BOOLEAN MiniSecondary_Ioctl ( IN PSECONDARY Secondary, IN OUT PFLT_CALLBACK_DATA Data ) { NTSTATUS status; //PIO_STACK_LOCATION iopb = IoGetCurrentIrpStackLocation( Irp ); PFLT_IO_PARAMETER_BLOCK iopb = Data->Iopb; //KEVENT waitEvent; ULONG ioctlCode = iopb->Parameters.DeviceIoControl.Common.IoControlCode; ULONG devType = DEVICE_TYPE_FROM_CTL_CODE(ioctlCode); UCHAR function = (UCHAR)((ioctlCode & 0x00003FFC) >> 2); PVOID inputBuffer, outputBuffer; IO_STATUS_BLOCK ioStatusBlock; SPY_LOG_PRINT( LFS_DEBUG_SECONDARY_TRACE, ("Secondary_Ioctl: IRP_MJ_DEVICE_CONTROL Entered, deviceType = %d, function = %d IOCTL_VOLUME_BASE = %d, MOUNTDEVCONTROLTYPE = %d\n", devType, function, IOCTL_VOLUME_BASE, MOUNTDEVCONTROLTYPE) ); if (IS_WINDOWS2K() && Secondary->LfsDeviceExt->DiskDeviceObject == NULL) { NDASFS_ASSERT( LFS_BUG ); return FLT_PREOP_SUCCESS_NO_CALLBACK; } if (IS_WINDOWSXP_OR_LATER() && Secondary->LfsDeviceExt->MountVolumeDeviceObject == NULL) { NDASFS_ASSERT( LFS_BUG ); return FLT_PREOP_SUCCESS_NO_CALLBACK; } if (ioctlCode == IOCTL_VOLUME_SET_GPT_ATTRIBUTES) { Data->IoStatus.Status = STATUS_NOT_SUPPORTED; Data->IoStatus.Information = 0; return FLT_PREOP_COMPLETE; } SPY_LOG_PRINT( LFS_DEBUG_LFS_TRACE, ("Open files from secondary: LfsDeviceExt = %p, iopb->MajorFunction = %x, iopb->MinorFunction = %x\n", Secondary->LfsDeviceExt, iopb->MajorFunction, iopb->MinorFunction) ); inputBuffer = MinispyMapInputBuffer( iopb, Data->RequestorMode ); outputBuffer = MinispyMapOutputBuffer( iopb, Data->RequestorMode ); status = LfsFilterDeviceIoControl( IS_WINDOWS2K() ? Secondary->LfsDeviceExt->DiskDeviceObject : Secondary->LfsDeviceExt->MountVolumeDeviceObject, ioctlCode, inputBuffer, iopb->Parameters.DeviceIoControl.Common.InputBufferLength, outputBuffer, iopb->Parameters.DeviceIoControl.Common.OutputBufferLength, &ioStatusBlock.Information ); SPY_LOG_PRINT( LFS_DEBUG_SECONDARY_ERROR, ("%s: status = %x\n", __FUNCTION__, status) ); Data->IoStatus.Status = status; Data->IoStatus.Information = ioStatusBlock.Information; return FLT_PREOP_COMPLETE; }
BOOLEAN IsNetDiskPartition( IN PDEVICE_OBJECT DiskDeviceObject, OUT PLOCAL_NETDISK_PARTITION_INFO LocalNetDiskPartitionInfo ) { BOOLEAN BRet; LSMPIOCTL_PRIMUNITDISKINFO PrimUnitDisk; //PARTITION_INFORMATION_EX partitionInformationEx; PARTITION_INFORMATION partitionInformation; NTSTATUS statusPartInfo; PDEVICE_OBJECT ScsiportAdapterDeviceObject; // // track ScsiPort Device Object // ScsiportAdapterDeviceObject = NULL; BRet = GetScsiportAdapter(DiskDeviceObject, &ScsiportAdapterDeviceObject); if(BRet != TRUE) { SPY_LOG_PRINT( LFS_DEBUG_LFS_ERROR, ("IsNetDiskPartition: GetScsiportAdapter() failed.