i use IoRegisterFsRegistrationChange to attach to all file system and filter IRP_MJ_FILE_SYSTEM_CONTROL so in irp handler i block any device that bus type is usb,
every thing is ok but cant get USB serial number
in STORAGE_DEVICE_DESCRIPTOR
i can get BusType , VendorIdOffset , ProductIdOffset; but what about SerialNumberOffset?
it return nothing
is any trick or bug ?
and : in IRP_MJ_FILE_SYSTEM_CONTROL we have tow device
IrpSp->Parameters.MountVolume.Vpb->RealDevice
IrpSp->Parameters.MountVolume.DeviceObject
both of them get same data , so i must send custom created IRP to which?
now i use
NTSTATUS QueryDeviceSerial (PDEVICE_OBJECT DiskDeviceObject)/*code without optimize */
{
NTSTATUS Status = STATUS_UNSUCCESSFUL;
KEVENT WaitEvent;
PMEDIA_SERIAL_NUMBER_DATA DeviceSerial ;
PIRP NewIrp;
CHAR Buffer[1024];
IO_STATUS_BLOCK IoStatusBlock;
PAGED_CODE ();
KeInitializeEvent ( &WaitEvent, NotificationEvent, FALSE );
NewIrp = IoBuildDeviceIoControlRequest
(
IOCTL_STORAGE_GET_MEDIA_SERIAL_NUMBER,
DiskDeviceObject,
NULL,
0,
Buffer,1024,
FALSE,
& WaitEvent,
& IoStatusBlock
);
if (NULL == NewIrp) // cant create new irp
{
DBGPRINT(("error in IRP build \n "));
return Status;
}
Status = IoCallDriver (DiskDeviceObject, NewIrp);
if (Status == STATUS_PENDING)
{
Status = KeWaitForSingleObject (& WaitEvent, Executive, KernelMode, FALSE, NULL);
Status = IoStatusBlock.Status;
}
if (! NT_SUCCESS (Status))
{
DBGPRINT((“error in send IRP %d 0x%08x\n”, Status, Status));
return Status;
}
DeviceSerial= (PMEDIA_SERIAL_NUMBER_DATA)Buffer;
DBGPRINT((“length %d serial %s \n”,DeviceSerial->SerialNumberLength ,DeviceSerial->SerialNumberData));
DBGPRINT((" ok\n"));
return Status;
}
but it return STATUS_NOT_SUPPORTED in IoCallDriver
after search , find i must send irp to disk device not volume device object
in http://accessch.googlecode.com/svn-history/r24/trunk/drv/main.cpp
it use FltGetDiskDeviceObject to get disk device object
now how get disk device with volume device ?
help
On 11/2/2011 8:54 AM, xxxxx@gmail.com wrote:
every thing is ok but cant get USB serial number
in STORAGE_DEVICE_DESCRIPTOR i can get BusType , VendorIdOffset ,
ProductIdOffset; but what about SerialNumberOffset? it return
nothing
Check with USBview if your USB device has its iSerialNumber set.
USB devices are not required to have serial numbers (iSerialNumber==0).
Then Windows would not have anything to report.
Using a serial number written onto the device during formatting (e.g.
something like a media serial number) is not useful for any so-called
“security application”, because such a number can be forged easily.
Suggestion: only accept devices that contain encrypted data, signed with
a valid certificate from the organization (that tries to enforce this
USB blocking scenario).
I’ve checked multiple USB devices and they all report (iSerialNumber==3), So I Assume they have serial numbers.
Also in device manager properties, I can find the serial number string, but so far I was not able to get it from any documented IRPs.
For example, in Device Instance Path, I have: USB\VID_125F&PID_C95A\AF34F6B625F018
and in Bus Relations, I have: USBSTOR\Disk&Ven_A-DATA&Prod_USB_Flash_Drive&Rev_0.00\af34f6b625f018&0
What i’m looking for is this: af34f6b625f018. And I don’t think this can change by just formatting the media, it’s part of the hardware properties.
Even if that can be forged too, This is not a mission critical security application, I just need this info for simple logging and tracking some USB flash disks.
