I’ve made a driver to ban the operation of “Change drive letter”.
After creating my device object, I attach it to “\DosDevices\
\MountPointManager” with IoAttachDeviceToDeviceStack
and got all IRP_MJ_DEVICE_CONTROL in dispatch function.
I got all IOCTLs supported by mount point manager like
IOCTL_MOUNTMGR_CREATE_POINT, IOCTL_MOUNTMGR_DELETE_POINTS.
When I test it in my computer, when changing a volume letter, it shows
that DeviceIoControl sequence:
IOCTL_MOUNTMGR_DELETE_POINTS
IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS
…
IOCTL_MOUNTMGR_CREATE_POINT
…
But when I modify my code to ban DELETE_POINTS and CREATE_POINT
operation, it shows that the delete operation was success due to there
is no volume letter for that volume and I can not enter this volume
with the letter “d:” it used to have.
the code to ban the operation I wrote is:
Irp->IoStatus.Status=STATUS_INVALID_PARAMETER;
Irp->IoStatus.Information=0;
IoCompleteRequest(Irp,IO_NO_INCREMENT);
return STATUS_UNSUCCESSFUL;
I don’t know why, anybody helps?thanks a lot!