Reading MBR

Hi,

I am trying to read MBRs on IRP_MN_MOUNT_VOLUME inside my filter-driver with
IoBuildSynchronousFsdRequest. But all I get is STATUS_INVALID_PARAMETER.

I read the “Recognizer” article on OSR online, but I can not see my mistake.
Is it correct to take the “Vpb->RealDevice” device object?

Thanks in advance

Mount paths of all Windows filesystems ignore MBR at all, including the
“partition type” byte.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “plu1”
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Sent: Thursday, December 22, 2005 3:45 PM
Subject: [ntfsd] Reading MBR

> Hi,
>
> I am trying to read MBRs on IRP_MN_MOUNT_VOLUME inside my filter-driver with
> IoBuildSynchronousFsdRequest. But all I get is STATUS_INVALID_PARAMETER.
>
> I read the “Recognizer” article on OSR online, but I can not see my mistake.
> Is it correct to take the “Vpb->RealDevice” device object?
>
> Thanks in advance
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

I believe that disk.sys provides a ‘volume’ to the file systems. It is a
zero (LBA) to n-1 sectors based hunk of storage. The MBR does not exist in
that ‘volume’ so there is nothing you can do to read it using what you are
given. You can get the physical drive name and read it that way or ask
disk.sys for the partition information for the physical drive. The physical
drive is a ‘volume’ also, but not exactly the same as the other ‘volumes’.
You have to be able to determine that it is your volume by using the
partition boot record (e.g. DOS boot record). Remember all file systems
added after the standard ones get to see the volume before the standard
ones, such as NTFS, FAT, and CDFS. Don’t forget that to ensure
compatibility that the first sector in that volume have the 0x55AA signature
in the last two bytes.

“Maxim S. Shatskih” wrote in message
news:xxxxx@ntfsd…
> Mount paths of all Windows filesystems ignore MBR at all, including the
> “partition type” byte.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
> ----- Original Message -----
> From: “plu1”
> Newsgroups: ntfsd
> To: “Windows File Systems Devs Interest List”
> Sent: Thursday, December 22, 2005 3:45 PM
> Subject: [ntfsd] Reading MBR
>
>
>> Hi,
>>
>> I am trying to read MBRs on IRP_MN_MOUNT_VOLUME inside my filter-driver
>> with
>> IoBuildSynchronousFsdRequest. But all I get is STATUS_INVALID_PARAMETER.
>>
>> I read the “Recognizer” article on OSR online, but I can not see my
>> mistake.
>> Is it correct to take the “Vpb->RealDevice” device object?
>>
>> Thanks in advance
>>
>>
>>
>> —
>> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>>
>> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>

> I believe that disk.sys provides a ‘volume’ to the file systems. It is a

zero (LBA) to n-1 sectors based hunk of storage.

Not exactly. “Volume” is implemented by the _volume manager, and it is a
[0…LBA) hunk of storage which is able of responding to some IOCTLs,
including the IOCTL_MOUNTDEV_xxx ones.

FtDisk is the volume manager which exposes the disk partitions as volumes (as
also the NT4-style legacy software RAIDs).

No volume managers on removable media though.

The MBR does not exist in
that ‘volume’

Yes, this is correct. After all, the volume can be removable media, or Dynamic
Disk, or GPT disk.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

A note:

You can not call down to the lower-driver with a sync. request in the mount
path.

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of plu1
Sent: Thursday, December 22, 2005 4:45 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Reading MBR

Hi,

I am trying to read MBRs on IRP_MN_MOUNT_VOLUME inside my filter-driver with

IoBuildSynchronousFsdRequest. But all I get is STATUS_INVALID_PARAMETER.

I read the “Recognizer” article on OSR online, but I can not see my mistake.

Is it correct to take the “Vpb->RealDevice” device object?

Thanks in advance


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@rocketdivision.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

What does that have to do with him WANTING to read the MBR?

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Thursday, December 22, 2005 1:43 PM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] Reading MBR

Mount paths of all Windows filesystems ignore MBR at all, including the
“partition type” byte.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “plu1”
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Sent: Thursday, December 22, 2005 3:45 PM
Subject: [ntfsd] Reading MBR

> Hi,
>
> I am trying to read MBRs on IRP_MN_MOUNT_VOLUME inside my filter-driver
with
> IoBuildSynchronousFsdRequest. But all I get is STATUS_INVALID_PARAMETER.
>
> I read the “Recognizer” article on OSR online, but I can not see my
mistake.
> Is it correct to take the “Vpb->RealDevice” device object?
>
> Thanks in advance
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@rocketdivision.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Excuse me, but perhaps my problem lies in a lack of knowledge.

If a recognizer can do this, why not my filter? The “recognizer” article on
OSR online has some pseudo sample code, which reads disk geometry and
sectors on "IRP_MN_MOUNT_VOLUME ".

And besides: I thought if I query Vpb->RealDevice…this is a sort of “block
device”…which I thought doesn’t belong to the “lower” driver of my filter.

