Read file from driver or pass parameters to it.

Andrew_Scott · July 8, 2013, 9:52am

Hi,

I am working on an upper volume filter driver using diskperf as base.
The main purpose of our driver is to monitor changes at the sector level.
Is it possible to read a file from my driver or how can I pass parameters to my driver?

amitr0-2 · July 8, 2013, 10:16am

hello,

there can be many ways to pass parameters to a driver:

use the registry
yes, you can read a file from your volume filter using the Zw* calls
Send IOCTLs to your own driver with the parameters.

On Mon, Jul 8, 2013 at 7:21 PM, wrote:

> Hi,
>
> I am working on an upper volume filter driver using diskperf as base.
> The main purpose of our driver is to monitor changes at the sector level.
> Is it possible to read a file from my driver or how can I pass parameters
> to my driver?
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

–

- ab

NTDEV_Newbie · July 8, 2013, 11:15am

Here is one way on how to do it using control device objects;

http://support.microsoft.com/kb/262305

Andrew_Scott · July 9, 2013, 10:38am

Hi,

Actually I want to read the file at a very early stage when the system boots.
So IOCTLs won’t be possible and I tried to use Zw* calls but failed.
I used the following code,

//////////////////////////////////Code////////////////////////////////////////

#define BUFFER_SIZE 100

NTSTATUS testfileread(IN PDEVICE_OBJECT DeviceObject)
{
HANDLE handle;
NTSTATUS ntstatus;
IO_STATUS_BLOCK ioStatusBlock;
LARGE_INTEGER byteOffset;

UNICODE_STRING uniName;
OBJECT_ATTRIBUTES objAttr;
CHAR buffer[BUFFER_SIZE];

RtlInitUnicodeString(&uniName, L"\SystemRoot\example.txt"); // or L"\SystemRoot\example.txt" or L"\DosDevices\C:\WINDOWS\example.txt"
InitializeObjectAttributes(&objAttr, &uniName,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
NULL, NULL);

// Do not try to perform any file operations at higher IRQL levels.
// Instead, you may use a work item or a system worker thread to perform file operations.

if(KeGetCurrentIrql() != PASSIVE_LEVEL)
{
return STATUS_INVALID_DEVICE_STATE;
}

ntstatus = ZwOpenFile(&handle,
GENERIC_READ,
&objAttr, &ioStatusBlock,
0, FILE_NON_DIRECTORY_FILE);
/*ntstatus = ZwCreateFile(&handle,
GENERIC_READ,
&objAttr, &ioStatusBlock,
NULL,
FILE_ATTRIBUTE_NORMAL,
0,
FILE_OPEN,
FILE_NON_DIRECTORY_FILE,
NULL, 0);*/
if(NT_SUCCESS(ntstatus)) {
byteOffset.LowPart = byteOffset.HighPart = 0;
ntstatus = ZwReadFile(handle, NULL, NULL, NULL, &ioStatusBlock,
buffer, BUFFER_SIZE, &byteOffset, NULL);
if(NT_SUCCESS(ntstatus)) {
buffer[BUFFER_SIZE-1] = ‘\0’;
DbgPrint(“testfileread: %s\n”, buffer);
}
else
{
DbgPrint(“testfileread: failed reading into buffer: %x\n”, ntstatus);
}
ZwClose(handle);
}
else
{
DbgPrint(“testfileread: ZwCreateFile failed %x\n”, ntstatus);
ZwClose(handle);
}
return STATUS_SUCCESS;
}

/////////////////////////////////////////////////////////////////////////////////////////////////////////

I tried to use both ZwCreateFile and ZwOpenFile, but I am getting the same error for both i.e. 0xC000000E(STATUS_NO_SUCH_DEVICE).

I am calling this function from the PNP routine in case IRP_MN_START_DEVICE. I also tried to call the function from testdriverStartDevice() function but got the same error.

