unable to identify system/boot partition

NTDEV
1

Hi all,

I have a volume upper filter driver.
In adddevice routine of driver i want to know about system volume to which i am attaching.
For this i am checking for flags in physicalobject that we got in adddevice for
DO_SYSTEM_BOOT_PARTITION flag.

I gone through the threads and i found that

if(DeviceObject->Vpb && (DeviceObject->Vpb->RealDevice->Flags &
DO_SYSTEM_BOOT_PARTITION))
should solve my problem.

But i am not getting this condition TRUE at any deviceobject in adddevice.
I try for deviceobject->flags instead of realdevice->flags, but condition is still not satisfying.
How should i move further?
DO_SYSTEM_BOOT_PARTITION flag identifies boot partition/volume or system
partition/volume?

Any other way to retrieve same thing?

Thanks in anticipation.

2

> In adddevice routine of driver i want to know about system volume to which i am attaching.

For this i am checking for flags in physicalobject that we got in
adddevice for DO_SYSTEM_BOOT_PARTITION flag.

The very name DO_SYSTEM_BOOT_PARTITION strongly suggests that it applies to a physical partition (PDO for which is created by Disk.Sys) and not to the logical volume that is mounted on it (PDO for which is created by FTdisk.Sys). In other words, you are on the wrong stack. This is why you never see this flag -
it is in PDO for partition object and not for the volume one that is passed to your AddDevice() . Concerning DeviceObject->Vpb, AFAIK, this field applies only to FS drivers, but you filter storage and not FS…

Anton Bassov

3

It should be set for the RealDeviceObject, but not until
IopMarkBootPartition has been called during OS initialization. Either
you are looking at the wrong device object or you are looking too early
in the boot process.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@hotmail.com
Sent: Thursday, March 20, 2008 3:32 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] unable to identify system/boot partition

Hi all,

I have a volume upper filter driver.
In adddevice routine of driver i want to know about system volume to
which i am attaching.
For this i am checking for flags in physicalobject that we got in
adddevice for
DO_SYSTEM_BOOT_PARTITION flag.

I gone through the threads and i found that

if(DeviceObject->Vpb && (DeviceObject->Vpb->RealDevice->Flags &
DO_SYSTEM_BOOT_PARTITION))
should solve my problem.

But i am not getting this condition TRUE at any deviceobject in
adddevice.
I try for deviceobject->flags instead of realdevice->flags, but
condition is still not satisfying.
How should i move further?
DO_SYSTEM_BOOT_PARTITION flag identifies boot partition/volume or system

partition/volume?

Any other way to retrieve same thing?

Thanks in anticipation.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

4

> Either you are looking at the wrong device object or you are looking too early in the boot process.

I am almost 100% sure the former is the case here…

Anton Bassov

5

> The very name DO_SYSTEM_BOOT_PARTITION strongly suggests that it

applies to a physical partition (PDO for which is created by Disk.Sys) and not
to
the logical volume that is mounted on it (PDO for which is created by
FTdisk.Sys).

DO_SYSTEM_BOOT_PARTITION is set on HarddiskVolume%d PDOs too.

Actually, it is set after the stack is initialized when the \SystemRoot
symlink is created.

AddDevice is too early.

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

6

Thanks for your response!

Is there any other way out from which i can get system volume?
I think systemroot field in registry will gives system volume information. But how can i convert c: to \device\harddiskX ?

I mean to say how will i convert drive letter to device names (\device\harddiskvolumexx)?
Thanks in anticipation!

7

> how can i convert c: to \device\harddiskX ?

This one is really easy - this is what ZwQuerySymbolicLink( )is for. IIRC, it is exported by both ntoskrnl.exe and ntdll.dll, so that it is callable from both kernel and user modes (UM QueryDosDeviceName() from kernel32.dll is just a wrapper for ZwQuerySymbolicLink() in ntdll.dll)

Anton Bassov

8

> Is there any other way out from which i can get system volume?

I usually do a ZwOpen of \SystemRoot in driver startup and grab the device
object from that.

/Rod

9

How can i convert from \device\harddisk0\partition1 to \device\harddiskvolume1?
Is there any API which do the job?

10

Only by listing all volumes (MOUNTDEV_MOUNTED_DEVICE_GUID) and matching the
DiskNumber reported by the volume (IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS) and by
the partition (IOCTL_STORAGE_GET_DEVICE_NUMBER).

Sorry, volume can be a software RAID which has several partitions in it.

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

wrote in message news:xxxxx@ntdev…
>
> How can i convert from \device\harddisk0\partition1 to
\device\harddiskvolume1?
> Is there any API which do the job?
>