堆棧內存溢出
  簡體   English   中英

Windows驅動程序，從內核創建/安裝磁盤設備

[英]Windows Driver, creating/mounting a disk device from kernel

 原文  2017-05-08 08:33:38  1   1    c/ windows/ kernel/ driver/ wdk

問題描述

我已經堅持了3個星期的問題，並且真的想繼續填寫文件系統代碼的“真正移植”工作。 我正在嘗試模擬從userland發布到內核驅動程序的動態掛載請求。 所以這是關於內核端代碼。

我一直在閱讀Dokan，win-btrfs以及其他一些類似的東西。 即，創建一個新的假磁盤設備，並以某種方式讓它有一個“卷”，分配一個驅動器號，文件系統請求涌入...

我想相信（哈）我很接近...我盡可能簡化了源代碼，協助閱讀，同​​樣清理日志，用變量名替換十六進制地址。

我根據名稱生成uuid，並在調用之前將注釋中使用的名稱放在注釋中。 

handle_mount_request_and_create_volume()
{
deviceCharacteristics = FILE_DEVICE_IS_MOUNTED;
deviceCharacteristics |= FILE_REMOVABLE_MEDIA;

// First create the disk device object,
// WIN_DriverObject is the DriverEntry object
status = IoCreateDeviceSecure(WIN_DriverObject,
    sizeof(myfs_mount_object_t),
    // '\Device\Volume{0b1bb601-af0b-32e8-a1d2-54c167af6277}'
    &diskDeviceName,
    FILE_DEVICE_DISK,
    deviceCharacteristics,
    FALSE,
    &SDDL_DEVOBJ_SYS_ALL_ADM_RWX_WORLD_RW_RES_R,
    NULL,
    &diskDeviceObject);

myfs_mount_object_t *zmo_dcb = diskDeviceObject->DeviceExtension;
// '\Device\Volume{0b1bb601-af0b-32e8-a1d2-54c167af6277}'
AsciiStringToUnicodeString(buf, &zmo_dcb->device_name);

// '\DosDevices\Global\Volume{0b1bb601-af0b-32e8-a1d2-54c167af6277}'
AsciiStringToUnicodeString(buf, &zmo_dcb->symlink_name);

// '\Device\Myfs{0b1bb601-af0b-32e8-a1d2-54c167af6277}'
AsciiStringToUnicodeString(buf, &zmo_dcb->fs_name);

diskDeviceObject->Flags |= DO_DIRECT_IO;

// Now create the filesystem device object
status = IoCreateDeviceSecure(
    WIN_DriverObject,
    sizeof(myfs_mount_object_t),
    // '\Device\Myfs{0b1bb601-af0b-32e8-a1d2-54c167af6277}'
    &fsDeviceName,
    FILE_DEVICE_DISK_FILE_SYSTEM,
    deviceCharacteristics,
    FALSE,
    &SDDL_DEVOBJ_SYS_ALL_ADM_RWX_WORLD_RW_RES_R,
    NULL,
    &fsDeviceObject);

myfs_mount_object_t *zmo_vcb = fsDeviceObject->DeviceExtension;

dprintf("WinDeviceObject : %p\n", WIN_DriverObject);
dprintf("diskDeviceObject: %p\n", diskDeviceObject);
dprintf("fsDeviceObject  : %p\n", fsDeviceObject);

// '\Device\Myfs{0b1bb601-af0b-32e8-a1d2-54c167af6277}'
AsciiStringToUnicodeString(buf, &zmo_vcb->device_name);

// '\DosDevices\Global\Volume{0b1bb601-af0b-32e8-a1d2-54c167af6277}'
AsciiStringToUnicodeString(buf, &zmo_vcb->symlink_name);

fsDeviceObject->Flags |= DO_DIRECT_IO;

diskDeviceObject->Vpb->DeviceObject = fsDeviceObject;
diskDeviceObject->Vpb->RealDevice = fsDeviceObject;
diskDeviceObject->Vpb->Flags |= VPB_MOUNTED;
diskDeviceObject->Vpb->VolumeLabelLength = wcslen(VOLUME_LABEL) * sizeof(WCHAR);
RtlStringCchCopyW(diskDeviceObject->Vpb->VolumeLabel,
    sizeof(diskDeviceObject->Vpb->VolumeLabel) / sizeof(WCHAR),
    VOLUME_LABEL);
diskDeviceObject->Vpb->SerialNumber = 0x19831116;

