IoRegisterPlugPlayNotification Issues

NTFSD
1

Hi,

I am writing file system minifilter in which my requirement is to detect USB pluggedIn for this in DriverEntry used “IoRegisterPlugPlayNotification” function to register callback function of USB detection.

/**************************Driver Entry*************************/

NTSTATUS
DriverEntry (
__in PDRIVER_OBJECT DriverObject,
__in PUNICODE_STRING RegistryPath
)
{

PSECURITY_DESCRIPTOR sd;
OBJECT_ATTRIBUTES oa;
UNICODE_STRING uStrVolume,uStrPort;
PFILTER_VOLUME_BASIC_INFORMATION pFilterInfo = NULL;
PFLT_VOLUME pFLTVolume;
PVOID buffer = NULL;
NTSTATUS nStatus = STATUS_SUCCESS;
NTSTATUS nStatus2 = STATUS_SUCCESS;
LONG NumberofVolumes = 0,NumberofVolumes2 = 0;
int iLoop = 0;
PVOID _NotificationBuffer = NULL;

try
{
//RtlInitUnicodeString(&uStrVolume,L"D:");
WinFLTData.m_NameQueryMethod = DEFAULT_NAME_QUERY_METHOD;
WinFLTData.m_DriverObject = DriverObject;

nStatus = FltRegisterFilter(DriverObject,&FilterRegistration,&WinFLTData.m_Filter);

nStatus = FltBuildDefaultSecurityDescriptor( &sd,
FLT_PORT_ALL_ACCESS );

RtlInitUnicodeString( &uStrPort, WINFLT_PORT_NAME );

InitializeObjectAttributes( &oa,
&uStrPort,
OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE,
NULL,
sd );

nStatus = FltCreateCommunicationPort(WinFLTData.m_Filter,
&WinFLTData.m_ServerPort,
&oa,
NULL,
Flt_Connect,
Flt_Disconnect,
Flt_Message,
1 );
FltFreeSecurityDescriptor( sd );
PsGetVersion(&gMajOSVersion,&gMinOSVersion,NULL,NULL);

nStatus = FltStartFiltering( WinFLTData.m_Filter);

nStatus = FltEnumerateVolumes(WinFLTData.m_Filter,NULL,0,&NumberofVolumes);
buffer = ExAllocatePool(PagedPool,1024);
_NotificationBuffer = ExAllocatePool(PagedPool,1024);

if(buffer != NULL)
{
for(iLoop = 0; iLoop < NumberofVolumes; iLoop++)
{
nStatus = FltEnumerateVolumeInformation(WinFLTData.m_Filter,iLoop,FilterVolumeBasicInformation,buffer, 1024,&NumberofVolumes2);
pFilterInfo = (PFILTER_VOLUME_BASIC_INFORMATION)buffer;
uStrVolume.Length = (USHORT)pFilterInfo->FilterVolumeNameLength;
uStrVolume.MaximumLength = uStrVolume.Length;
uStrVolume.Buffer = &pFilterInfo->FilterVolumeName[0];

if(NT_SUCCESS(nStatus))
{
nStatus = FltGetVolumeFromName(WinFLTData.m_Filter,&uStrVolume,&pFLTVolume);
if(NT_SUCCESS(nStatus))
{
nStatus = FltAttachVolume(WinFLTData.m_Filter,pFLTVolume,NULL,NULL);
DbgPrint(“Attached Volume Successfully… \n”);
FltObjectDereference(pFLTVolume);
}
}
}
ExFreePool(buffer);
}

/************************************ Registration of Callback function ***/
nStatus2 = IoRegisterPlugPlayNotification
( EventCategoryDeviceInterfaceChange, PNPNOTIFY_DEVICE_INTERFACE_INCLUDE_EXISTING_INTERFACES, (PVOID)&GUID_DEVICE_INTERFACE_ARRIVAL, DriverObject, (PDRIVER_NOTIFICATION_CALLBACK_ROUTINE)USB_PnpNotifyInterfaceChange,
(PVOID)“”,
(PVOID)&_NotificationBuffer
);
/************************************ Registration of Callback function ***/
DbgPrint(“Status Value…%d\n”,nStatus2);
ExFreePool(_NotificationBuffer);