\n")); return FALSE; } BRet = GetPrimaryUnitDisk( ScsiportAdapterDeviceObject, &PrimUnitDisk ); if(BRet == TRUE && LocalNetDiskPartitionInfo) { LocalNetDiskPartitionInfo->DesiredAccess = PrimUnitDisk.UnitDisk.DesiredAccess; LocalNetDiskPartitionInfo->GrantedAccess = PrimUnitDisk.UnitDisk.GrantedAccess; LocalNetDiskPartitionInfo->MessageSecurity = FALSE; LocalNetDiskPartitionInfo->RwDataSecurity = FALSE; RtlCopyMemory(&LocalNetDiskPartitionInfo->BindAddress, &PrimUnitDisk.UnitDisk.BindingAddress , sizeof(LPX_ADDRESS)); LocalNetDiskPartitionInfo->NetDiskPartitionInfo.EnabledTime.QuadPart = PrimUnitDisk.EnabledTime.QuadPart; RtlCopyMemory(&LocalNetDiskPartitionInfo->NetDiskPartitionInfo.NetDiskAddress, &PrimUnitDisk.UnitDisk.NetDiskAddress, sizeof(LPX_ADDRESS) ); LocalNetDiskPartitionInfo->NetDiskPartitionInfo.UnitDiskNo = PrimUnitDisk.UnitDisk.UnitDiskId; RtlCopyMemory( LocalNetDiskPartitionInfo->NetDiskPartitionInfo.UserId, PrimUnitDisk.UnitDisk.UserID, sizeof(LocalNetDiskPartitionInfo->NetDiskPartitionInfo.UserId) ); RtlCopyMemory( LocalNetDiskPartitionInfo->NetDiskPartitionInfo.Password, PrimUnitDisk.UnitDisk.Password, sizeof(LocalNetDiskPartitionInfo->NetDiskPartitionInfo.Password) ); SPY_LOG_PRINT( LFS_DEBUG_LFS_INFO, ("Password: %02X:%02X:%02X:%02X:%02X:%02X:%02X:%02X\n", LocalNetDiskPartitionInfo->NetDiskPartitionInfo.Password[0], LocalNetDiskPartitionInfo->NetDiskPartitionInfo.Password[1], LocalNetDiskPartitionInfo->NetDiskPartitionInfo.Password[2], LocalNetDiskPartitionInfo->NetDiskPartitionInfo.Password[3], LocalNetDiskPartitionInfo->NetDiskPartitionInfo.Password[4], LocalNetDiskPartitionInfo->NetDiskPartitionInfo.Password[5], LocalNetDiskPartitionInfo->NetDiskPartitionInfo.Password[6], LocalNetDiskPartitionInfo->NetDiskPartitionInfo.Password[7])); LocalNetDiskPartitionInfo->SlotNo = PrimUnitDisk.UnitDisk.SlotNo; // // get a starting offset of the partition // #if 0 statusPartInfo = LfsFilterDeviceIoControl( DiskDeviceObject, IOCTL_DISK_GET_PARTITION_INFO_EX, NULL, 0, &partitionInformationEx, sizeof(PARTITION_INFORMATION_EX), NULL ); #endif statusPartInfo = LfsFilterDeviceIoControl( DiskDeviceObject, IOCTL_DISK_GET_PARTITION_INFO, NULL, 0, &partitionInformation, sizeof(PARTITION_INFORMATION), NULL ); if(!NT_SUCCESS(statusPartInfo)) { SPY_LOG_PRINT( LFS_DEBUG_LFS_INFO, ("LFSS: LfsFilterDeviceIoControl() failed.\n")); BRet = FALSE; goto cleanup; } // LocalNetDiskPartitionInfo->NetDiskPartitionInfo.StartingOffset.QuadPart = partitionInformationEx.StartingOffset.QuadPart; LocalNetDiskPartitionInfo->NetDiskPartitionInfo.StartingOffset.QuadPart = partitionInformation.StartingOffset.QuadPart; SPY_LOG_PRINT( LFS_DEBUG_LFS_INFO, ("LFS: IsNetDiskPartition: DesiredAccess=%08x, GrantedAccess=%08x\n", PrimUnitDisk.UnitDisk.DesiredAccess, PrimUnitDisk.UnitDisk.GrantedAccess )); } cleanup: if(ScsiportAdapterDeviceObject) ObDereferenceObject(ScsiportAdapterDeviceObject); return BRet; }
