Hi. I'm currently making a driver for recording the addresses and lengths of I/O request happening in the system.
I made a driver that operates below storage class driver and above storage port driver, so that it can filter SRBs.
This is the CDB of the SCSI_REQUEST_BLOCK I got for SCSIOP_READ. Apparently, I found the length of the I/O, but not the address.
Should I use another method, other than relying on CDB?
That is not a read cdb. The opcode ought to be 28.
The storage class driver code that sets up the CDB is here: Windows-driver-samples/storage/class/classpnp/src/xferpkt.c at 4f30b7f23e3c0c2a547a3a5cf27087f6bd95c9ad · microsoft/Windows-driver-samples · GitHub
So you mean to say that the opcode, not the Function member of the SRB, should be reference in order to filter read and write operations?
Like pCdb->CDB10.OperationCode member in the code you provided?
You need to filter on Irp for IRP_MJ_SCSI, then srbs for SRB_FUNCTION_EXECUTE_SCSI, then on the CDB for whatever IO operations you need.
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.
