How to know Request is from OS Installation in Storage driver

During win7 installation, I have to load Storage driver in load driver option, How storage driver which is loaded by me will get to know whether request is from windows installation or OS booted from secondary disk.

Why do you need to know that?

We are observing a different behavior in series of PNP IRPs received by our Storage Port Upper Filter driver during Win 7 installation (load using LoadDriver option) and when used as a secondary disk. Hence we want to track these and accordingly modify our code flow. Is there any registry key or parameters in driver dispatch function, through which we could get a hint about loading environment such as setup, secondary disk, etc., The same behavior is not observed in Win 8.1/10.

What are the two different sequences of PNP irps? A specific sequence of pnp irps does not indicate a higher level environment like setup. As long as the sequences conform to valid state transitions, you should handle them and not do anything different based on what you INFER is going on.

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Thursday, March 9, 2017 11:05 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] How to know Request is from OS Installation in Storage driver

We are observing a different behavior in series of PNP IRPs received by our Storage Port Upper Filter driver during Win 7 installation (load using LoadDriver option) and when used as a secondary disk. Hence we want to track these and accordingly modify our code flow. Is there any registry key or parameters in driver dispatch function, through which we could get a hint about loading environment such as setup, secondary disk, etc., The same behavior is not observed in Win 8.1/10.


NTDEV is sponsored by OSR

Visit the list online at: http:

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
Details at http:

To unsubscribe, visit the List Server section of OSR Online at http:</http:></http:></http:>

The filter driver attaches a device object (Fake PDO) to the Miniport’ PDO received in IRP_MN_QUERY_DEVICE_RELATIONS for filter DO, so that we can capture the IRP_MN_QUERY_ID for Miniport PDO. We are able to capture it (and we do some modification in ID reported) and after that we are getting IRP_MN_REMOVE_DEVICE for Fake PDO. After that the stack is enumerated without our Fake PDO. But the same is not observed in Win 7 (secondary), Win 8.1/10. Hence we would like to know the win 7 installation case and handle this special case internally.

“The filter driver attaches a device object (Fake PDO) to the Miniport’ PDO
received in IRP_MN_QUERY_DEVICE_RELATIONS for filter DO, so that we can capture
the IRP_MN_QUERY_ID for Miniport PDO. We are able to capture it (and we do some
modification in ID reported) and after that we are getting IRP_MN_REMOVE_DEVICE
for Fake PDO.”

That’s a bit convoluted solution. Why do you need that? If you want to capture IRPs going to Miniport’s PDO, you just need to attach a FilterDO on top of it when you first see it in QUERY_DEVICE_RELATIONS (note that you can see BusRelation requests returning the same PDO multiple times). Fake PDO is a wrong solution.

Alex,

Sorry for the terminology “PDO” used. Actually, we just created a DO and attached to Miniport’s PDO and then we could get the QUERY_DEVICE_RELATIONS. Still we could not find out clear way to find out installation scenario.

You need to describe exactly what sequence you expect and what sequence you see, and what problem it is causing for you. If you want to tell a future boot disk from non-boot disk by the IRP sequence, I’m afraid you can’t do that reliably.