>What is the best way to do what I am trying to accomplish? Can I do it with
Windows IO Manager calls, or is there some >way to use SetupDI in a similar
way to get access to the relevant kernel objects?
Well, there’s a few things here to sort out for you. I’ll start by saying
that SetupDi isn’t really suited for what you’re asking. All you can really
get out of SetupDi is the, “Devices by Connection” view in Device Manager.
It doesn’t so much deal with device objects and what the dispatch entry
points in the driver objects would be, that’s strictly in the realm of
kernel mode.
With that out of the way…You have to realize that there are two concepts
in Windows. There are device stacks, which are sets of attached devices, and
device branches, which are *logical* groupings of device objects and device
stacks. So, for example, when an I/O request gets sent to the storage
branch, it first flows through the file system stack, then the volume stack,
then the disk stack, etc. Even if you know all of the devices in a
particular stack that won’t give you, “all of the IRP handlers that will be
called when an IRP is sent to a particular device” because those might not
all be in the same stack. Which brings me to my next point…
Even worse, the flow of an I/O request is never pre-determined. Any device
could send the request to any other device in the system at any point, so
there’s no way to know a priori where an IRP is going to go. This is why we
created IRPTracker, which tracks the IRPs at runtime and logs an entry for
each device object they touch. This relies on hacks though that aren’t
really suitable for production code.
That all makes your problem as stated pretty intractable. If you can scope
it or redefine it better we might be able to help.
-scott
–
Scott Noone
Consulting Associate
OSR Open Systems Resources, Inc.
http://www.osronline.com
wrote in message news:xxxxx@ntdev…
> I am trying to programmatically enumerate all of the IRP handlers that
> will be called when an IRP is sent to a particular device. I know that I
> can get a driver object related to a particular device through a call to
> IoGetDeviceObjectPointer and from there can inspect the Driver Object’s
> MajorFunction table. However, if I am clear about how the driver stack
> works in Windows there could be filter drivers attached lower in the
> device stack and references to the IRP handlers they register would not
> appear in this “top layer” MajorFunction table referenced by the
> Driver/Device Object returned by IoGetDeviceObjectPointer. Thus what I am
> really trying to do is enumerate all of the DriverObject’s and their
> respective MajorFunction tables that will be referenced when an IRP is
> sent to a particular device.
>
> My searching for a solution to this problem has suggested I investigate
> the SetupDI API. I have, and have looked at the Devcon example in the DDK
> but it wasn’t immediately clear to me that this API could yield the actual
> kernel objects associated with a device stack that I am interested in
> (DeviceObject/DriverObject/MajorFunction). It seems to me that I should
> be able to use other Windows IO Manager calls like
> IoGetDeviceObjectPointer to enumerate these objects I want, but perhaps
> not since I have looked pretty hard yet have not found them.
>
> What is the best way to do what I am trying to accomplish? Can I do it
> with Windows IO Manager calls, or is there some way to use SetupDI in a
> similar way to get access to the relevant kernel objects?
>
> Thanks a bunch for any help you can give me!
>
>