阅读:2619回复:0
求助 内核中使用IOCTL_STORAGE_QUERY_PROPERTY区分USB与磁盘卷
将我的过滤驱动文件SYS 挂载在{71A27CDD-812A-11D0-BEC7-08002BE2092F}存储卷类下
在adddevice函数中对于过滤到的设备发送IOCTL_STORAGE_QUERY_PROPERTY以区分是磁盘卷还是USB卷 但是函数始终不成功 返回参数失败 c00000EF 代码如下NTSTATUS AddDevice( IN PDRIVER_OBJECT DriverObject, IN PDEVICE_OBJECT PhysicalDeviceObject) { IsUSBVolume = FALSE; QueryDeviceType(PhysicalDeviceObject ,&IsUSBVolume) ....... } QueryDeviceType用的是驱网的代码 就是新建一个IRP 发送出去查询_STORAGE_QUERY_PROPERTY 但是在IoCallDriver老是返回失败 不知道什么原因 代码如下 NTSTATUS QueryDeviceType(PDEVICE_OBJECT DiskDeviceObject,BOOL* IsUSBVolume) { NTSTATUS status = STATUS_UNSUCCESSFUL; KEVENT WaitEvent; STORAGE_PROPERTY_QUERY Query; PIRP NewIrp; UCHAR pBuffer[sizeof(STORAGE_DEVICE_DESCRIPTOR)+512]; PSTORAGE_DEVICE_DESCRIPTOR Descriptor; IO_STATUS_BLOCK IoStatus; PAGED_CODE(); NewIrp = IoBuildDeviceIoControlRequest(IOCTL_STORAGE_QUERY_PROPERTY, DiskDeviceObject, (PVOID)&Query, sizeof(STORAGE_DEVICE_DESCRIPTOR), (PVOID)pBuffer, sizeof(STORAGE_DEVICE_DESCRIPTOR) * 4, FALSE, &WaitEvent, &IoStatus); if (NULL == NewIrp) // can't create new irp { DbgPrint(" BusTypeUnknown \n"); return status; } status = IoCallDriver(DiskDeviceObject, NewIrp); if (status == STATUS_PENDING) { status = KeWaitForSingleObject(&WaitEvent, Executive, KernelMode, FALSE, NULL); status = IoStatus.Status; } if (!NT_SUCCESS(status)) { DbgPrint(" BusTypeUnknown \n"); return status; } Descriptor = (PSTORAGE_DEVICE_DESCRIPTOR)pBuffer; if(Descriptor->BusType == BusTypeUsb) { DbgPrint("GetStorageDeviceBusType SUCCEED: %d DevType:%x \n ", Descriptor->BusType, DiskDeviceObject->DeviceType); *IsUSBVolume = TRUE; } return status; } |
|