}
finally
{

if (!NT_SUCCESS( nStatus ) ) {

if (NULL != WinFLTData.m_ServerPort) {
FltCloseCommunicationPort( WinFLTData.m_ServerPort);
}

if (NULL != WinFLTData.m_Filter) {
FltUnregisterFilter( WinFLTData.m_Filter);
}

}
}
DbgPrint(“Testing Driver started Successfully… \n”);
return nStatus;
}

/************************Callback definition ******************/
NTSTATUS
USB_PnpNotifyInterfaceChange(
__in PDEVICE_INTERFACE_CHANGE_NOTIFICATION NotificationStruct,
__in PVOID Context
)
{
DbgPrint(“USB Plugged In…\n”);
return STATUS_SUCCESS;
}
/************************Callback definition ******************/

Unfortunately USB pluggedIn event is not being detected. Plz let me know if any body trace the problem

Thanks

2

Hi,

When the EventCategory parameters for the call to
IoRegisterPlugPlayNotification is EventCategoryDeviceInterfaceChange,
EventCategoryData must point to a GUID specifying a device interface
class. For example GUID_DEVINTERFACE_VOLUME.

GUID_DEVICE_INTERFACE_ARRIVAL is the event passed to you in the
callbacks PDEVICE_INTERFACE_CHANGE_NOTIFICATION structure, and not a
device interface class.

Ben Lewis

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@yahoo.com
Sent: 11 December 2009 10:07
To: Windows File Systems Devs Interest List
Subject: [ntfsd] IoRegisterPlugPlayNotification Issues

Hi,

I am writing file system minifilter in which my requirement is to detect
USB pluggedIn for this in DriverEntry used
“IoRegisterPlugPlayNotification” function to register callback function
of USB detection.

/**************************Driver Entry*************************/

NTSTATUS
DriverEntry (
__in PDRIVER_OBJECT DriverObject,
__in PUNICODE_STRING RegistryPath
)
{

PSECURITY_DESCRIPTOR sd;
OBJECT_ATTRIBUTES oa;
UNICODE_STRING uStrVolume,uStrPort;
PFILTER_VOLUME_BASIC_INFORMATION pFilterInfo = NULL;
PFLT_VOLUME pFLTVolume;
PVOID buffer = NULL;
NTSTATUS nStatus = STATUS_SUCCESS;
NTSTATUS nStatus2 = STATUS_SUCCESS;
LONG NumberofVolumes = 0,NumberofVolumes2 = 0;
int iLoop = 0;
PVOID _NotificationBuffer = NULL;

try
{
//RtlInitUnicodeString(&uStrVolume,L"D:");
WinFLTData.m_NameQueryMethod =
DEFAULT_NAME_QUERY_METHOD;
WinFLTData.m_DriverObject = DriverObject;

nStatus =
FltRegisterFilter(DriverObject,&FilterRegistration,&WinFLTData.m_Filter)
;

nStatus = FltBuildDefaultSecurityDescriptor(
&sd,
FLT_PORT_ALL_ACCESS
);

RtlInitUnicodeString( &uStrPort,
WINFLT_PORT_NAME );

InitializeObjectAttributes( &oa,
&uStrPort,
OBJ_KERNEL_HANDLE |
OBJ_CASE_INSENSITIVE,
NULL,
sd );

nStatus =
FltCreateCommunicationPort(WinFLTData.m_Filter,

&WinFLTData.m_ServerPort,

&oa,

NULL,

Flt_Connect,

Flt_Disconnect,

Flt_Message,

1 );
FltFreeSecurityDescriptor( sd );

PsGetVersion(&gMajOSVersion,&gMinOSVersion,NULL,NULL);

nStatus = FltStartFiltering(
WinFLTData.m_Filter);

nStatus =
FltEnumerateVolumes(WinFLTData.m_Filter,NULL,0,&NumberofVolumes);
buffer = ExAllocatePool(PagedPool,1024);
_NotificationBuffer =
ExAllocatePool(PagedPool,1024);

if(buffer != NULL)
{
for(iLoop = 0; iLoop < NumberofVolumes;
iLoop++)
{
nStatus =
FltEnumerateVolumeInformation(WinFLTData.m_Filter,iLoop,FilterVolumeBasi
cInformation,buffer, 1024,&NumberofVolumes2);
pFilterInfo =
(PFILTER_VOLUME_BASIC_INFORMATION)buffer;
uStrVolume.Length =
(USHORT)pFilterInfo->FilterVolumeNameLength;
uStrVolume.MaximumLength =
uStrVolume.Length;
uStrVolume.Buffer =
&pFilterInfo->FilterVolumeName[0];

if(NT_SUCCESS(nStatus))
{
nStatus =
FltGetVolumeFromName(WinFLTData.m_Filter,&uStrVolume,&pFLTVolume);
if(NT_SUCCESS(nStatus))
{
nStatus =
FltAttachVolume(WinFLTData.m_Filter,pFLTVolume,NULL,NULL);