BOOLEAN GetScsiportAdapter( IN PDEVICE_OBJECT DiskDeviceObject, IN PDEVICE_OBJECT *ScsiportAdapterDeviceObject ) { SCSI_ADDRESS ScsiAddress; NTSTATUS ntStatus; UNICODE_STRING ScsiportAdapterName; WCHAR ScsiportAdapterNameBuffer[32]; WCHAR ScsiportAdapterNameTemp[32] = L""; OBJECT_ATTRIBUTES objectAttributes; HANDLE fileHandle = NULL; IO_STATUS_BLOCK IoStatus; PFILE_OBJECT ScsiportDeviceFileObject = NULL; ntStatus = LfsFilterDeviceIoControl( DiskDeviceObject, IOCTL_SCSI_GET_ADDRESS, NULL, 0, &ScsiAddress, sizeof(SCSI_ADDRESS), NULL ); if(!NT_SUCCESS(ntStatus)) { SPY_LOG_PRINT( LFS_DEBUG_LFS_INFO, ("GetScsiportAdapter: LfsFilterDeviceIoControl() failed.\n")); goto error_out; } SPY_LOG_PRINT( LFS_DEBUG_LFS_TRACE, ("GetScsiportAdapter: ScsiAddress=Len:%d PortNumber:%d PathId:%d TargetId:%d Lun:%d\n", (LONG)ScsiAddress.Length, (LONG)ScsiAddress.PortNumber, (LONG)ScsiAddress.PathId, (LONG)ScsiAddress.TargetId, (LONG)ScsiAddress.Lun )); _snwprintf( ScsiportAdapterNameTemp, 32 * sizeof(WCHAR), L"\\Device\\ScsiPort%d", ScsiAddress.PortNumber ); RtlInitEmptyUnicodeString( &ScsiportAdapterName, ScsiportAdapterNameBuffer, sizeof( ScsiportAdapterNameBuffer ) ); RtlAppendUnicodeToString( &ScsiportAdapterName, ScsiportAdapterNameTemp ); InitializeObjectAttributes( &objectAttributes, &ScsiportAdapterName, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL); // // open the file object for the given device // ntStatus = ZwCreateFile( &fileHandle, SYNCHRONIZE|FILE_READ_DATA, &objectAttributes, &IoStatus, NULL, 0, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN, FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0); if (!NT_SUCCESS( ntStatus )) { SPY_LOG_PRINT( LFS_DEBUG_LFS_INFO, ("GetScsiportAdapter: ZwCreateFile() failed.\n")); goto error_out; } ntStatus = ObReferenceObjectByHandle( fileHandle, FILE_READ_DATA, *IoFileObjectType, KernelMode, &ScsiportDeviceFileObject, NULL); if(!NT_SUCCESS( ntStatus )) { SPY_LOG_PRINT( LFS_DEBUG_LFS_INFO, ("GetScsiportAdapter: ObReferenceObjectByHandle() failed.\n")); goto error_out; } *ScsiportAdapterDeviceObject = IoGetRelatedDeviceObject( ScsiportDeviceFileObject ); if(*ScsiportAdapterDeviceObject == NULL) { SPY_LOG_PRINT( LFS_DEBUG_LFS_INFO, ("GetScsiportAdapter: IoGetRelatedDeviceObject() failed.\n")); ObDereferenceObject(ScsiportDeviceFileObject); goto error_out; } ObDereferenceObject(ScsiportDeviceFileObject); ZwClose(fileHandle); ObReferenceObject(*ScsiportAdapterDeviceObject); return TRUE; error_out: *ScsiportAdapterDeviceObject = NULL; if(fileHandle) ZwClose(fileHandle); return FALSE; }