> For example, in Device Instance Path, I have: USB\VID_125F&PID_C95A\AF34F6B625F018
It is only a convenience Windows puts the serial number in the device instance path. I have seen it replaced with a random unique number, especially if you do a fast unplug/replug while there are open handles on the device.
Tim.
I was just mentioning that path to specify what I’m looking for. This serial number is unique to each hardware, and one should be able to query it just fine! I’ve already done it in Linux Kernel using udev with these same devices and had no problems.
The device instance path might get changed to make the path unique, but it doesn’t change the fact that the device serial number is always the same.
How can I query that before device is mounted when I’m attached to filesystem driver?
On 11/2/2011 12:55 PM, xxxxx@gmail.com wrote:
any body
If this is urgent, please open a support incident with Microsoft.
Otherwise, please read:
http://catb.org/~esr/faqs/smart-questions.html
'm sorry for pushing everybody for an answer. It’s just that I didn’t know what else to do, and this “any body” post was out of desperation.
I just hope someone can answer me, Although I’m still searching the forums and sample codes, but I’m not sure if I can find the answer.
On 11/2/2011 2:36 PM, xxxxx@gmail.com wrote:
'm sorry for pushing everybody for an answer. It’s just that I didn’t
know what else to do, and this “any body” post was out of
desperation.
Please understand: you can’t push anyone for an answer here.
OSR is not a part of Microsoft Support.
You can open a support incident with Microsoft, pay money, and then
you are entitled to push them for an answer.
I just hope someone can answer me,
What would most likely help - yourself, and others who try to help you -
is if you could write up a concise summary of your problem and question,
complete with example code and information about the exact environment
where it occurs, which ways you tried, and the results.
Not a long wordy essay, but an accurate and concise problem report.
Maybe someone in a different timezone will get up in a few hours and can
answer your question. Maybe nobody here knows the answer.
Good luck.
>I was just mentioning that path to specify what I’m looking for. This serial number is unique to each
hardware, and one should be able to query it just fine!
It is not mandatory! the device is allowed to have no serial number.
More so, it is unique only across 1 vendor/model - other models can have the clashing value.
To query it, you will need to insert the second instance of your filter between USBSTOR and the rest of the USB stack, and send a query URB from there. Not a trivial task to do.
–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com
On Thu, Nov 3, 2011 at 12:21 PM, Maxim S. Shatskih
wrote:
>>I was just mentioning that path to specify what I’m looking for.
>> This serial number is unique to each hardware, and one should be
>> able to query it just fine!
>
> It is not mandatory! the device is allowed to have no serial number.
That is true for generic USB device. For USB Mass Storage Device,
it seems to depend on the device type.
+++++
http://www.usb.org/developers/devclass_docs/usbmassbulk_10.pdf
4.1.1 Serial Number
The iSerialNumber field shall be set to the index of the string descriptor
that contains the serial number. The serial number shall contain at least
12 valid digits, represented as a UNICODE string. The last 12 digits of the
serial number shall be unique to each USB idVendor and idProduct pair.
+++++
So for BOT, it seems to me that serial number is compulsory.
But not for CBI. Section 3.1 says the serial number is not
compulsory.
http://www.usb.org/developers/devclass_docs/usb_msc_cbi_1.1.pdf
Not so sure about UAS.
> More so, it is unique only across 1 vendor/model - other models can
> have the clashing value.
>
> To query it, you will need to insert the second instance of your filter
> between USBSTOR and the rest of the USB stack, and send a query
> URB from there. Not a trivial task to do.
>
Not so sure if this will help or not, but usbdeview seems to be
able to read the USB serial number of USB Mass Storage Device.
http://www.nirsoft.net/utils/usb_devices_view.html
In terms of filter driver, the libusb-win32 filter driver can be used for
reading the USB serial number. But we do not recommend it to
be used as a class filter driver, it usually works as device filter driver
for many device, but can cause problems when used as a class filter
driver. So it is probably not what you want either.
http://sourceforge.net/apps/trac/libusb-win32/wiki
–
Xiaofan