Frank

“Jamey Kirby” schrieb im Newsbeitrag
news:xxxxx@ntfsd…
>A note:
>
> You can not call down to the lower-driver with a sync. request in the
> mount
> path.
>
> Jamey
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of plu1
> Sent: Thursday, December 22, 2005 4:45 AM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] Reading MBR
>
> Hi,
>
> I am trying to read MBRs on IRP_MN_MOUNT_VOLUME inside my filter-driver
> with
>
> IoBuildSynchronousFsdRequest. But all I get is STATUS_INVALID_PARAMETER.
>
> I read the “Recognizer” article on OSR online, but I can not see my
> mistake.
>
> Is it correct to take the “Vpb->RealDevice” device object?
>
> Thanks in advance
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@rocketdivision.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>

There are complete examples of a file system recognizer. I know I have one
somewhere, from Nagar. Since this is posted in ntfsd, I will assume the
filter is a file system filter. Only reads of the data from the mounting
volume are permitted. Ignore the MBR.

“frank” wrote in message news:xxxxx@ntfsd…
> Excuse me, but perhaps my problem lies in a lack of knowledge.
>
> If a recognizer can do this, why not my filter? The “recognizer” article
> on OSR online has some pseudo sample code, which reads disk geometry and
> sectors on "IRP_MN_MOUNT_VOLUME ".
>
> And besides: I thought if I query Vpb->RealDevice…this is a sort of
> “block device”…which I thought doesn’t belong to the “lower” driver of
> my filter.
>
> Frank
>
> “Jamey Kirby” schrieb im Newsbeitrag
> news:xxxxx@ntfsd…
>>A note:
>>
>> You can not call down to the lower-driver with a sync. request in the
>> mount
>> path.
>>
>> Jamey
>>
>>
>> -----Original Message-----
>> From: xxxxx@lists.osr.com
>> [mailto:xxxxx@lists.osr.com] On Behalf Of plu1
>> Sent: Thursday, December 22, 2005 4:45 AM
>> To: Windows File Systems Devs Interest List
>> Subject: [ntfsd] Reading MBR
>>
>> Hi,
>>
>> I am trying to read MBRs on IRP_MN_MOUNT_VOLUME inside my filter-driver
>> with
>>
>> IoBuildSynchronousFsdRequest. But all I get is STATUS_INVALID_PARAMETER.
>>
>> I read the “Recognizer” article on OSR online, but I can not see my
>> mistake.
>>
>> Is it correct to take the “Vpb->RealDevice” device object?
>>
>> Thanks in advance
>>
>>
>>
>> —
>> Questions? First check the IFS FAQ at
>> https://www.osronline.com/article.cfm?id=17
>>
>> You are currently subscribed to ntfsd as: xxxxx@rocketdivision.com
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>>
>
>
>

I guess if your filter does not need to run under Windows 2000, then you are
OK. However, if you do want to support Windows 2000, you can not call a
synchronous request to a block device from the mount path. Rather than me
paraphrasing, I am enclosing Molly Browns post on this issue to this list a
little over a year ago:

***** Begin Insert

Hi Jiri,

No, the problem is not that mount requests get completed at DPC on Windows
2000. The problem is that DFS filter on Windows 2000 Server calls down to
the file system with APCs disabled (it is inside a call to
FsRtlEnterFileSystem()). If your filter waits in the dispatch routine for
the MOUNT IRP to complete, APCs will still be disabled when FAT wants to do
is final processing which completes the IRP. FAT needs to queue an APC to
do this final processing, but since APCs are disabled, this APC will never
run, the IRP will never be completed and your filter’s event will never be
signaled.

Now, you may ask “Why not just do this work in the mount completion routine
since a mount request isn’t going to get completed at DPC?”. While to date
I’ve never seen a mount request complete at DPC, but the IO model does not
rule out that possibility, so my advice is to error on the side of caution.
The extra overhead to ensure that you can do this final mount process at
PASSIVE_LEVEL is not very large and MOUNTs do not happen very frequently.

Thanks,
Molly Brown
Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no rights.

***** End Insert

I had a bug in a driver that was related to this issue. We kept the bug open
for nearly a year because we were unable to resolve or reproduce the issue
or isolate why it was happening. It was rare, maybe 10 machines out of
nearly a million. Passing the mount request and the mount completion off to
a worker threads resolved the issue. Like Molly said, mounts are not
frequent and the overhead does not impact overall system performance.

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of frank
Sent: Friday, December 23, 2005 3:45 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Reading MBR

Excuse me, but perhaps my problem lies in a lack of knowledge.

If a recognizer can do this, why not my filter? The “recognizer” article on
OSR online has some pseudo sample code, which reads disk geometry and
sectors on "IRP_MN_MOUNT_VOLUME ".

And besides: I thought if I query Vpb->RealDevice…this is a sort of "block

device"…which I thought doesn’t belong to the “lower” driver of my filter.

Frank

“Jamey Kirby” schrieb im Newsbeitrag
news:xxxxx@ntfsd…
>A note:
>
> You can not call down to the lower-driver with a sync. request in the
> mount
> path.
>
> Jamey
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of plu1
> Sent: Thursday, December 22, 2005 4:45 AM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] Reading MBR
>
> Hi,
>
> I am trying to read MBRs on IRP_MN_MOUNT_VOLUME inside my filter-driver
> with
>
> IoBuildSynchronousFsdRequest. But all I get is STATUS_INVALID_PARAMETER.
>
> I read the “Recognizer” article on OSR online, but I can not see my
> mistake.
>
> Is it correct to take the “Vpb->RealDevice” device object?
>
> Thanks in advance
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@rocketdivision.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@rocketdivision.com
To unsubscribe send a blank email to xxxxx@lists.osr.com