\\\\\\\\\\\\\\\\\\\Code\\\\\\\\\\\\\\\\\\\\\\\\\

case IRP_MN_START_DEVICE:
//
// Call the Start Routine handler to schedule a completion routine
//
DebugPrint((3,
“testdriverDispatchPnp: Schedule completion for START_DEVICE”));
status = testdriverStartDevice(DeviceObject, Irp);
if(NT_SUCCESS(status))
{
testfileread(DeviceObject);
}
break;

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

Can you give me some inputs what I am doing wrong?

amitr0-2 · July 9, 2013, 11:00am

you cant use FS APIs before FS mount is complete.

On Tue, Jul 9, 2013 at 8:08 PM, wrote:

> Hi,
>
> Actually I want to read the file at a very early stage when the system
> boots.
> So IOCTLs won’t be possible and I tried to use Zw* calls but failed.
> I used the following code,
>
>
> //////////////////////////////////Code////////////////////////////////////////
>
> #define BUFFER_SIZE 100
>
> NTSTATUS testfileread(IN PDEVICE_OBJECT DeviceObject)
> {
> HANDLE handle;
> NTSTATUS ntstatus;
> IO_STATUS_BLOCK ioStatusBlock;
> LARGE_INTEGER byteOffset;
>
> UNICODE_STRING uniName;
> OBJECT_ATTRIBUTES objAttr;
> CHAR buffer[BUFFER_SIZE];
>
> RtlInitUnicodeString(&uniName, L"\SystemRoot\example.txt"); // or
> L"\SystemRoot\example.txt" or L"\DosDevices\C:\WINDOWS\example.txt"
> InitializeObjectAttributes(&objAttr, &uniName,
> OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
> NULL, NULL);
>
> // Do not try to perform any file operations at higher IRQL levels.
> // Instead, you may use a work item or a system worker thread to
> perform file operations.
>
> if(KeGetCurrentIrql() != PASSIVE_LEVEL)
> {
> return STATUS_INVALID_DEVICE_STATE;
> }
>
> ntstatus = ZwOpenFile(&handle,
> GENERIC_READ,
> &objAttr, &ioStatusBlock,
> 0, FILE_NON_DIRECTORY_FILE);
> /ntstatus = ZwCreateFile(&handle,
> GENERIC_READ,
> &objAttr, &ioStatusBlock,
> NULL,
> FILE_ATTRIBUTE_NORMAL,
> 0,
> FILE_OPEN,
> FILE_NON_DIRECTORY_FILE,
> NULL, 0);/
> if(NT_SUCCESS(ntstatus)) {
> byteOffset.LowPart = byteOffset.HighPart = 0;
> ntstatus = ZwReadFile(handle, NULL, NULL, NULL, &ioStatusBlock,
> buffer, BUFFER_SIZE, &byteOffset, NULL);
> if(NT_SUCCESS(ntstatus)) {
> buffer[BUFFER_SIZE-1] = ‘\0’;
> DbgPrint(“testfileread: %s\n”, buffer);
> }
> else
> {
> DbgPrint(“testfileread: failed reading into
> buffer: %x\n”, ntstatus);
> }
> ZwClose(handle);
> }
> else
> {
> DbgPrint(“testfileread: ZwCreateFile failed %x\n”,
> ntstatus);
> ZwClose(handle);
> }
> return STATUS_SUCCESS;
> }
>
>
> /////////////////////////////////////////////////////////////////////////////////////////////////////////
>
> I tried to use both ZwCreateFile and ZwOpenFile, but I am getting the same
> error for both i.e. 0xC000000E(STATUS_NO_SUCH_DEVICE).
>
> I am calling this function from the PNP routine in case
> IRP_MN_START_DEVICE. I also tried to call the function from
> testdriverStartDevice() function but got the same error.
>
>
> \\\\\\\\\\\\\\\\\\\Code\\\\\\\\\\\\\\\\\\\\\\\\<br>>
> case IRP_MN_START_DEVICE:
> //
> // Call the Start Routine handler to schedule a completion
> routine
> //
> DebugPrint((3,
> “testdriverDispatchPnp: Schedule completion for
> START_DEVICE”));
> status = testdriverStartDevice(DeviceObject, Irp);
> if(NT_SUCCESS(status))
> {
> testfileread(DeviceObject);
> }
> break;
>
>
> \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\<br>>
> Can you give me some inputs what I am doing wrong?
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

–

- ab

Don_Burn · July 9, 2013, 11:18am

Put this stuff in the registry. You don’t have a choice for early boot.