ObReferenceObject(fsDeviceObject);
ObReferenceObject(diskDeviceObject);

// Create symlink for userland
// '\DosDevices\Global\Volume{0b1bb601-af0b-32e8-a1d2-54c167af6277}'
// '\Device\Volume{0b1bb601-af0b-32e8-a1d2-54c167af6277}'
status = IoCreateSymbolicLink(&symbolicLinkTarget, &diskDeviceName);

// Mark devices as initialized
diskDeviceObject->Flags &= ~DO_DEVICE_INITIALIZING;
fsDeviceObject->Flags &= ~DO_DEVICE_INITIALIZING;

// Send IOCTL_MOUNTMGR_VOLUME_ARRIVAL_NOTIFICATION on the
// diskDeviceObject to MountMgr
// '\Device\Volume{0b1bb601-af0b-32e8-a1d2-54c167af6277}'
SendVolumeArrivalNotification(&diskDeviceName);

// register objects
status = IoReportDetectedDevice(
    WIN_DriverObject,
    InterfaceTypeUndefined,
    0, 0, NULL, NULL, FALSE,
    &pnpDeviceObject);
IoAttachDeviceToDeviceStack(pnpDeviceObject, diskDeviceObject);
IoRegisterDeviceInterface(
    pnpDeviceObject,
    &GUID_DEVINTERFACE_DISK,
    NULL,
    // out "\??\ROOT#MYFS#0000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
    &diskDeviceName);
IoSetDeviceInterfaceState(&diskDeviceName, TRUE);
IoRegisterDeviceInterface(
    pnpDeviceObject,
    &MOUNTDEV_MOUNTED_DEVICE_GUID,
    NULL,
    // out "\??\ROOT#MYFS#0000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
    &fsDeviceName);
status = IoSetDeviceInterfaceState(&Dcb->fs_name, TRUE);

// Lets call IOCTL_MOUNTMGR_NEXT_DRIVE_LETTER
status = mountmgr_add_drive_letter(mountmgrDeviceObject, &fsDeviceName);
dprintf("DriveLetterWasAssigned = %u, CurrentDriveLetter = %c\n", mmdli.DriveLetterWasAssigned, mmdli.CurrentDriveLetter);

// Lets call IOCTL_MOUNTMGR_QUERY_POINTS
status = mountmgr_get_drive_letter(mountmgrDeviceObject, &diskDeviceName);

dprintf("   point %d: '%.*S' '%.*S'\n", Index,
    ipoint->DeviceNameLength / sizeof(WCHAR), DeviceName,
    ipoint->SymbolicLinkNameLength / sizeof(WCHAR), SymbolicLinkName);

並且程序生成的輸出： 

** Run code:
WinDeviceObject : FFFFAA81D83CC060
diskDeviceObject: FFFFAA81D260A080
fsDeviceObject  : FFFFAA81D301EC40
=> SendVolumeArrivalNotification

# First requests come in, I don't really know what to do in CREATE/CLEANUP
# and CLOSE, so they mostly just return STATUS_SUCCESS

dispatcher: enter: major 0: minor 0: IRP_MJ_CREATE diskDeviceObject
IRP_MJ_CREATE: FileObject FFFFAA81D6AE8CC0 related 0000000000000000 name '(null)' flags 0x0
Setting FileObject->Vpb to FFFFAA81D559B590
dispatcher: exit: 0x0

dispatcher: enter: major 18: minor 0: IRP_MJ_CLEANUP diskDeviceObject
dispatcher: exit: 0x0

dispatcher: enter: major 2: minor 0: IRP_MJ_CLOSE diskDeviceObject
dispatcher: exit: 0x0

dispatcher: enter: major 0: minor 0: IRP_MJ_CREATE diskDeviceObject
IRP_MJ_CREATE: FileObject FFFFAA81D6AE8CC0 related 0000000000000000 name '(null)' flags 0x0
Setting FileObject->Vpb to FFFFAA81D559B590
dispatcher: exit: 0x0

dispatcher: enter: major 18: minor 0: IRP_MJ_CLEANUP deviceObject FFFFAA81D260A080
dispatcher: exit: 0x0

dispatcher: enter: major 14: minor 0: IRP_MJ_DEVICE_CONTROL diskDeviceObject
IOCTL_MOUNTDEV_QUERY_DEVICE_NAME
dispatcher: exit: STATUS_BUFFER_OVERFLOW

dispatcher: enter: major 14: minor 0: IRP_MJ_DEVICE_CONTROL diskDeviceObject
IOCTL_MOUNTDEV_QUERY_DEVICE_NAME
replying with '\Device\Volume{0b1bb601-af0b-32e8-a1d2-54c167af6277}'
dispatcher: exit: 0x0

dispatcher: enter: major 14: minor 0: IRP_MJ_DEVICE_CONTROL diskDeviceObject
IOCTL_MOUNTDEV_QUERY_UNIQUE_ID
dispatcher: exit: STATUS_BUFFER_OVERFLOW

dispatcher: enter: major 14: minor 0: IRP_MJ_DEVICE_CONTROL diskDeviceObject
IOCTL_MOUNTDEV_QUERY_UNIQUE_ID
replying with '\DosDevices\Global\Volume{0b1bb601-af0b-32e8-a1d2-54c167af6277}'
dispatcher: exit: 0x0

dispatcher: enter: major 14: minor 0: IRP_MJ_DEVICE_CONTROL diskDeviceObject
IOCTL_MOUNTDEV_QUERY_STABLE_GUID
dispatcher: exit: STATUS_NOT_IMPLEMENTED
# Doesn't sound like I want/need to use stable_guid, so skipping it


dispatcher: enter: major 2: minor 0: IRP_MJ_CLOSE diskDeviceObject
dispatcher: exit: 0x0

dispatcher: enter: major 0: minor 0: IRP_MJ_CREATE diskDeviceObject
IRP_MJ_CREATE: FileObject FFFFAA81D6AE8CC0 related 0000000000000000 name '(null)' flags 0x0
Setting FileObject->Vpb to FFFFAA81D559B590
dispatcher: exit: 0x0

dispatcher: enter: major 18: minor 0: IRP_MJ_CLEANUP diskDeviceObject
dispatcher: exit: 0x0

dispatcher: enter: major 14: minor 0: IRP_MJ_DEVICE_CONTROL diskDeviceObject
IOCTL_MOUNTDEV_QUERY_SUGGESTED_LINK_NAME
dispatcher: exit: STATUS_NOT_IMPLEMENTED
# Similarly here, should be ok to go without, right?

dispatcher: enter: major 2: minor 0: IRP_MJ_CLOSE diskDeviceObject
dispatcher: exit: 0x0

dispatcher: enter: major 0: minor 0: IRP_MJ_CREATE diskDeviceObject
IRP_MJ_CREATE: FileObject FFFFAA81D6AE8CC0 related 0000000000000000 name '(null)' flags 0x0
Setting FileObject->Vpb to FFFFAA81D559B590
dispatcher: exit: 0x0

dispatcher: enter: major 18: minor 0: IRP_MJ_CLEANUP diskDeviceObject
dispatcher: exit: 0x0

dispatcher: enter: major 14: minor 0: IRP_MJ_DEVICE_CONTROL diskDeviceObject
IOCTL_VOLUME_ONLINE
dispatcher: exit: 0x0

dispatcher: enter: major 14: minor 0: IRP_MJ_DEVICE_CONTROL diskDeviceObject
IOCTL_VOLUME_POST_ONLINE
dispatcher: exit: 0x0

dispatcher: enter: major 2: minor 0: IRP_MJ_CLOSE diskDeviceObject

dispatcher: exit: 0x0

<= SendVolumeArrivalNotification

IoReportDetectedDevice success
IoAttachDeviceToDeviceStack success

# Reply to GUID_DEVINTERFACE_DISK
IoRegisterDeviceInterface success: \??\ROOT#MYFS#0000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
IoSetDeviceInterfaceState success

# Reply to MOUNTDEV_MOUNTED_DEVICE_GUID
IoRegisterDeviceInterface success: \??\ROOT#MYFS#0000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
IoSetDeviceInterfaceState success

# IOCTL_MOUNTMGR_NEXT_DRIVE_LETTER work
mmdlt = \Device\Myfs{0b1bb601-af0b-32e8-a1d2-54c167af6277}

dispatcher: enter: major 0: minor 0: IRP_MJ_CREATE fsDeviceObject
IRP_MJ_CREATE: FileObject FFFFAA81D2958390 related 0000000000000000 name '(null)' flags 0x0
Setting FileObject->Vpb to FFFFAA81D559B590
dispatcher: exit: 0x0

dispatcher: enter: major 18: minor 0: IRP_MJ_CLEANUP fsDeviceObject
dispatcher: exit: 0x0

dispatcher: enter: major 14: minor 0: IRP_MJ_DEVICE_CONTROL fsDeviceObject
IOCTL_MOUNTDEV_QUERY_DEVICE_NAME
dispatcher: exit: STATUS_BUFFER_OVERFLOW

dispatcher: enter: major 14: minor 0: IRP_MJ_DEVICE_CONTROL fsDeviceObject
IOCTL_MOUNTDEV_QUERY_DEVICE_NAME
replying with '\Device\Myfs{0b1bb601-af0b-32e8-a1d2-54c167af6277}'
dispatcher: exit: 0x0

dispatcher: enter: major 2: minor 0: IRP_MJ_CLOSE fsDeviceObject
dispatcher: exit: 0x0

DriveLetterWasAssigned = 0, CurrentDriveLetter = D
# Oh, claims it has a drive letter?

IOCTL_MOUNTMGR_QUERY_POINTS return 0
point 0: '\Device\HarddiskVolume1' '\??\Volume{168821f0-0000-0000-0000-100000000000}'
point 1: '\Device\HarddiskVolume2' '\DosDevices\C:'
point 2: '\Device\HarddiskVolume2' '\??\Volume{168821f0-0000-0000-0000-501f00000000}'
point 3: '\Device\Floppy0' '\DosDevices\A:'
point 4: '\Device\Floppy0' '\??\Volume{ffc72bda-0526-11e7-ba78-806e6f6e6963}'
point 5: '' '\??\Volume{5d761629-339b-11e7-baa7-ab3bc3128e46}'
point 6: '' '\DosDevices\D:'

沒有我的代碼，我只會有0,1,2,3和4.所以看起來我已經創建了5和6.我不知道5是什么，Volume GUID與代碼中的任何內容都不匹配，或者輸出。 6雖然有“D：”，但......

顯示“D：”是令人鼓舞的，但是左側（Dev​​iceName）真的應該是空的嗎？ 這是我接下來要看的嗎？

或者是對IRP_MJ_CREATE的調用？ 除了回復STATUS_SUCCESS之外，我什么也沒做。 我確實將Vpb分配給FileObject，但它沒有任何區別。

什么是設備5？ 這是我的問題，是生成了一個名字，因為我在某處錯誤地回復了？

或者我錯過了一個基本命令？

希望我Windows開發人員......

1 個解決方案

解決方案1
 0  2017-05-10 03:36:35

最后，它應該工作，它必須是我做的事情。 這幾乎就是它的意義所在。 我曾在某處拾起這些線; 

  if (Status != STATUS_SUCCESS)
      Irp->IoStatus.Information = 0;

這意味着我為查詢名稱長度的查詢吹走了“需要的大小”返回整數。 只是看到這里的代碼，任何人都無法回答這個問題。 現在我變得更好了： 

point 4: '\Device\Volume{0b1bb601-af0b-32e8-a1d2-54c167af6277}'
      '\DosDevices\D:'

和一堆新的查詢，包括IRP_MJ_DIRECTORY_CONTROL，所以我至少可以繼續。 對不起噪音。

暫無
暫無

聲明:本站的技術帖子網頁，遵循CC BY-SA 4.0協議，如果您需要轉載，請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.

相關問題 在Windows內核設備驅動程序中使用fprintf 從內核窗口創建文件 從 C 中的 windows kernel 驅動程序讀取注冊表 從內核寫入用戶空間的問題-Linux設備驅動程序 Linux設備驅動程序：將字符串從內核復制到UserSpace 如何從Windows內核模式驅動程序設置鍵盤指示燈？ 從Windows 10內核模式驅動程序登錄到txt文件 從Windows內核模式驅動程序確定文件所有者 內核設備驅動程序“解除引用&#39;void *&#39;指針 如何為內核和設備驅動程序開發設置 YouCompleteMe？
相關標簽
 
粵ICP備18138465號  © 2020-2024 STACKOOM.COM