DbgPrint(“Attached Volume Successfully… \n”);

FltObjectDereference(pFLTVolume);
}

}
}
ExFreePool(buffer);
}

/************************************ Registration of Callback function
***/
nStatus2 = IoRegisterPlugPlayNotification
( EventCategoryDeviceInterfaceChange,
PNPNOTIFY_DEVICE_INTERFACE_INCLUDE_EXISTING_INTERFACES,
(PVOID)&GUID_DEVICE_INTERFACE_ARRIVAL,
DriverObject,
(PDRIVER_NOTIFICATION_CALLBACK_ROUTINE)USB_PnpNotifyInterfaceChange,
(PVOID)“”,
(PVOID)&_NotificationBuffer
);
/************************************ Registration of Callback function
***/
DbgPrint(“Status Value…%d\n”,nStatus2);
ExFreePool(_NotificationBuffer);

}
finally
{

if (!NT_SUCCESS( nStatus ) ) {

if (NULL != WinFLTData.m_ServerPort) {
FltCloseCommunicationPort(
WinFLTData.m_ServerPort);
}

if (NULL != WinFLTData.m_Filter) {
FltUnregisterFilter(
WinFLTData.m_Filter);
}

}
}
DbgPrint(“Testing Driver started
Successfully… \n”);
return nStatus;
}

/************************Callback definition ******************/
NTSTATUS USB_PnpNotifyInterfaceChange(
__in PDEVICE_INTERFACE_CHANGE_NOTIFICATION NotificationStruct,
__in PVOID Context
)
{
DbgPrint(“USB Plugged In…\n”);
return STATUS_SUCCESS;
}
/************************Callback definition ******************/

Unfortunately USB pluggedIn event is not being detected. Plz let me know
if any body trace the problem

Thanks

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars (including our
new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

Hi Ben,

I created GUID like following. and then passed in this function but the result was same No Event when USB pluggedIn.

DEFINE_GUID(GUID_DEVINTERFACE_USB,
0x7fef14e3, 0xd828, 0x43fd, 0xb5, 0x3c, 0xa2, 0x66, 0x12, 0xc3, 0xe8, 0x57);

/************************************ Registration of Callback function ***/

nStatus2 = IoRegisterPlugPlayNotification ( EventCategoryDeviceInterfaceChange, PNPNOTIFY_DEVICE_INTERFACE_INCLUDE_EXISTING_INTERFACES, (PVOID)&GUID_DEVICE_INTERFACE_ARRIVAL, DriverObject, (PDRIVER_NOTIFICATION_CALLBACK_ROUTINE)USB_PnpNotifyInterfaceChange, (PVOID)“”, (PVOID)&_NotificationBuffer );

/************************************ Registration of Callback function ***

Thanks

4

Where did your define for GUID_DEVINTERFACE_USB come from? That is not
a microsoft defined GUID (at leaast not it any of the platform sdks or
ddks I have installed)

I know this works because I just tried it a minute ago

Define GUID as:-

/* A5DCBF10-6530-11D2-901F-00C04FB951ED */
DEFINE_GUID(GUID_DEVINTERFACE_USB_DEVICE, 0xA5DCBF10L,
0x6530, 0x11D2, 0x90, 0x1F, 0x00, 0xC0, 0x4F, 0xB9, 0x51, 0xED ); (comes
from usbiodef.h)

Registering for the notification looked like this:-

IoRegisterPlugPlayNotification( EventCategoryDeviceInterfaceChange,

PNPNOTIFY_DEVICE_INTERFACE_INCLUDE_EXISTING_INTERFACES,

(PVOID)&GUID_DEVINTERFACE_USB_DEVICE,

pTheDriver->pDriverObject,

(PDRIVER_NOTIFICATION_CALLBACK_ROUTINE)GeneralUsb_PnpNotifyInterfaceChan
ge,

(PVOID)pTheDriver,

&GeneralUsb_NotificationHandle );

