Logical Block Address not Showing up in CDB of SCSI_REQUEST_BLOCK

NTDEV
1

Hi. I'm currently making a driver for recording the addresses and lengths of I/O request happening in the system.
I made a driver that operates below storage class driver and above storage port driver, so that it can filter SRBs.

image
image394×475 3.62 KB

This is the CDB of the SCSI_REQUEST_BLOCK I got for SCSIOP_READ. Apparently, I found the length of the I/O, but not the address.
Should I use another method, other than relying on CDB?

2

That is not a read cdb. The opcode ought to be 28.

The storage class driver code that sets up the CDB is here: Windows-driver-samples/storage/class/classpnp/src/xferpkt.c at 4f30b7f23e3c0c2a547a3a5cf27087f6bd95c9ad · microsoft/Windows-driver-samples · GitHub

3

So you mean to say that the opcode, not the Function member of the SRB, should be reference in order to filter read and write operations?
Like pCdb->CDB10.OperationCode member in the code you provided?

4

You need to filter on Irp for IRP_MJ_SCSI, then srbs for SRB_FUNCTION_EXECUTE_SCSI, then on the CDB for whatever IO operations you need.