SD BUS Filter driver

NTDEV
1

Hello Everybody,

I am looking for a filter driver that would intercept the SDIO client driver requests to the bus driver and provide some kind of interface for application to watch the IRPs and data.

I tried TestFilter found here http://www.opening-windows.com/testfilter.html
But I could not get it working.

Is there a filter driver that I can use for this purpose?

Regards,
Surendra

2

xxxxx@onchiptech.com wrote:

I am looking for a filter driver that would intercept the SDIO client driver requests to the bus driver and provide some kind of interface for application to watch the IRPs and data.

I tried TestFilter found here http://www.opening-windows.com/testfilter.html
But I could not get it working.

Most SD card readers are exposed simply as a USB mass storage device.
Do you actually have a PCI SD host controller using sdbus.sys?

How did you try to install the TestFilter?

You can also try OSR’s IrpTracker at
http://www.osronline.com/article.cfm?article=199.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

3

Clients use SdBusSubmitRequest. It is not irp based.

4

Tim,

Thank you for your quick reply.

I have tried TestFilter by creating a key TestFilter under HKLM\SystemCurrentControlSet\Services and the following three values into it

name: ErrorControl
type: REG_DWORD
value: 0x0
name: ImagePath
type: REG_EXPAND_SZ
value: \Device\HarddiskVolume1\Apps\TestApp\TestFilt.sys
name: Start
type: REG_DWORD
value: 0x3
name: Type
type: REG_DWORD
value: 0x1

The service always failed to start with the above settings.

Then I created a service using command line "sc create binPath= “\Device\HarddiskVolume1\Apps\TestApp\TestFilt.sys”
and then “sc start TestFilt”. The service has started but did not connect to bus driver for filtering. Here I don’t know how to specify registry settings to filter the SD Bus driver.

It seems like IrpTracker suits my requirement job. Is it possible to view the data in IRPs with IrpTracker?

I will try IrpTracker now and post the results.

Once again thank you for the help.
Surendra

5

By the way, I am not using the external SD card reader. I am using built in SDIO Host controller in my laptop and I am trying to intercept communication to SDIO card.

6

typedef struct _SDBUS_REQUEST_PACKET {
SD_REQUEST_FUNCTION RequestFunction;
PVOID UserContext[3];
ULONG_PTR Information;
union {
UCHAR AsUCHAR[16];
ULONG AsULONG[4];
SDRESP_TYPE3 Type3;
} ResponseData;
UCHAR ResponseLength;
union {
struct {
SDBUS_PROPERTY Property;
PVOID Buffer;
ULONG Length;
} GetSetProperty;
struct {
SDCMD_DESCRIPTOR CmdDesc;
ULONG Argument;
PMDL Mdl;
ULONG Length;
} DeviceCommand;
} Parameters;
} SDBUS_REQUEST_PACKET, *PSDBUS_REQUEST_PACKET;

I need to decode the above structure and the contents of memory pointed to by structure member “PMDL Mdl;”

7

xxxxx@onchiptech.com wrote:

I have tried TestFilter by creating a key TestFilter under HKLM\SystemCurrentControlSet\Services and the following three values into it
…
The service always failed to start with the above settings.

Then I created a service using command line "sc create binPath= “\Device\HarddiskVolume1\Apps\TestApp\TestFilt.sys”
and then “sc start TestFilt”. The service has started but did not connect to bus driver for filtering. Here I don’t know how to specify registry settings to filter the SD Bus driver.

Of course it didn’t start. How did you think it was supposed to know
which driver to filter? TestFilt is a PnP driver. It is not started
with the Service Manager. You create the service (to establish a
pointer to the file), then you create an UpperFilters or LowerFilters
key in the Enum registry tree of the device you want to filter, that
includes your service’s name. Then, the next time the driver starts,
your filter will be automatically loaded.

However, as mnavab indicates, SD clients use a direct-call API to submit
requests, not IRPs. A filter driver is not going to help you.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

8

>>However, as mnavab indicates, SD clients use a direct-call API to submit

>requests, not IRPs. A filter driver is not going to help you.

How does the direct-call API works from SD Card client driver to SD Bus driver ?

I am assuming that as the suggests SdBusSubmitRequest() is a wrapper function that in turn submit an IRP request?