Solution if IRP_MN_MOUNT_VOLUME is not called

NTFSD
1

Hello,
I found a parry to bypass a windows kernel bug (only when a external storage disk is connected) about
sending irp IRP_MN_MOUNT_VOLUME.
If the IRP_MN_MOUNT_VOLUME is not called THEN Is it correct to modify the structure VPB-> DeviceObject directly in the deviceobject DCB ?
I mean creating a VPB disk deviceobject with API function kernel ‘IoCreateDevice’ and setting DeviceObject-> VPB-> DeviceObject (in a deviceobject DCB).
This method can this work good ???
Frankly I have only this solution.

Thank

2

To begin with, I highly doubt it is a problem in Windows with your
control device not getting sent the mount request after you return
unrecognized_volume. I have implemented many file systems, layered file
systems, etc and mount processing has always worked as expected.

Have you enabled FileSpy on the control device for NTFS, FAT and your
control device? And note that the mount calls, if I recall, are called
in the order that the file system registration occurred. So, for
example, for a FAT thumb drive, if FAT registered before you then it
would be called to mount the volume before your fs would be called. And
if it successfully mounts the volume, returning status_success, then
your fs will not be called.

Pete

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

------ Original Message ------
From: xxxxx@gmail.com
To: “Windows File Systems Devs Interest List”
Sent: 8/17/2017 10:17:33 AM
Subject: [ntfsd] Solution if IRP_MN_MOUNT_VOLUME is not called

>Hello,
>I found a parry to bypass a windows kernel bug (only when a external
>storage disk is connected) about
>sending irp IRP_MN_MOUNT_VOLUME.
>If the IRP_MN_MOUNT_VOLUME is not called THEN Is it correct to modify
>the structure VPB-> DeviceObject directly in the deviceobject DCB ?
>I mean creating a VPB disk deviceobject with API function kernel
>‘IoCreateDevice’ and setting DeviceObject-> VPB-> DeviceObject (in a
>deviceobject DCB).
>This method can this work good ???
>Frankly I have only this solution.
>
>Thank
>
>—
>NTFSD is sponsored by OSR
>
>
>MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>software drivers!
>Details at http:
>
>To unsubscribe, visit the List Server section of OSR Online at
>http:</http:></http:>

3

I tested filespy
I view STATUS STATUS_INVALID_DEVICE_REQUEST in column IRP_MJ_FILE_SYSTEM/…
And that I never return these !!.
It’s kernel windows that returns (STATUS_INVALID_DEVICE_REQUEST) without
call my driver.

4

I forgot says about filespy in “show minifilter” , i don’t view my volume.