The callback I wrote looked like this:-

NTSTATUS CDLPFDE_Driver::GeneralUsb_PnpNotifyInterfaceChange( PVOID
pNotifyContext, PVOID pContext )
{
PDEVICE_INTERFACE_CHANGE_NOTIFICATION pNotifyData =
(PDEVICE_INTERFACE_CHANGE_NOTIFICATION)pNotifyContext;
CDLPFDE_Driver* pDriverCtx =
(CDLPFDE_Driver*)pContext;

PAGED_CODE();

if( IsEqualGUID( pNotifyData->Event,
GUID_DEVICE_INTERFACE_ARRIVAL ) )
{
DLP_DRV_LOG_PRINT( DLP_DRV_TRACE_ALWAYS, (
“GUID_DEVINTERFACE_USB_DEVICE: GUID_DEVICE_INTERFACE_ARRIVAL : %wZ\n”,
pNotifyData->SymbolicLinkName ) );
}

if( IsEqualGUID( pNotifyData->Event,
GUID_DEVICE_INTERFACE_REMOVAL ) )
{
DLP_DRV_LOG_PRINT( DLP_DRV_TRACE_ALWAYS, (
“GUID_DEVINTERFACE_USB_DEVICE: GUID_DEVICE_INTERFACE_REMOVAL : %wZ\n”,
pNotifyData->SymbolicLinkName ) );
}

return STATUS_SUCCESS;
}

If it still isnt working then you are doing something silly as this is a
very simple bit of code!

Ben

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@yahoo.com
Sent: 11 December 2009 12:22
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] IoRegisterPlugPlayNotification Issues

Hi Ben,

I created GUID like following. and then passed in this function but the
result was same No Event when USB pluggedIn.

DEFINE_GUID(GUID_DEVINTERFACE_USB,
0x7fef14e3, 0xd828, 0x43fd, 0xb5, 0x3c, 0xa2, 0x66, 0x12, 0xc3, 0xe8,
0x57);

/************************************ Registration of Callback function
***/

nStatus2 = IoRegisterPlugPlayNotification (
EventCategoryDeviceInterfaceChange,
PNPNOTIFY_DEVICE_INTERFACE_INCLUDE_EXISTING_INTERFACES,
(PVOID)&GUID_DEVICE_INTERFACE_ARRIVAL, DriverObject,
(PDRIVER_NOTIFICATION_CALLBACK_ROUTINE)USB_PnpNotifyInterfaceChange,
(PVOID)“”, (PVOID)&_NotificationBuffer );

/************************************ Registration of Callback function
***

Thanks

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

5

Hi Ben,

Its working fine for only USB devices, but not detecting external drives that is plugged into USB Port.

Thanks

6

You asked for USB devices! Register for GUID_DEVINTERFACE_DISK,
GUID_DEVINTERFACE_VOLUME and/or GUID_DEVINTERFACE_PARTITION to get the
arrival of what I think you are actually interested in.

Ben

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@yahoo.com
Sent: 14 December 2009 07:49
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] IoRegisterPlugPlayNotification Issues

Hi Ben,

Its working fine for only USB devices, but not detecting external drives
that is plugged into USB Port.

Thanks

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars (including our
new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

7

Now, I successfully got the notification of USB and External Drive , but issue is that in Notification Event I want to attach USB/External Drive with my minifilter… but didnt success I used the following code to attach all drives.

NTSTATUS
USB_PnpNotifyInterfaceChange(
__in PVOID pNotifyContext,
__in PVOID pContext
)
{
UNICODE_STRING uStrGuid,uGuid;
UNICODE_STRING uStrConst;
PDEVICE_INTERFACE_CHANGE_NOTIFICATION pNotifyData = (PDEVICE_INTERFACE_CHANGE_NOTIFICATION)pNotifyContext;

UNICODE_STRING uStrVolume;
PFILTER_VOLUME_BASIC_INFORMATION pFilterInfo = NULL;
PFLT_VOLUME pFLTVolume;
PVOID buffer = NULL;
NTSTATUS nStatus = STATUS_SUCCESS;
LONG NumberofVolumes = 0,NumberofVolumes2 = 0;
int iLoop = 0;
int i = 0;

RtlStringFromGUID(&pNotifyData->Event ,&uStrGuid);

DbgPrint(“GUID…%ws\n”,uStrGuid.Buffer);

RtlInitUnicodeString(&uStrConst,L"{cb3a4004-46f0-11d0-b08f-00609713053f}");

if(RtlCompareUnicodeString(&uStrConst,&uStrGuid,TRUE)==0)
{
buffer = ExAllocatePool(PagedPool,1024);

