Hello All,
Do anybody know how to find PDEVICE_OBJECT of the disk PDO object having the
PDEVICE_OBJECT of one of the disk partition (e.g. ‘\Disk\HARDDISKVOLUME1’)?
I tried to send IOCTL_STORAGE_GET_DEVICE_NUMBER for partition object, but it
returns STATUS_NO_SUCH_DEVICE.
Minimal target OS is Windows 2000 SP3.
Thank you in advance,
Al
Send IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS instead of
IOCTL_STORAGE_GET_DEVICE_NUMBER, it will return 1 extent with a disk number in
it.
–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
wrote in message news:xxxxx@ntfsd…
> Hello All,
>
> Do anybody know how to find PDEVICE_OBJECT of the disk PDO object having the
> PDEVICE_OBJECT of one of the disk partition (e.g. ‘\Disk\HARDDISKVOLUME1’)?
>
> I tried to send IOCTL_STORAGE_GET_DEVICE_NUMBER for partition object, but it
> returns STATUS_NO_SUCH_DEVICE.
>
> Minimal target OS is Windows 2000 SP3.
>
> Thank you in advance,
>
> Al
>
>
Hi Maxim,
Thank you very much for the help. However, it will return me only Disk number. How I’m getting the PDEVICE_OBJECT of PDO? Should I consider, that any driver will create object with name ‘\Disk\HardDiskX’ (where X is disk number) and reference object by name or there is more direct way to get PDO?
More generally, how partition objects created by FtDisk and disk object (created by drivers like ATAPI, USB etc) are connected? How you would enumerate partition objects from disk object and vice versa?
With best regards,
Al
Have you run DeviceTree? How about DiskView? This is mostly storage
related and not filesystems. Study the source for disk.sys and see how it
interfaces with the mount manager. Debug a boot where you have two hard
drives. The first contains the OS. The second has several partitions.
Watch how ftdisk, mount manager, and the partition manager access that
physical drive and the volumes that are present. If one of the partitions
is formatted with FAT, then you can also watch and see how fastfat gets
involved.
wrote in message news:xxxxx@ntfsd…
> Hi Maxim,
>
> Thank you very much for the help. However, it will return me only Disk
> number. How I’m getting the PDEVICE_OBJECT of PDO? Should I consider, that
> any driver will create object with name ‘\Disk\HardDiskX’ (where X is disk
> number) and reference object by name or there is more direct way to get
> PDO?
>
> More generally, how partition objects created by FtDisk and disk object
> (created by drivers like ATAPI, USB etc) are connected? How you would
> enumerate partition objects from disk object and vice versa?
>
> With best regards,
>
> Al
>
>
>
Hi David,
Thank you very much for your reply. Yes, I understand how to crack Ftdisk.
My question is different: What is a “legal” (“standard”, “documented” or whatsoever) method for get connection between PDO and partitions.
With best regards,
Al
By convention if the disk number from IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS
is N the disk device has a symbolic link \Device\HarddiskN\DR0 and a Win32
visible symbolic link at \.\PhysicalDiskN.
On Nov 13, 2007 5:09 PM, wrote:
> Hi Maxim,
>
> Thank you very much for the help. However, it will return me only Disk
> number. How I’m getting the PDEVICE_OBJECT of PDO? Should I consider, that
> any driver will create object with name ‘\Disk\HardDiskX’ (where X is disk
> number) and reference object by name or there is more direct way to get PDO?
>
>
> More generally, how partition objects created by FtDisk and disk object
> (created by drivers like ATAPI, USB etc) are connected? How you would
> enumerate partition objects from disk object and vice versa?
>
> With best regards,
>
> Al
>
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@hollistech.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
–
Mark Roddy
> Thank you very much for the help. However, it will return me only Disk
number.
How I’m getting the PDEVICE_OBJECT of PDO?
\.\PhysicalDrive%d is a symlink to this PDO, substitute the disk number there.
Another way: get all Physical Disk device interfaces, open each of them,
call IOCTL_STORAGE_GET_DEVICE_NUMBER, and match to the number you learned from
the FtDisk’s volume device name.
More generally, how partition objects created by FtDisk and disk object
(created
by drivers like ATAPI, USB etc) are connected?
FtDisk is the so-called “volume manager”. Its device objects form a
separate PnP subtree not related to the disk’s subtree in any way. They are all
children of \Device\FtControl PDO, and \Device\FtControl PDO is created using
IoReportDetectedDevice.
So, you cannot use PnP to correlate the FtDisk’s \Device\HarddiskVolume%d
to, say, \Device\Harddisk%d\Partition%d.
Nevertheless, FtDisk is creating the \Device\HarddiskVolume%d device
objects on the basis of arrival notifications of the partition device objects
from PartMgr, and yes, FtDisk maintains the internal association (not a PnP
one) between \Device\HarddiskVolume%d and \Device\Harddisk%d\Partition%d.
Actually, read/write/IOCTL_DISK_xxx/IOCTL_STORAGE_xxx arrived to
\Device\HarddiskVolume%d are passed by FtDisk down to
\Device\Harddisk%d\Partition%d.
To discover this relation, query the disk number from
\Device\HarddiskVolume%d and then match to the disk/partition stacks.
–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
Hi Maxim,
Thank you very much for detailed explanation. I will follow your recommendations. So far I understood you - there is no any direct way for get an association PDO and his volumes. That’s kind of fanny since FtDisk has such information.
I have two more small questions:
I. Assuming that MBR of the disk was modified, what is a best way to force Disk.sys to re-enumerate partitions (w/o simulate surprise removal / reconnection of the drive)?
II. On test system I see following stack:
If partitions are physically enumerated by Disk.sys and Volumes are created by FtDisk, what exactly
PartMgr.sys is doing in the middle?
> I. Assuming that MBR of the disk was modified, what is a best way to force
Disk.sys to re-enumerate partitions (w/o simulate surprise removal /
reconnection
of the drive)?
IOCTL_DISK_UPDATE_PROPERTIES
–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
Thank you very much, Maxim.