Is it available to attach usb storage in minifilter?

NTFSD
1

Hi all.
I want to attach a usb storage in minifilter.
In the InstanceSetupCallback routine:
Firstly,I judge the VolumeDeviceType.If the VolumeDeviceType
!= FILE_DEVICE_DISK_FILE_SYSTEM,return STATUS_FLT_DO_NOT_ATTACH.
Secondly,I get the VolumeProperties.
finally,if the flag FILE_REMOVABLE_MEDIA is on
in VolumeProperties->DeviceCharacteristics,return STATUS_SUCCESS to attach
the device.

Following are my codes in detail:

NTSTATUS
ScannerInstanceSetup (
__in PCFLT_RELATED_OBJECTS FltObjects,
__in FLT_INSTANCE_SETUP_FLAGS Flags,
__in DEVICE_TYPE VolumeDeviceType,
__in FLT_FILESYSTEM_TYPE VolumeFilesystemType
)

{
PFLT_VOLUME_PROPERTIES VolumeProperties;
ULONG returnLength;
NTSTATUS status;
UNREFERENCED_PARAMETER( Flags );
UNREFERENCED_PARAMETER( VolumeFilesystemType );

PAGED_CODE();
_asm int 3;
DbgPrint((“InstanceSetup…\n”));
if(FILE_DEVICE_DISK_FILE_SYSTEM != VolumeDeviceType) {
DbgPrint((“The VolumeDeviceType is not FILE_DEVICE_DISK_FILE_SYSTEM\n”));
return STATUS_FLT_DO_NOT_ATTACH;
}
DbgPrint((“The VolumeDeviceType is FILE_DEVICE_DISK_FILE_SYSTEM\n”));
// Allocate the memery for VolumeProperties
VolumeProperties = ( PFLT_VOLUME_PROPERTIES )ExAllocatePoolWithTag (
NonPagedPool,
sizeof(FLT_VOLUME_PROPERTIES) + 512,
FILE_POOL_TAG );
if( NULL == VolumeProperties ) {
DbgPrint((“InstanceSetupCallback: not enough memory to allocate
FLT_VOLUME_PROPERTIES\n” ));
return STATUS_FLT_DO_NOT_ATTACH;
}

returnLength = 0;
status = FltGetVolumeProperties( FltObjects->Volume,
VolumeProperties,
sizeof(FLT_VOLUME_PROPERTIES) + 512,
&returnLength );

if ( !NT_SUCCESS(status) ) {
DbgPrint((“InstanceSetupCallback: Error geting volume properties\n”
));
return STATUS_FLT_DO_NOT_ATTACH;
}

// Judge the information of the volume properties
// _asm int 3;
if(FILE_DEVICE_DISK_FILE_SYSTEM != VolumeProperties->DeviceType) {
DbgPrint((“The VolumeDeviceType is not FILE_DEVICE_DISK_FILE_SYSTEM\n”));
return STATUS_FLT_DO_NOT_ATTACH;
}
DbgPrint((“The VolumeDeviceType is FILE_DEVICE_DISK_FILE_SYSTEM\n”));

// _asm int 3;
if( !FlagOn(FILE_REMOVABLE_MEDIA, VolumeProperties->DeviceCharacteristics) )
{
DbgPrint((“The DeviceCharacteristics is not FILE_REMOVABLE_MEDIA\n”));
return STATUS_FLT_DO_NOT_ATTACH;
}
DbgPrint((“The DeviceCharacteristics is FILE_REMOVABLE_MEDIA\n”));

DbgPrint((“The Device is attached!!!\n”));
return STATUS_SUCCESS;
}

If it is not available??please tell me the reason and give me another
method??Thank you???

2

Unfortunately, sometimes the devices don$B!G(Bt tell the truth - they may be
removable but report themselves as fixed. (To be fair, this is a gray area

  • is an external USB drive that$B!G(Bs being used as the system disk
    $B!H(Bremovable$B!I(B?)

I had to work around this by checking the bus controller and, if USB, assume
it is a removable disk. This involved calling

IoBuildDeviceIoControlRequest( IOCTL_STORAGE_QUERY_PROPERTY, pDevObj,$B!D(B )

and checking for USB or 1394 bus controllers:

bRemovableVolume = ( BusTypeUsb == StorageDescriptor.BusType ||
BusType1394 == StorageDescriptor.BusType );

I did this in the driver InstanceSetup so you can decide if it should be
attached.

HTH,

Ken

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of wingbird chen
Sent: Thursday, July 30, 2009 10:25 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Is it available to attach usb storage in minifilter?

Hi all.

I want to attach a usb storage in minifilter.

In the InstanceSetupCallback routine:

Firstly,I judge the VolumeDeviceType.If the VolumeDeviceType !=
FILE_DEVICE_DISK_FILE_SYSTEM,return STATUS_FLT_DO_NOT_ATTACH.

Secondly,I get the VolumeProperties.

finally,if the flag FILE_REMOVABLE_MEDIA is on in
VolumeProperties->DeviceCharacteristics,return STATUS_SUCCESS to attach the
device.

Following are my codes in detail:

NTSTATUS

ScannerInstanceSetup (

__in PCFLT_RELATED_OBJECTS FltObjects,

__in FLT_INSTANCE_SETUP_FLAGS Flags,

__in DEVICE_TYPE VolumeDeviceType,

__in FLT_FILESYSTEM_TYPE VolumeFilesystemType

)

{

PFLT_VOLUME_PROPERTIES VolumeProperties;

ULONG returnLength;

NTSTATUS status;

UNREFERENCED_PARAMETER( Flags );

UNREFERENCED_PARAMETER( VolumeFilesystemType );

PAGED_CODE();

_asm int 3;

DbgPrint((“InstanceSetup…\n”));

if(FILE_DEVICE_DISK_FILE_SYSTEM != VolumeDeviceType) {

DbgPrint((“The VolumeDeviceType is not
FILE_DEVICE_DISK_FILE_SYSTEM\n”));

return STATUS_FLT_DO_NOT_ATTACH;

}

DbgPrint((“The VolumeDeviceType is FILE_DEVICE_DISK_FILE_SYSTEM\n”));

// Allocate the memery for VolumeProperties

VolumeProperties = ( PFLT_VOLUME_PROPERTIES )ExAllocatePoolWithTag (
NonPagedPool,

sizeof(FLT_VOLUME_PROPERTIES) + 512,

FILE_POOL_TAG );

if( NULL == VolumeProperties ) {

DbgPrint((“InstanceSetupCallback: not enough memory to allocate
FLT_VOLUME_PROPERTIES\n” ));

return STATUS_FLT_DO_NOT_ATTACH;

}

returnLength = 0;

status = FltGetVolumeProperties( FltObjects->Volume,

VolumeProperties,

sizeof(FLT_VOLUME_PROPERTIES) + 512,

&returnLength );

if ( !NT_SUCCESS(status) ) {

DbgPrint((“InstanceSetupCallback: Error geting volume properties\n”
));

return STATUS_FLT_DO_NOT_ATTACH;

}

// Judge the information of the volume properties

// _asm int 3;

if(FILE_DEVICE_DISK_FILE_SYSTEM != VolumeProperties->DeviceType) {

DbgPrint((“The VolumeDeviceType is not
FILE_DEVICE_DISK_FILE_SYSTEM\n”));

return STATUS_FLT_DO_NOT_ATTACH;

}

DbgPrint((“The VolumeDeviceType is FILE_DEVICE_DISK_FILE_SYSTEM\n”));

// _asm int 3;

if( !FlagOn(FILE_REMOVABLE_MEDIA,
VolumeProperties->DeviceCharacteristics) ) {

DbgPrint((“The DeviceCharacteristics is not
FILE_REMOVABLE_MEDIA\n”));

return STATUS_FLT_DO_NOT_ATTACH;

}

DbgPrint((“The DeviceCharacteristics is FILE_REMOVABLE_MEDIA\n”));

DbgPrint((“The Device is attached!!!\n”));

return STATUS_SUCCESS;

}

If it is not available$B!$(Bplease tell me the reason and give me another
method$B!#(BThank you$B!*!*(B

— NTFSD is sponsored by OSR For our schedule of debugging and file system
seminars (including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars To unsubscribe, visit the List Server section of
OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

Don’t forget the specifications for the various hard drives - SCSI, SATA, ATAPI, etc. and how they report removal capability. There are also rules for what is ‘removable’. It something being removable because the ‘media’ is removable or because the drive is removable? SCSI refers to removable medium as one example where the RMB bit in the SCSI Inquiry response only indicates that the medium is removable. Since many external drives such as USB, 1394, eSata, etc. use hard drives made to be able to installed in any system the removal capability indications may not work. Don’t know how to handle eSata since you can only know it is a SATA controller and not if it is external or internal. Even in early versions of Windows NT, removable drives were supported for SCSI.

“Ken Cross” wrote in message news:xxxxx@ntfsd…
Unfortunately, sometimes the devices don$B!G(Bt tell the truth ? they may be removable but report themselves as fixed. (To be fair, this is a gray area ? is an external USB drive that$B!G(Bs being used as the system disk $B!H(Bremovable$B!I(B?)

I had to work around this by checking the bus controller and, if USB, assume it is a removable disk. This involved calling

IoBuildDeviceIoControlRequest( IOCTL_STORAGE_QUERY_PROPERTY, pDevObj,$B!D(B )

and checking for USB or 1394 bus controllers:

bRemovableVolume = ( BusTypeUsb == StorageDescriptor.BusType || BusType1394 == StorageDescriptor.BusType );

I did this in the driver InstanceSetup so you can decide if it should be attached.

HTH,

Ken

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of wingbird chen
Sent: Thursday, July 30, 2009 10:25 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Is it available to attach usb storage in minifilter?

Hi all.

I want to attach a usb storage in minifilter.

In the InstanceSetupCallback routine:

Firstly,I judge the VolumeDeviceType.If the VolumeDeviceType != FILE_DEVICE_DISK_FILE_SYSTEM,return STATUS_FLT_DO_NOT_ATTACH.

Secondly,I get the VolumeProperties.

finally,if the flag FILE_REMOVABLE_MEDIA is on in VolumeProperties->DeviceCharacteristics,return STATUS_SUCCESS to attach the device.

Following are my codes in detail:

NTSTATUS

ScannerInstanceSetup (

in PCFLT_RELATED_OBJECTS FltObjects,

 in FLT_INSTANCE_SETUP_FLAGS Flags,

in DEVICE_TYPE VolumeDeviceType,

 in FLT_FILESYSTEM_TYPE VolumeFilesystemType

)

{

PFLT_VOLUME_PROPERTIES VolumeProperties;

ULONG returnLength;

NTSTATUS status;

UNREFERENCED_PARAMETER( Flags );

UNREFERENCED_PARAMETER( VolumeFilesystemType );

PAGED_CODE();

_asm int 3;

DbgPrint((“InstanceSetup…\n”));

if(FILE_DEVICE_DISK_FILE_SYSTEM != VolumeDeviceType) {

DbgPrint((“The VolumeDeviceType is not FILE_DEVICE_DISK_FILE_SYSTEM\n”));

return STATUS_FLT_DO_NOT_ATTACH;

}

DbgPrint((“The VolumeDeviceType is FILE_DEVICE_DISK_FILE_SYSTEM\n”));

// Allocate the memery for VolumeProperties

VolumeProperties = ( PFLT_VOLUME_PROPERTIES )ExAllocatePoolWithTag ( NonPagedPool,

sizeof(FLT_VOLUME_PROPERTIES) + 512,

FILE_POOL_TAG );

if( NULL == VolumeProperties ) {

DbgPrint((“InstanceSetupCallback: not enough memory to allocate FLT_VOLUME_PROPERTIES\n” ));

return STATUS_FLT_DO_NOT_ATTACH;

}

returnLength = 0;

status = FltGetVolumeProperties( FltObjects->Volume,

VolumeProperties,

sizeof(FLT_VOLUME_PROPERTIES) + 512,

&returnLength );

if ( !NT_SUCCESS(status) ) {

DbgPrint((“InstanceSetupCallback: Error geting volume properties\n” ));

return STATUS_FLT_DO_NOT_ATTACH;

}

// Judge the information of the volume properties

// _asm int 3;

if(FILE_DEVICE_DISK_FILE_SYSTEM != VolumeProperties->DeviceType) {

DbgPrint((“The VolumeDeviceType is not FILE_DEVICE_DISK_FILE_SYSTEM\n”));

return STATUS_FLT_DO_NOT_ATTACH;

}

DbgPrint((“The VolumeDeviceType is FILE_DEVICE_DISK_FILE_SYSTEM\n”));

// _asm int 3;

if( !FlagOn(FILE_REMOVABLE_MEDIA, VolumeProperties->DeviceCharacteristics) ) {

DbgPrint((“The DeviceCharacteristics is not FILE_REMOVABLE_MEDIA\n”));

return STATUS_FLT_DO_NOT_ATTACH;

}

DbgPrint((“The DeviceCharacteristics is FILE_REMOVABLE_MEDIA\n”));

DbgPrint((“The Device is attached!!!\n”));

return STATUS_SUCCESS;

}

If it is not available$B!$(Bplease tell me the reason and give me another method$B!#(BThank you$B!!(B

— NTFSD is sponsored by OSR For our schedule of debugging and file system seminars (including our new fs mini-filter seminar) visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

4

Thank you very much!
I have another question.Is it unique(idVendor,idProduct and iSerialNumber of
the usb device)?
If it is not,how can I get the unique identification to a usb device?
My english is not very good.I hope you can make sense of it.Thank you!

2009/7/31 David Craig xxxxx@yoshimuni.com

Don’t forget the specifications for the various hard drives - SCSI, SATA,
ATAPI, etc. and how they report removal capability. There are also rules
for what is ‘removable’. It something being removable because the ‘media’
is removable or because the drive is removable? SCSI refers to removable
medium as one example where the RMB bit in the SCSI Inquiry response only
indicates that the medium is removable. Since many external drives such as
USB, 1394, eSata, etc. use hard drives made to be able to installed in any
system the removal capability indications may not work. Don’t know how to
handle eSata since you can only know it is a SATA controller and not if it
is external or internal. Even in early versions of Windows NT, removable
drives were supported for SCSI.

“Ken Cross” wrote in message news:xxxxx@ntfsd…
>
> Unfortunately, sometimes the devices don??t tell the truth ?C they may be
> removable but report themselves as fixed. (To be fair, this is a gray area
> ?C is an external USB drive that??s being used as the system disk
> ??removable???)
>
>
>
> I had to work around this by checking the bus controller and, if USB,
> assume it is a removable disk. This involved calling
>
>
>
> IoBuildDeviceIoControlRequest( IOCTL_STORAGE_QUERY_PROPERTY, pDevObj,?? )
>
>
>
> and checking for USB or 1394 bus controllers:
>
>
>
> bRemovableVolume = ( BusTypeUsb == StorageDescriptor.BusType ||
> BusType1394 == StorageDescriptor.BusType );
>
>
>
> I did this in the driver InstanceSetup so you can decide if it should be
> attached.
>
>
>
> HTH,
>
> Ken
>
>
>
>
>
>
>
> From: xxxxx@lists.osr.com [mailto:
> xxxxx@lists.osr.com] *On Behalf Of *wingbird chen
> Sent: Thursday, July 30, 2009 10:25 AM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] Is it available to attach usb storage in minifilter?
>
>
>
> Hi all.
>
>
>
> I want to attach a usb storage in minifilter.
>
> In the InstanceSetupCallback routine:
>
> Firstly,I judge the VolumeDeviceType.If the VolumeDeviceType
> != FILE_DEVICE_DISK_FILE_SYSTEM,return STATUS_FLT_DO_NOT_ATTACH.
>
> Secondly,I get the VolumeProperties.
>
> finally,if the flag FILE_REMOVABLE_MEDIA is on
> in VolumeProperties->DeviceCharacteristics,return STATUS_SUCCESS to attach
> the device.
>
>
>
> Following are my codes in detail:
>
>
>
> NTSTATUS
>
> ScannerInstanceSetup (
>
> in PCFLT_RELATED_OBJECTS FltObjects,
>
> in FLT_INSTANCE_SETUP_FLAGS Flags,
>
> in DEVICE_TYPE VolumeDeviceType,
>
> in FLT_FILESYSTEM_TYPE VolumeFilesystemType
>
> )
>
>
>
> {
>
> PFLT_VOLUME_PROPERTIES VolumeProperties;
>
> ULONG returnLength;
>
> NTSTATUS status;
>
>
>
> UNREFERENCED_PARAMETER( Flags );
>
> UNREFERENCED_PARAMETER( VolumeFilesystemType );
>
>
>
> PAGED_CODE();
>
>
>
> _asm int 3;
>
> DbgPrint((“InstanceSetup…\n”));
>
>
>
> if(FILE_DEVICE_DISK_FILE_SYSTEM != VolumeDeviceType) {
>
>
>
> DbgPrint((“The VolumeDeviceType is not
> FILE_DEVICE_DISK_FILE_SYSTEM\n”));
>
> return STATUS_FLT_DO_NOT_ATTACH;
>
> }
>
> DbgPrint((“The VolumeDeviceType is FILE_DEVICE_DISK_FILE_SYSTEM\n”));
>
>
>
> // Allocate the memery for VolumeProperties
>
> VolumeProperties = ( PFLT_VOLUME_PROPERTIES )ExAllocatePoolWithTag (
> NonPagedPool,
>
>
> sizeof(FLT_VOLUME_PROPERTIES) + 512,
>
>
> FILE_POOL_TAG );
>
>
> if( NULL == VolumeProperties ) {
>
>
>
> DbgPrint((“InstanceSetupCallback: not enough memory to allocate
> FLT_VOLUME_PROPERTIES\n” ));
>
> return STATUS_FLT_DO_NOT_ATTACH;
>
> }
>
>
>
> returnLength = 0;
>
> status = FltGetVolumeProperties( FltObjects->Volume,
>
> VolumeProperties,
>
> sizeof(FLT_VOLUME_PROPERTIES)
> + 512,
>
> &returnLength );
>
>
>
> if ( !NT_SUCCESS(status) ) {
>
>
>
> DbgPrint((“InstanceSetupCallback: Error geting volume
> properties\n” ));
>
> return STATUS_FLT_DO_NOT_ATTACH;
>
> }
>
>
>
> // Judge the information of the volume properties
>
> // _asm int 3;
>
> if(FILE_DEVICE_DISK_FILE_SYSTEM != VolumeProperties->DeviceType) {
>
>
>
> DbgPrint((“The VolumeDeviceType is not
> FILE_DEVICE_DISK_FILE_SYSTEM\n”));
>
> return STATUS_FLT_DO_NOT_ATTACH;
>
> }
>
> DbgPrint((“The VolumeDeviceType is FILE_DEVICE_DISK_FILE_SYSTEM\n”));
>
>
>
> // _asm int 3;
>
> if( !FlagOn(FILE_REMOVABLE_MEDIA,
> VolumeProperties->DeviceCharacteristics) ) {
>
>
>
> DbgPrint((“The DeviceCharacteristics is not
> FILE_REMOVABLE_MEDIA\n”));
>
> return STATUS_FLT_DO_NOT_ATTACH;
>
> }
>
> DbgPrint((“The DeviceCharacteristics is FILE_REMOVABLE_MEDIA\n”));
>
>
>
>
>
> DbgPrint((“The Device is attached!!!\n”));
>
>
>
> return STATUS_SUCCESS;
>
> }
>
>
>
>
>
> If it is not available??please tell me the reason and give me another
> method??Thank you???
>
>
>
> — NTFSD is sponsored by OSR For our schedule of debugging and file system
> seminars (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars To unsubscribe, visit the List Server section
> of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>