The sample filter driver - sfilter - defines a device type as:
#define SFILTER_DEVICE_TYPE 0x1234
If I change it to value in the range of 32768-65535, the debugger trips on
every:
ASSERT(IS_MY_DEVICE_EXTENSION( DeviceObject->DeviceExtension ));
I can change the value to 0x1236 and it works fine. Does a filter device
type have to be in a special predefined range for a custom file system
filter driver?
I also notice that the filespy example uses a device type value of 0x1235
for it’s device type which it uses in it’s custom IOCTLS and in the
IoCreateDevice call in DriverEntery, whereas, sfilter uses
FILE_DEVICE_DISK_FILE_SYSTEM (0x8) in it’s IoCreateDevice call.
Documentation says:
"File system and network drivers set other system-defined FILE_DEVICE_XXX
in the Type fields of their respective device objects.
“FILE_DEVICE_XXX values in the range 0–32767 are reserved to Microsoft®.
All driver writers must use one of these system-defined constants for new
drivers when the underlying device corresponds to a type in the preceding
list.”
I guess FILE_DEVICE_DISK_FILE_SYSTEM for the IoCreateDevice call makes
sense in a filesystem filter driver. I will be creating some custom IOCTLs
for my filter driver and I don’t understand why the value 0x8088 will fail
the asserts and 0x1236 will not?
It is all so confusing at times.
For those who may not have the kit the macro is defined:
#define IS_MY_DEVICE_EXTENSION(_devExt) (((_devExt) != NULL) && (((PDEVICE_EXTENSION)(_devExt))->MyDriver == FsDriverObject) && (((PDEVICE_EXTENSION)(_devExt))->Type == SFILTER_DEVICE_TYPE) && (((PDEVICE_EXTENSION)(_devExt))->Size == sizeof( DEVICE_EXTENSION )))
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
See the discussion “Filter driver/NT4.0” beginning on 12 May in
comp.os.ms-windows.programmer.nt.kernel-mode and look at Walter Oney’s
suggestion in particular.
–
James Antognini
IBM Watson Research
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
I checked the news reference and it discusses a problem involving the VPB
with a generic filter driver on a storage device stack. My question
concerns a problem with the defined device type to be used in the IOCTLs
to
the SFILTER generic file system filter driver which resides above the disk
file system driver. I did not see that issue addressed in the news
discussion referenced.
Regards,
Joe
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
I was thinking of the suggestion to copy, or otherwise use, the type
from the lower device object.
–
James Antognini
IBM Watson Research
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
I found the problem. The type is defined as a CSHORT in _DEVICE_EXTENSION
typedef struct _DEVICE_EXTENSION {
CSHORT Type;
CSHORT Size;
PDRIVER_OBJECT MyDriver; //pointer to my DriverObject
PDEVICE_OBJECT NextDeviceObject;
PDEVICE_OBJECT RealDeviceObject;
BOOLEAN Attached;
} DEVICE_EXTENSION, *PDEVICE_EXTENSION;
The compiler sees the “#define SFILTER_DEVICE_TYPE” as a const int. Since
the comparison was being done in a macro the compiler did not issue any
warning about the mismatch. I added a CSHORT cast to the macro and now
everything is fine.
#define IS_MY_DEVICE_EXTENSION(_devExt) (((_devExt) != NULL) && (((PDEVICE_EXTENSION)(_devExt))->MyDriver == FsDriverObject) && (((PDEVICE_EXTENSION)(_devExt))->Type == (CSHORT) SFILTER_DEVICE_TYPE) &&
(((PDEVICE_EXTENSION)(_devExt))->Size == sizeof( DEVICE_EXTENSION )))
Regards,
Joe
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com