IoRegisterPlugPlayNotification problem ( i dont get notify? )

I use the following code for notification when a USB device is plugged into a USB Port, but I don’t know which GUID to use for EventCategoryData in IoRegisterPlugPlayNotification:

With GUID_CLASS_USB_DEVICE I don’t get notifications why?

MSDN:

EventCategoryData must point to a GUID specifying a device interface class. CallbackRoutine >will be called when an interface of that class is enabled or removed.

Code:
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath){ NTSTATUS status; DriverObject->DriverUnload=usblockerUnload;status=IoRegisterPlugPlayNotification( EventCategoryDeviceInterfaceChange, PNPNOTIFY_DEVICE_INTERFACE_INCLUDE_EXISTING_INTERFACES, (PVOID)&GUID_CLASS_USB_DEVICE, DriverObject, (PDRIVER_NOTIFICATION_CALLBACK_ROUTINE)PnpNotifyInterfaceChange, NULL, &NotificationHandle);if(!NT_SUCCESS(status)) { DbgPrint("error in IoRegisterPlugPlayNotification"); return status; }DbgPrint(" ok "); return STATUS_SUCCESS;}void usblockerUnload(IN PDRIVER_OBJECT DriverObject){ NTSTATUS status;DbgPrint(" Unload \s \r"); status=IoUnregisterPlugPlayNotification(NotificationHandle);if(!NT_SUCCESS(status)) { DbgPrint("error in IoRegisterPlugPlayNotification"); }}
NTSTATUS PnpNotifyInterfaceChange( PVOID pNotifyContext, PVOID pContext )
{
DbgPrint("USB ");
return STATUS_SUCCESS;
}
And, very important question: How can I use IoSetDeviceInterfaceState to disable an instance of a previously registered device interface class in my call back ?

i must handle Adddevice? and use INF file?

i get confuse why this callback (PnpNotifyInterfaceChange ) not called

That guid is a device class guid, not a device interface guid. Class guids are used in INFs. You cannot disable another driver’s device interface. Only the driver that enabled it can disable it.

d

debt from my phone

-----Original Message-----
From: xxxxx@gmail.com
Sent: Sunday, May 29, 2011 1:52 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] IoRegisterPlugPlayNotification problem ( i dont get notify? )

I use the following code for notification when a USB device is plugged into a USB Port, but I don’t know which GUID to use for EventCategoryData in IoRegisterPlugPlayNotification:

With GUID_CLASS_USB_DEVICE I don’t get notifications why?

MSDN:

EventCategoryData must point to a GUID specifying a device interface class. CallbackRoutine >will be called when an interface of that class is enabled or removed.

Code:
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath){ NTSTATUS status; DriverObject->DriverUnload=usblockerUnload;status=IoRegisterPlugPlayNotification( EventCategoryDeviceInterfaceChange, PNPNOTIFY_DEVICE_INTERFACE_INCLUDE_EXISTING_INTERFACES, (PVOID)&GUID_CLASS_USB_DEVICE, DriverObject, (PDRIVER_NOTIFICATION_CALLBACK_ROUTINE)PnpNotifyInterfaceChange, NULL, &NotificationHandle);if(!NT_SUCCESS(status)) { DbgPrint("error in IoRegisterPlugPlayNotification"); return status; }DbgPrint(" ok "); return STATUS_SUCCESS;}void usblockerUnload(IN PDRIVER_OBJECT DriverObject){ NTSTATUS status;DbgPrint(" Unload \s \r"); status=IoUnregisterPlugPlayNotification(NotificationHandle);if(!NT_SUCCESS(status)) { DbgPrint("error in IoRegisterPlugPlayNotification"); }}
NTSTATUS PnpNotifyInterfaceChange( PVOID pNotifyContext, PVOID pContext )
{
DbgPrint("USB ");
return STATUS_SUCCESS;
}
And, very important question: How can I use IoSetDeviceInterfaceState to disable an instance of a previously registered device interface class in my call back ?

i must handle Adddevice? and use INF file?

i get confuse why this callback (PnpNotifyInterfaceChange ) not called


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

so what GUID i use in IoRegisterPlugPlayNotification for notify USB mass storage ?

i dont undrestand i must use INF file or not ?

how can disable usb mass storage ( security reason )?

i must write driver it purpose is disable use if USB is mass storage and allow if USB is another type like mouse

please please give me a solution

anybody help

Write a disk filter and test if the bus is USB, if so attach to the
device object and fail appropriate IRP’s. This has been discussed many
times in various forums use a search engine and find the older
discussions.

Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

xxxxx@gmail.com” wrote in message
news:xxxxx@ntdev:

> so what GUID i use in IoRegisterPlugPlayNotification for notify USB mass storage ?
>
> i dont undrestand i must use INF file or not ?
>
>
> how can disable usb mass storage ( security reason )?
>
> i must write driver it purpose is disable use if USB is mass storage and allow if USB is another type like mouse
>
> please please give me a solution
>
> anybody help

i approximately 2 week search for own solution and your solution but cant find any good resource

only three question/appeal :

old Question : what GUID i use in IoRegisterPlugPlayNotification for notify USB mass storage ?
i must add adddevice routine in my driver to notify with IoRegisterPlugPlayNotification ?
and please give me any resource ,samle , … about your idea for prevent USB mass storage
( i am newbie and this project is very influence in my job)

thanks

You do not use IoRegiserPlugPlayNotification, you instead create a disk
class filter, then in AddDevice check if the bus is USB. There are a
number of samples for filter drivers in the WDK.

Most of us will not tell you how to do your job, many of us do this for
a living as consultants.

Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

xxxxx@gmail.com” wrote in message
news:xxxxx@ntdev:

> i approximately 2 week search for own solution and your solution but cant find any good resource
>
> only three question/appeal :
>
> old Question : what GUID i use in IoRegisterPlugPlayNotification for notify USB mass storage ?
> i must add adddevice routine in my driver to notify with IoRegisterPlugPlayNotification ?
> and please give me any resource ,samle , … about your idea for prevent USB mass storage
> ( i am newbie and this project is very influence in my job)
>
> thanks

hi xxxxx@gmail.com,
*
*
*Adding to Don’s replies…*
*
*
*The Diskperf sample in the WDK is a good starting point for your problem.*
*
*
*C:\WinDDK\7600.16385.0\src\storage\filters\diskperf*
*
*
*Put appropriate breakpoints/traces in this code and monitor the flow for an
USB plugin.*
*
*
*Especially focus on AddDevive, StartIO, IRP_MN_START_DEVICE and other
handlers. Also see if you can identify a normal disk from a usb disk. then
you can fail the right requests in a graceful manner.*
*
*
*thanks*
*
*
*Amitr0*
*
*
On Mon, May 30, 2011 at 12:38 AM, wrote:

>
> i approximately 2 week search for own solution and your solution but
> cant find any good resource
>
> only three question/appeal :
>
> old Question : what GUID i use in IoRegisterPlugPlayNotification for notify
> USB mass storage ?
> i must add adddevice routine in my driver to notify with
> IoRegisterPlugPlayNotification ?
> and please give me any resource ,samle , … about your idea for
> prevent USB mass storage
> ( i am newbie and this project is very influence in my job)
>
> thanks
>
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>



- amitr0

Actually, a KMDF filter is a smarter approach, and if you know what you
are doing you only attach to devices on the USB bus so no determining
whether or not to fail. At least that is how I’ve done it for clients.

Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“amitr0” wrote in message news:xxxxx@ntdev:

> hi xxxxx@gmail.com,
> *
> *
> Adding to Don’s replies…
> *
> *
> The Diskperf sample in the WDK is a good starting point for your problem.
> *
> *
> C:\WinDDK\7600.16385.0\src\storage\filters\diskperf
> *
> *
> Put appropriate breakpoints/traces in this code and monitor the flow for an
> USB plugin.

> *
> *
> Especially focus on AddDevive, StartIO, IRP_MN_START_DEVICE and other
> handlers. Also see if you can identify a normal disk from a usb disk. then
> you can fail the right requests in a graceful manner.

> *
> *
> thanks
> *
> *
> Amitr0
> *
> *
> On Mon, May 30, 2011 at 12:38 AM, wrote:
>
> >
> > i approximately 2 week search for own solution and your solution but
> > cant find any good resource
> >
> > only three question/appeal :
> >
> > old Question : what GUID i use in IoRegisterPlugPlayNotification for notify
> > USB mass storage ?
> > i must add adddevice routine in my driver to notify with
> > IoRegisterPlugPlayNotification ?
> > and please give me any resource ,samle , … about your idea for
> > prevent USB mass storage
> > ( i am newbie and this project is very influence in my job)
> >
> > thanks
> >
> >
> >
> > —
> > NTDEV is sponsored by OSR
> >
> > For our schedule of WDF, WDM, debugging and other seminars visit:
> > http://www.osr.com/seminars
> >
> > To unsubscribe, visit the List Server section of OSR Online at
> > http://www.osronline.com/page.cfm?name=ListServer
> >
>
>
>
> –
>
> - amitr0

very thank

i decide to write filter but i am eager to understand more about IoRegisterPlugPlayNotification

@ Don Burn:
You cannot disable another driver’s device interface. Only the driver that enabled it can disable it.

so how we can disable it in user mode:
http://www.codeproject.com/KB/system/HwDetect.aspx

Setup the SP_PROPCHANGE_PARAMS structure properly
Call SetupDiSetClassInstallParams() and pass-in the SP_PROPCHANGE_PARAMS structure
Call SetupDiCallClassInstaller() with DIF_PROPERTYCHANGE

what is different ? can you explain this ?
///////

what is relationship between disk class filter and adddevice? filter can support PNP

very thanks

The project you mention detects changes, it does not change things.
This is the same as IoRegisterPlugPlayNotification it will tell you that
an interface is available or gone, but it does not provide a control to
change the state.

Take a class on Windows driver writing, you are not ready to manipulate
the storage stack.

Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

xxxxx@gmail.com” wrote in message
news:xxxxx@ntdev:

> very thank
>
> i decide to write filter but i am eager to understand more about IoRegisterPlugPlayNotification
>
> @ Don Burn:
> You cannot disable another driver’s device interface. Only the driver that enabled it can disable it.
>
> so how we can disable it in user mode:
> http://www.codeproject.com/KB/system/HwDetect.aspx
>
> Setup the SP_PROPCHANGE_PARAMS structure properly
> Call SetupDiSetClassInstallParams() and pass-in the SP_PROPCHANGE_PARAMS structure
> Call SetupDiCallClassInstaller() with DIF_PROPERTYCHANGE
>
>
> what is different ? can you explain this ?
> ///////
>
> what is relationship between disk class filter and adddevice? filter can support PNP
>
> very thanks

the above project in codeproject.com can disable USB , so why you say “it does not change things”

there is no class for driver developing in my country !!

xxxxx@gmail.com wrote:

so what GUID i use in IoRegisterPlugPlayNotification for notify USB mass storage ?

i dont undrestand i must use INF file or not ?

how can disable usb mass storage ( security reason )?

i must write driver it purpose is disable use if USB is mass storage and allow if USB is another type like mouse

What a novel idea. That’s never been done before.

You are not aware that there are a huge number of products on the market
today that serve exactly this purpose, helping you to impede the normal
functioning of your computer?


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.