BOOLEAN GetHarddisk( IN PDEVICE_OBJECT DiskDeviceObject, IN PDEVICE_OBJECT *HarddiskDeviceObject ) { NTSTATUS ntStatus; VOLUME_DISK_EXTENTS volumeDiskExtents; UNICODE_STRING harddiskName; WCHAR harddiskNameBuffer[32]; WCHAR harddiskNameTemp[32]; ACCESS_MASK desiredAccess; ULONG attributes; OBJECT_ATTRIBUTES objectAttributes; ULONG fileAttributes; ULONG shareAccess; ULONG createDisposition; ULONG createOptions; IO_STATUS_BLOCK ioStatusBlock; HANDLE harddiskFileHandle; PFILE_OBJECT harddiskDeviceFileObject; ntStatus = LfsFilterDeviceIoControl( DiskDeviceObject, IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS, NULL, 0, &volumeDiskExtents, sizeof(VOLUME_DISK_EXTENTS), NULL ); if(!NT_SUCCESS(ntStatus)) { //ASSERT(LFS_UNEXPECTED); SPY_LOG_PRINT( LFS_DEBUG_LFS_INFO, ("GetScsiportAdapter: LfsFilterDeviceIoControl() failed.\n")); return FALSE; } SPY_LOG_PRINT( LFS_DEBUG_LFS_INFO, ("ntStatus = %x, volumeDiskExtents.Extents[0].DiskNumber = %d\n", ntStatus, volumeDiskExtents.Extents[0].DiskNumber)); _snwprintf( harddiskNameTemp, 32 * sizeof(WCHAR), L"\\DosDevices\\PhysicalDrive%d", //L"\\\\.\\PhysicalDrive%d", volumeDiskExtents.Extents[0].DiskNumber ); RtlInitEmptyUnicodeString(&harddiskName, harddiskNameBuffer, sizeof(harddiskNameBuffer)); RtlAppendUnicodeToString(&harddiskName, harddiskNameTemp); desiredAccess = SYNCHRONIZE|FILE_READ_DATA; attributes = OBJ_KERNEL_HANDLE; attributes |= OBJ_CASE_INSENSITIVE; InitializeObjectAttributes( &objectAttributes, &harddiskName, attributes, NULL, NULL ); fileAttributes = 0; shareAccess = FILE_SHARE_READ | FILE_SHARE_WRITE; createDisposition = FILE_OPEN; createOptions = FILE_SYNCHRONOUS_IO_NONALERT; ntStatus = ZwCreateFile( &harddiskFileHandle, desiredAccess, &objectAttributes, &ioStatusBlock, NULL, fileAttributes, shareAccess, createDisposition, createOptions, NULL, 0 ); if (!NT_SUCCESS( ntStatus )) { //ASSERT(LFS_UNEXPECTED); SPY_LOG_PRINT( LFS_DEBUG_LFS_INFO, ("GetScsiportAdapter: ZwCreateFile() failed.\n")); return FALSE; } if(ntStatus == STATUS_SUCCESS) { ASSERT(ioStatusBlock.Information == FILE_OPENED); } ntStatus = ObReferenceObjectByHandle( harddiskFileHandle, FILE_READ_DATA, *IoFileObjectType, KernelMode, &harddiskDeviceFileObject, NULL ); if(!NT_SUCCESS( ntStatus )) { ASSERT(LFS_UNEXPECTED); SPY_LOG_PRINT( LFS_DEBUG_LFS_INFO, ("GetScsiportAdapter: ObReferenceObjectByHandle() failed.