How to get the boot-volume in a minifilter?

NTFSD
1

I need to find out the boot volume (not system volume) in my minifilter.
In some older post on the list i read that in the device-object there is a DO_SYSTEM_BOOT_PARTITION flag indicating the boot-volume

So i tried (without luck) the following in my instance setup routine:

TmpStatus=FltGetDeviceObject(FltObjects->Volume, &DevObj);
if(NT_SUCCESS(TmpStatus)){
bootdevice = BooleanFlagOn( DevObj->Flags,DO_SYSTEM_BOOT_PARTITION);
…

So does anyone know how to correctly find out the boot volume? Or is there a registry key indicating the boot volume?

Thank you!

Klaus

2

I think you need to look at the device, not the volume. I’ve not tried it,
but this should work.

TmpStatus=FltGetDiskDeviceObject(FltObjects->Volume, &DevObj);
if(NT_SUCCESS(TmpStatus)){
bootdevice = BooleanFlagOn( DevObj->Flags,DO_SYSTEM_BOOT_PARTITION);

Rod

wrote in message news:xxxxx@ntfsd…
>I need to find out the boot volume (not system volume) in my minifilter.
> In some older post on the list i read that in the device-object there is a
> DO_SYSTEM_BOOT_PARTITION flag indicating the boot-volume
>
> So i tried (without luck) the following in my instance setup routine:
>
> TmpStatus=FltGetDeviceObject(FltObjects->Volume, &DevObj);
> if(NT_SUCCESS(TmpStatus)){
> bootdevice = BooleanFlagOn( DevObj->Flags,DO_SYSTEM_BOOT_PARTITION);
> …
>
> So does anyone know how to correctly find out the boot volume? Or is there
> a registry key indicating the boot volume?
>
> Thank you!
>
> Klaus
>
>
>

3

you could use IoGetBootDiskInformation in your driver entry, and then
compare the signatures from the drive layout structure for that disk. you
can then also compare the extents of the volume to see if you volume is the
boot or system.

“Rod Widdowson” wrote in message
news:xxxxx@bay0-mc4-f16.bay0.hotmail.com…
>I think you need to look at the device, not the volume. I’ve not tried it,
> but this should work.
>
> TmpStatus=FltGetDiskDeviceObject(FltObjects->Volume, &DevObj);
> if(NT_SUCCESS(TmpStatus)){
> bootdevice = BooleanFlagOn( DevObj->Flags,DO_SYSTEM_BOOT_PARTITION);
>
> Rod
>
> wrote in message news:xxxxx@ntfsd…
>>I need to find out the boot volume (not system volume) in my minifilter.
>> In some older post on the list i read that in the device-object there is
>> a
>> DO_SYSTEM_BOOT_PARTITION flag indicating the boot-volume
>>
>> So i tried (without luck) the following in my instance setup routine:
>>
>> TmpStatus=FltGetDeviceObject(FltObjects->Volume, &DevObj);
>> if(NT_SUCCESS(TmpStatus)){
>> bootdevice = BooleanFlagOn( DevObj->Flags,DO_SYSTEM_BOOT_PARTITION);
>> …
>>
>> So does anyone know how to correctly find out the boot volume? Or is
>> there
>> a registry key indicating the boot volume?
>>
>> Thank you!
>>
>> Klaus
>>
>>
>>
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@hotmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

4

IoGetBootDiskInformation will only succeed if called during the initialization of boot drivers and fails with STATUS_TOO_LATE if called after BootDriverReinitialization is complete.

…John

5

which makes sense doesn’t it? what if someone changes the boot device after you boot. so the only really valid time is during boot.

------------------- Greg Jacklin Email: xxxxx@hotmail.com CELL: 760.672.4727 -------------------

Date: Thu, 14 Jun 2007 11:45:45 -0400> From: xxxxx@msn.com> To: xxxxx@lists.osr.com> Subject: RE:[ntfsd] How to get the boot-volume in a minifilter?> > IoGetBootDiskInformation will only succeed if called during the initialization of boot drivers and fails with STATUS_TOO_LATE if called after BootDriverReinitialization is complete.> > …John > > —> Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17\> > You are currently subscribed to ntfsd as: xxxxx@hotmail.com> To unsubscribe send a blank email to xxxxx@lists.osr.com