DbgPrint(“Symbolic Name %ws \n”,pNotifyData->SymbolicLinkName->Buffer);

FltEnumerateVolumes(WinFLTData.m_Filter,NULL,0,&NumberofVolumes);

DbgPrint(“Number of Volumes %d \n”,NumberofVolumes);
for(iLoop = 0; iLoop < NumberofVolumes; iLoop++)
{
nStatus = FltEnumerateVolumeInformation(WinFLTData.m_Filter,iLoop,FilterVolumeBasicInformation,buffer, 1024,&NumberofVolumes2);
pFilterInfo = (PFILTER_VOLUME_BASIC_INFORMATION)buffer;
uStrVolume.Length = (USHORT)pFilterInfo->FilterVolumeNameLength;
uStrVolume.MaximumLength = uStrVolume.Length;
uStrVolume.Buffer = &pFilterInfo->FilterVolumeName[0];

if(NT_SUCCESS(nStatus))
{
nStatus = FltGetVolumeFromName(WinFLTData.m_Filter,&uStrVolume,&pFLTVolume);
if(NT_SUCCESS(nStatus))
{

nStatus = FltAttachVolume(WinFLTData.m_Filter,pFLTVolume,NULL,NULL);
if(NT_SUCCESS(nStatus))
{
DbgPrint("%ws ",uStrVolume.Buffer);
DbgPrint(“Volume Attached…\n”);
}
FltObjectDereference(pFLTVolume);

}
}
}

if(buffer != NULL)
ExFreePool(buffer);
}

return STATUS_SUCCESS;
}NTSTATUS
USB_PnpNotifyInterfaceChange(
__in PVOID pNotifyContext,
__in PVOID pContext
)
{
UNICODE_STRING uStrGuid,uGuid;
UNICODE_STRING uStrConst;
PDEVICE_INTERFACE_CHANGE_NOTIFICATION pNotifyData = (PDEVICE_INTERFACE_CHANGE_NOTIFICATION)pNotifyContext;

UNICODE_STRING uStrVolume;
PFILTER_VOLUME_BASIC_INFORMATION pFilterInfo = NULL;
PFLT_VOLUME pFLTVolume;
PVOID buffer = NULL;
NTSTATUS nStatus = STATUS_SUCCESS;
LONG NumberofVolumes = 0,NumberofVolumes2 = 0;
int iLoop = 0;
int i = 0;

RtlStringFromGUID(&pNotifyData->Event ,&uStrGuid);

DbgPrint(“GUID…%ws\n”,uStrGuid.Buffer);

RtlInitUnicodeString(&uStrConst,L"{cb3a4004-46f0-11d0-b08f-00609713053f}");

if(RtlCompareUnicodeString(&uStrConst,&uStrGuid,TRUE)==0)
{
buffer = ExAllocatePool(PagedPool,1024);

DbgPrint(“Symbolic Name %ws \n”,pNotifyData->SymbolicLinkName->Buffer);

FltEnumerateVolumes(WinFLTData.m_Filter,NULL,0,&NumberofVolumes);

DbgPrint(“Number of Volumes %d \n”,NumberofVolumes);
for(iLoop = 0; iLoop < NumberofVolumes; iLoop++)
{
nStatus = FltEnumerateVolumeInformation(WinFLTData.m_Filter,iLoop,FilterVolumeBasicInformation,buffer, 1024,&NumberofVolumes2);
pFilterInfo = (PFILTER_VOLUME_BASIC_INFORMATION)buffer;
uStrVolume.Length = (USHORT)pFilterInfo->FilterVolumeNameLength;
uStrVolume.MaximumLength = uStrVolume.Length;
uStrVolume.Buffer = &pFilterInfo->FilterVolumeName[0];

if(NT_SUCCESS(nStatus))
{
nStatus = FltGetVolumeFromName(WinFLTData.m_Filter,&uStrVolume,&pFLTVolume);
if(NT_SUCCESS(nStatus))
{

nStatus = FltAttachVolume(WinFLTData.m_Filter,pFLTVolume,NULL,NULL);
if(NT_SUCCESS(nStatus))
{
DbgPrint("%ws ",uStrVolume.Buffer);
DbgPrint(“Volume Attached…\n”);
}
FltObjectDereference(pFLTVolume);

}
}
}

if(buffer != NULL)
ExFreePool(buffer);
}

return STATUS_SUCCESS;
}

Thanks…