlayNotification that should
be fileobject for volume. I called this routine
IoRegisterPlugPlayNotification when irp IRP_MJ_FILE_SYSTEM_CONTROL with
minor code RP_MN_MOUNT_VOLUME is issued i.e. at the time when the volumes
gets mounted
but i am unable to find the fileobject for that is to be passed as third
parameter for IoRegisterPlugPlayNotification
Regards
Rohit
I have tried IoGetDeviceObjectPointer(&symLink, STANDARD_RIGHTS_ALL,
&FileObject, &TargetDeviceObject); for getting the file object that is
thrird parameter for IoRegisterPlugPlayNotification where symlink is a
unicode string and its buffer contain “\DosDevices\C:”. When i call this
function ,The function never returns.
Might me some deadlock occured inside the functon
Please suggest me the possible solution
Regards
Rohit
On 4/25/06, Rohit wrote:
>
> I am using filespy and analyzing it code and found that if someone changes
> the drive letter for any volume through computer management, the logs
> continues to show the old drive name correponding to the irps for that
> volume. I know there is mapping stored in device extension object that
> maintains the mapping between volume and drive letter. now if we change the
> drive letter through computer management, that mapping remains unchanged.
> Below are the lines from some previous post
>
> You would call
> IoRegisterPlugPlayNotification(EventCategoryTargetDeviceChange); and pass in
> the volume object for the third parameter. Then you should get all the
> custom event notifications for that volume. Look for
> GUID_IO_VOLUME_NAME_CHANGE to detect drive letter changes. When the
> ((PPLUGPLAY_NOTIFICATION_HEADER)NotificationStructure)->Event GUID is a
> custom GUID, the NotificationStructure the callback received is actually a
> TARGET_DEVICE_CUSTOM_NOTIFICATION structure, and the FileObject field
> contains the file object the caller passed in to the corresponding call to
> IoRegisterPlugPlayNotification (the third parameter mentioned).
>
> I want to do exactly same thing . but my problem is that i am not able to
> find out the third parameter for IoRegisterPlugPlayNotification that should
> be fileobject for volume. I called this routine
> IoRegisterPlugPlayNotification when irp IRP_MJ_FILE_SYSTEM_CONTROL with
> minor code RP_MN_MOUNT_VOLUME is issued i.e. at the time when the volumes
> gets mounted
> but i am unable to find the fileobject for that is to be passed as third
> parameter for IoRegisterPlugPlayNotification
>
> Regards
> Rohit
>
I s’pose it may not be entirely obvious that IoGetDeviceObjectPointer does an open of the target device. But it does. With this knowledge…
from the DDK docs:
“A callback routine must not open the device directly. If the provider of the interface causes blocking PnP events, the notification callback routine can cause a deadlock if it tries to open the device in the callback thread.”
Discussed in The NT Insider or OSR Online:
http://www.osronline.com/article.cfm?id=24
HTH,
Peter
OSR
Thanks Peter for the reply
I am using FileSpy as base code for making prototype.
here i am just trying to register the callback for drive letter change
notification through IoRegisterPlugPlayNotification Which i am not able to
do. Your reply is I think more concerned with opening a same device inside
the callback routine.
This isn’t the case. I have set the callback yet.
I want to register the callback inside the IO completion routine for IRP
with MAJOR function IRP_MJ_FILE_SYSTEM_CONTROL and Minor function
IRP_MN_MOUNT_VOLUME. But for getting the FileObject for Third parameter for
IoRegisterPlugPlayNotification, i am calling IoGetDeviceObjectPointer(&SymLink,
STANDARD_RIGHTS_ALL,
&FileObject,
&TargetDeviceObject);
where the buffer for UNICODE_STRING contains \DosDevices\c:
In that case function does not return from “IoGetDeviceObjectPointer”
function. Mgth got struck in some deadlock.
Please guide me to reach to solution
Regards
Rohit
Sorry foir the previous mail
Thanks Peter for the reply
I am using FileSpy as base code for making prototype.
here i am just trying to register the callback for drive letter change
notification through IoRegisterPlugPlayNotification Which i am not able to
do. Your reply is I think more concerned with opening a same device inside
the callback routine.
This isn’t the case. I have n’t set the callback yet.
I want to register the callback inside the IO completion routine for IRP
with MAJOR function IRP_MJ_FILE_SYSTEM_CONTROL and Minor function
IRP_MN_MOUNT_VOLUME. But for getting the FileObject for Third parameter for
IoRegisterPlugPlayNotification, i am calling IoGetDeviceObjectPointer(&SymLink,
STANDARD_RIGHTS_ALL,
&FileObject,
&TargetDeviceObject);
where the buffer for UNICODE_STRING contains \DosDevices\c:
In that case function does not return from “IoGetDeviceObjectPointer”
function. Mgth got struck in some deadlock.
Please guide me to reach to solution
Regards
Rohit
> I s’pose it may not be entirely obvious that IoGetDeviceObjectPointer does an
open of the target device. But it does. With this knowledge…
IoGetDeviceObjectPointer is a sequence of:
NtOpenFile
ObReferenceObjectByHandle
IoGetRelatedDeviceObject
ZwClose
Nothing else.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com