Don Burn
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@hotmail.com
Sent: Tuesday, July 09, 2013 10:38 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Read file from driver or pass parameters to it.

Hi,

Actually I want to read the file at a very early stage when the system
boots.
So IOCTLs won’t be possible and I tried to use Zw* calls but failed.
I used the following code,

//////////////////////////////////Code//////////////////////////////////////
//

#define BUFFER_SIZE 100

NTSTATUS testfileread(IN PDEVICE_OBJECT DeviceObject) {
HANDLE handle;
NTSTATUS ntstatus;
IO_STATUS_BLOCK ioStatusBlock;
LARGE_INTEGER byteOffset;

UNICODE_STRING uniName;
OBJECT_ATTRIBUTES objAttr;
CHAR buffer[BUFFER_SIZE];

RtlInitUnicodeString(&uniName, L"\SystemRoot\example.txt"); // or
L"\SystemRoot\example.txt" or L"\DosDevices\C:\WINDOWS\example.txt"
InitializeObjectAttributes(&objAttr, &uniName,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
NULL, NULL);

// Do not try to perform any file operations at higher IRQL levels.
// Instead, you may use a work item or a system worker thread to perform
file operations.

if(KeGetCurrentIrql() != PASSIVE_LEVEL)
{
return STATUS_INVALID_DEVICE_STATE;
}

ntstatus = ZwOpenFile(&handle,
GENERIC_READ,
&objAttr, &ioStatusBlock,
0, FILE_NON_DIRECTORY_FILE);
/*ntstatus = ZwCreateFile(&handle,
GENERIC_READ,
&objAttr, &ioStatusBlock,
NULL,
FILE_ATTRIBUTE_NORMAL,
0,
FILE_OPEN,
FILE_NON_DIRECTORY_FILE,
NULL, 0);*/
if(NT_SUCCESS(ntstatus)) {
byteOffset.LowPart = byteOffset.HighPart = 0;
ntstatus = ZwReadFile(handle, NULL, NULL, NULL, &ioStatusBlock,
buffer, BUFFER_SIZE, &byteOffset, NULL);
if(NT_SUCCESS(ntstatus)) {
buffer[BUFFER_SIZE-1] = ‘\0’;
DbgPrint(“testfileread: %s\n”, buffer);
}
else
{
DbgPrint(“testfileread: failed reading into buffer:
%x\n”, ntstatus);
}
ZwClose(handle);
}
else
{
DbgPrint(“testfileread: ZwCreateFile failed %x\n”,
ntstatus);
ZwClose(handle);
}
return STATUS_SUCCESS;
}

////////////////////////////////////////////////////////////////////////////
/////////////////////////////

I tried to use both ZwCreateFile and ZwOpenFile, but I am getting the same
error for both i.e. 0xC000000E(STATUS_NO_SUCH_DEVICE).

I am calling this function from the PNP routine in case IRP_MN_START_DEVICE.
I also tried to call the function from testdriverStartDevice() function but
got the same error.

\\\\\\\\\\\\\\\\\\\Code\\\\\\\\\\\\\\\\\\
\\\\\\\

case IRP_MN_START_DEVICE:
//
// Call the Start Routine handler to schedule a completion
routine
//
DebugPrint((3,
“testdriverDispatchPnp: Schedule completion for
START_DEVICE”));
status = testdriverStartDevice(DeviceObject, Irp);
if(NT_SUCCESS(status))
{
testfileread(DeviceObject);
}
break;

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\

Can you give me some inputs what I am doing wrong?

NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer