Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Upcoming OSR Seminars | ||
---|---|---|
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
Kernel Debugging | 9-13 Sept 2024 | Live, Online |
Developing Minifilters | 15-19 July 2024 | Live, Online |
Internals & Software Drivers | 11-15 Mar 2024 | Live, Online |
Writing WDF Drivers | 20-24 May 2024 | Live, Online |
Comments
raw disk or partition there is the raw file system attached. Depending on
how you coded things the filter manager will be called.
-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of
[email protected] [email protected]
Sent: Saturday, July 08, 2017 2:27 PM
To: Windows File Systems Devs Interest List <[email protected]>
Subject: [ntfsd] Instancesetup call
Hi folks
Why if Im opening physicadeviceX fltmgr is calling instance setup? Isnt it
supposed to be called when minifilter is going to be attached to fsd stack?
When there is open do physical device then this is disk level not fsd isnt
it like that?
Thanks a lot
---
NTFSD is sponsored by OSR
MONTHLY seminars on crash dump analysis, WDF, Windows internals and software
drivers!
Details at <http://www.osr.com/seminars>
To unsubscribe, visit the List Server section of OSR Online at
<http://www.osronline.com/page.cfm?name=ListServer>
I'm talking about accessing disk like this:
HANDLE disk = CreateFile(L"\\\\.\\PhysicalDrive0", GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL);
So I'm using symlink to \device\harddisk0\dr0.
1. Where I can read something about RAW DISK. When it is attached etc?
2. What you mean when you wrote "Depending on how you coded things the filter manager will be called"? I mean I understand I'm always talking about access to disk, but not really tracking operation of it. Are there any other methods to open drive expect direct open of DO to which I could send IOCTL?
thank you
1. Where I can read something about RAW DISK. When it is attached etc?
</QUOTE>
Windows source code only.
Actually, there is nothing big about RAW. This is a rudimentary file system driver that initializes file objects and pass through IO to the volume or disk class driver.
RAW is mounted when a create request is issued to a disk device object or a volume device object without mounted file system driver. When the last file object is closed the RAW is unmounted.
<QUOTE>
Are there any other methods to
open drive expect direct open of DO to which I could send IOCTL?
</QUOTE>
No, if IOCTL is sent from a user mode application. You need a handle.