\n")); ZwClose(harddiskFileHandle); return FALSE; } *HarddiskDeviceObject = IoGetRelatedDeviceObject(harddiskDeviceFileObject); if(*HarddiskDeviceObject == NULL) { ASSERT(LFS_UNEXPECTED); SPY_LOG_PRINT( LFS_DEBUG_LFS_INFO, ("GetScsiportAdapter: IoGetRelatedDeviceObject() failed.\n")); ObDereferenceObject(harddiskDeviceFileObject); ZwClose(harddiskFileHandle); return FALSE; } ObReferenceObject(*HarddiskDeviceObject); ObDereferenceObject(harddiskDeviceFileObject); ZwClose(harddiskFileHandle); return TRUE; }
BOOLEAN GetPrimaryUnitDisk( IN PDEVICE_OBJECT diskDeviceObject, OUT PLSMPIOCTL_PRIMUNITDISKINFO PrimUnitDisk ) { NTSTATUS status; PSRB_IO_CONTROL psrbioctl; int outbuff_sz; PLSMPIOCTL_QUERYINFO QueryInfo; PLSMPIOCTL_PRIMUNITDISKINFO tmpPrimUnitDisk; ASSERT(KeGetCurrentIrql() == PASSIVE_LEVEL); outbuff_sz = sizeof(SRB_IO_CONTROL) + sizeof(LSMPIOCTL_QUERYINFO) + sizeof(LSMPIOCTL_PRIMUNITDISKINFO); psrbioctl = (PSRB_IO_CONTROL)ExAllocatePool(NonPagedPool , outbuff_sz); if(psrbioctl == NULL) { SPY_LOG_PRINT( LFS_DEBUG_LFS_INFO, ("STATUS_INSUFFICIENT_RESOURCES\n")); return FALSE; } memset(psrbioctl, 0, sizeof(*psrbioctl)); psrbioctl->HeaderLength = sizeof(SRB_IO_CONTROL); memcpy(psrbioctl->Signature, LANSCSIMINIPORT_IOCTL_SIGNATURE, 8); psrbioctl->Timeout = 10; psrbioctl->ControlCode = LANSCSIMINIPORT_IOCTL_QUERYINFO_EX; psrbioctl->Length = sizeof(LSMPIOCTL_QUERYINFO) + sizeof(LSMPIOCTL_PRIMUNITDISKINFO); QueryInfo = (PLSMPIOCTL_QUERYINFO)((PUCHAR)psrbioctl + sizeof(SRB_IO_CONTROL)); tmpPrimUnitDisk = (PLSMPIOCTL_PRIMUNITDISKINFO)((PUCHAR)psrbioctl + sizeof(SRB_IO_CONTROL)); QueryInfo->Length = sizeof(LSMPIOCTL_QUERYINFO); QueryInfo->InfoClass = LsmpPrimaryUnitDiskInformation; QueryInfo->QueryDataLength = 0; status = LfsFilterDeviceIoControl( diskDeviceObject, IOCTL_SCSI_MINIPORT, psrbioctl, outbuff_sz, psrbioctl, outbuff_sz, NULL ); if(NT_SUCCESS(status)) { if(tmpPrimUnitDisk->Length == sizeof(LSMPIOCTL_PRIMUNITDISKINFO)) { SPY_LOG_PRINT( LFS_DEBUG_LFS_INFO, ("desiredAccess = %x, grantedAccess = %x, GENERIC_WRITE = %x\n", tmpPrimUnitDisk->UnitDisk.DesiredAccess,tmpPrimUnitDisk->UnitDisk.GrantedAccess, GENERIC_WRITE)); RtlCopyMemory(PrimUnitDisk, tmpPrimUnitDisk, sizeof(LSMPIOCTL_PRIMUNITDISKINFO)); } else { SPY_LOG_PRINT( LFS_DEBUG_LFS_ERROR, ("Miniport driver does not match the version.\n")); status = STATUS_REVISION_MISMATCH; } } else { SPY_LOG_PRINT( LFS_DEBUG_LFS_TRACE, ("[LFS] GetPrimaryUnitDisk: Not NetDisk. status = %x\n", status)); } ExFreePool(psrbioctl); if(NT_SUCCESS(status)) return TRUE; else return FALSE; }