I am facing a problem in opening the device handle in user mode. I am a newbie to driver development and right now, I want to dump/visualize the system attributes that the BIOS actually places in RAM at 000F0000h to 000FFFFFh. So, I wrote a simple driver which I am unable to open its handle in user mode application via CreateFile win32 API or WinObj sysInternals tool. Please anyone could help me out as I am stuck in it for last three days.
In driver code, I do not register myself for the PNP dispatch function as I am not handling any device. Also, I created the device object with device type as unknown. I do not know what I have done wrong. Below, is the driver code and driver inf file.
==============
Driver Code
NTSTATUS
DriverEntry(
IN PDRIVER_OBJECT DriverObject,
IN PUNICODE_STRING RegistryPath )
{
DriverObject->DriverExtension->AddDevice = (PDRIVER_ADD_DEVICE)BiosDump_AddDevice;
DriverObject->DriverUnload = (PDRIVER_UNLOAD)BiosDump_Unload;
DriverObject->MajorFunction[IRP_MJ_CREATE] = (PDRIVER_DISPATCH)BiosDump_Create;
DriverObject->MajorFunction[IRP_MJ_CLOSE] = (PDRIVER_DISPATCH)BiosDump_Close;
DriverObject->MajorFunction[IRP_MJ_READ] = (PDRIVER_DISPATCH)BiosDump_Read;
DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = (PDRIVER_DISPATCH)BiosDump_DeviceIO;
DriverObject->MajorFunction[IRP_MJ_CLEANUP] = (PDRIVER_DISPATCH)BiosDump_Cleanup;
return STATUS_SUCCESS;
}
NTSTATUS
BiosDump_AddDevice(
__in struct _DRIVER_OBJECT *DriverObject,
__in struct _DEVICE_OBJECT *PhysicalDeviceObject )
{
NTSTATUS status;
UNICODE_STRING DeviceName;
UNICODE_STRING SymbolicLinkName;
PDEVICE_OBJECT DeviceObject;
RtlInitUnicodeString( &DeviceName, BIOS_DUMP_NT_DEVICE_NAME );
//
// Create Bios Dump device object
//
status = IoCreateDevice( DriverObject, // DriverObject
0, // DeviceExtensionSize
&DeviceName, // DeviceName
FILE_DEVICE_UNKNOWN, // DeviceType
0, // DeviceCharacteristics
FALSE, // Exclusive
&DeviceObject ); // DeviceObject
if( NT_ERROR( status ) )
{
DbgPrint( “ERROR : Failed to create BiosDump device object…%d\n”, status );
return status;
}
//
// Set the device object flags
//
DeviceObject->Flags |= DO_DIRECT_IO;
RtlInitUnicodeString( &SymbolicLinkName, BIOS_DUMP_DOS_DEVICE_NAME );
//
// Create symbolic link to the device
//
status = IoCreateSymbolicLink( &SymbolicLinkName, &DeviceName );
if( NT_ERROR( status ) )
{
DbgPrint( “ERROR : Failed to create symbolic link to BiosDump device object…%d\n”, status );
IoDeleteDevice( DeviceObject );
return status;
}
//
// Attach the device object to the device stack
//
if( IoAttachDeviceToDeviceStack( DeviceObject, PhysicalDeviceObject ) == NULL )
{
DbgPrint( “ERROR : Failed to attach BiosDump device object to device stack\n” );
IoDeleteSymbolicLink( &SymbolicLinkName );
IoDeleteDevice( DeviceObject );
return status;
}
//
// Clear the device initialization flag
//
DeviceObject->Flags &= ~(DO_DEVICE_INITIALIZING);
return STATUS_SUCCESS;
}
===========================================
Driver INF
;--------------------------------------------------------------------
; Version section
;--------------------------------------------------------------------
[Version]
Signature = “$WINDOWS NT$”
Class = System
ClassGuid = {4d36e97d-e325-11ce-bfc1-08002be10318}
Provider = %EMS%
DriverVer = 07/01/2007,1.0.0.1
;--------------------------------------------------------------------
; DestinationDirs section
;--------------------------------------------------------------------
[DestinationDirs]
DefaultDestDir = 12
;--------------------------------------------------------------------
; SourceDisksNames section
;--------------------------------------------------------------------
[SourceDisksNames]
1 = %Disk1%
;--------------------------------------------------------------------
; SourceDisksFiles section
;--------------------------------------------------------------------
[SourceDisksFiles]
BiosDump.sys = 1
;--------------------------------------------------------------------
; Manufacturer section
;--------------------------------------------------------------------
[Manufacturer]
%EMS% = BiosDumpModelSection,NTx86
[BiosDumpModelSection.NTx86]
%BiosDump% = BiosDumpDDInstall, BiosDump
[BiosDumpDDInstall]
CopyFiles = @BiosDump.sys
[BiosDumpDDInstall.Services]
AddService = %BiosDump%,0x00000002,BiosDumpServiceInstallSection
[BiosDumpServiceInstallSection]
DisplayName = %BiosDump%
Description = %BiosDumpDesc%
ServiceType = 1 ; SERVICE_KERNEL_DRIVER
StartType = 1 ; SERVICE_SYSTEM_START
ErrorControl = 1 ; SERVICE_ERROR_NORMAL
ServiceBinary = %12%\BiosDump.sys
;--------------------------------------------------------------------
; Strings section
;--------------------------------------------------------------------
[Strings]
EMS = “EMS”
Disk1 = “HardDisk 0”
BiosDump = “BiosDump”
BiosDumpDesc = “Bios Dump Utility”