CreateMutex
까보면 다나와~
iocontrolcode (2)

드라이버와 어플리케이션과의 통신
2011. 9. 26. 16:46,  유용한 지식 자료들/드라이버, 커널 관련

1. IRP(I/O Request Packet) : 통신의 주체이며 데이터 버퍼를 포함하는 데이터 구조체, 드라이버는 IRP를 처리하는 함수를 가지고 있어야 한다.
2. IOCTL(I/O Control) : 유저 에플리케이션과 커널 드라이브간 통신을 위해 프로그래머가 정의하는 명령

#드라이버의 생성 절차(http://gogil.tistory.com/9)
DriverEntry -> IoCreateDevice -> IoCreateSymbolicLink -> MajorFunction과 DriverUnload 등록

#App와 통신 절차(http://guimong.tistory.com/66)
IRP_MJ_CREATE -> IRP_MJ_DEVICE_CONTROL(APP에서 드라이버로 입력이 있을 경우) -> IRP_MJ_CLOSE


User App에서 DeviceIoControl()에 전달될 IoCotrolCode의 정의(#예)는 다음과 같다.
#define IOCTL_EXAMPLE_SAMPLE_DIRECT_IN_IO  CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_IN_DIRECT, FILE_READ_DATA | FILE_WRITE_DATA)

특히 CTL_CODE 부분은 다음과 같은 구조로 되어있다.

출처 : http://luckey.tistory.com/122

Method는 다음과 같다.
METHOD_IN_DIRECT
METHOD_IOUT_DIRECT
METHOD_BUFFERED
METHOD_NEITHER : 3(11b), App 메모리 주소를 사용(?)

IOCTL에 대한 다른 정보!~
http://ezbeat.tistory.com/341

보충~(http://ezbeat.tistory.com/286)
User에서 I/O Control을 위해 DeviceIoControl()함수를 호출하면 디바이스에 IRP가 전달되는데, 디바이스에서 해당 IRP를 처리하기 위해 IoGetCrurrentirpStackLocation을 사용하여 IRP에 존재하는 IO 스택 포인터 위치를 전달 받는다. 전달 받은 구조체는 IO_STACK_LOCATION(24byte)이고 그안에 DeviceIoControl()함수 호출시 파라미터로 넘긴 IoControlCode를 처리한다.
pStack->Parameters.DeviceIoControl.IoControlCode


와우!! DDK 모든 Ref!!!!
http://www.perisoft.net/engineer/wdmcard.htm


------------------
맞는지 모르겠지만 일단 나름대로 하면!
드라이버는 최초 디바이스와 심볼링링크, MajorFunction을 미리 생성한다. 이후 App는 미리 생성된 MajorFunction을 호출하여 원하는 행위를 할 수 있는데 이때 IoControlCode라는 것이 핵심으로 User App에서 보내는 IRP를 확인하면 어떤 행위를 하려는 것인지 알 수가 있다. 따라서 Control Code의 구조를 알고 호출하는 Function이 무엇인지 확인하는 것이 주요하다. 해당 Function은 IRP_MJ_DEVICE_CONTROL(0x0e)에서 확인한다.
저작자표시 비영리 변경금지

'유용한 지식 자료들 > 드라이버, 커널 관련' 카테고리의 다른 글

SCSI REQUEST BLOCK의 CDB[0].OperationCode Commands  (1) 2011.10.11
atapi object +74h hook  (0) 2011.09.28
atapi의 특정 Major Function 후킹  (0) 2011.09.28
IoControl 정보 제공 툴  (0) 2011.09.26
후킹을 통한 프로세스 및 파일 보호  (0) 2011.09.22
  Comments,     Trackbacks

IoControl 정보 제공 툴
2011. 9. 26. 14:57,  유용한 지식 자료들/드라이버, 커널 관련
IoControl에 대한 정보를 알수 있도록 툴을 제공하고 있습니다.^^
 
http://tbaioctl.codeplex.com/




다음은 그냥 퍼옴 (http://www.4ucode.com/Study/Topic/518106)
 :  IoControlCode 정의된 부분 같네요;


/* coded by Ray Linn */
        IOCTL_STORAGE_BASE = FileDevice.MASS_STORAGE,
        IOCTL_STORAGE_CHECK_VERIFY = (IOCTL_STORAGE_BASE << 16) | (0x0200 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_CHECK_VERIFY2 = (IOCTL_STORAGE_BASE << 16) | (0x0200 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_MEDIA_REMOVAL = (IOCTL_STORAGE_BASE << 16) | (0x0201 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_EJECT_MEDIA = (IOCTL_STORAGE_BASE << 16) | (0x0202 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_LOAD_MEDIA = (IOCTL_STORAGE_BASE << 16) | (0x0203 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_LOAD_MEDIA2 = (IOCTL_STORAGE_BASE << 16) | (0x0203 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_RESERVE = (IOCTL_STORAGE_BASE << 16) | (0x0204 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
       IOCTL_STORAGE_RELEASE = (IOCTL_STORAGE_BASE << 16) | (0x0205 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_FIND_NEW_DEVICES = (IOCTL_STORAGE_BASE << 16) | (0x0206 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_MCN_CONTROL = (IOCTL_STORAGE_BASE << 16) | (0x0251 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_GET_MEDIA_TYPES = (IOCTL_STORAGE_BASE << 16) | (0x0300 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_GET_MEDIA_TYPES_EX = (IOCTL_STORAGE_BASE << 16) | (0x0301 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_GET_MEDIA_SERIAL_NUMBER = (IOCTL_STORAGE_BASE << 16) | (0x0304 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_GET_HOTPLUG_INFO = (IOCTL_STORAGE_BASE << 16) | (0x0305 << 2) | (Method.Buffered) | (0 << 14),
      
        IOCTL_STORAGE_SET_HOTPLUG_INFO = (IOCTL_STORAGE_BASE << 16) | (0x0306 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_STORAGE_RESET_BUS = (IOCTL_STORAGE_BASE << 16) | (0x0400 << 2) | (Method.Buffered) | (FileAccess.Read << 14),

        IOCTL_STORAGE_RESET_DEVICE = (IOCTL_STORAGE_BASE << 16) | (0x0401 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_BREAK_RESERVATION = (IOCTL_STORAGE_BASE << 16) | (0x0405 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_PERSISTENT_RESERVE_IN = (IOCTL_STORAGE_BASE << 16) | (0x0406 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_PERSISTENT_RESERVE_OUT = (IOCTL_STORAGE_BASE << 16) | (0x0407 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_STORAGE_GET_DEVICE_NUMBER = (IOCTL_STORAGE_BASE << 16) | (0x0420 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_PREDICT_FAILURE = (IOCTL_STORAGE_BASE << 16) | (0x0440 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_READ_CAPACITY = (IOCTL_STORAGE_BASE << 16) | (0x0450 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_QUERY_PROPERTY = (IOCTL_STORAGE_BASE << 16) | (0x0500 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_MANAGE_DATA_SET_ATTRIBUTES = (IOCTL_STORAGE_BASE << 16) | (0x0501 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        IOCTL_STORAGE_GET_BC_PROPERTIES = (IOCTL_STORAGE_BASE << 16) | (0x0600 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_ALLOCATE_BC_STREAM = (IOCTL_STORAGE_BASE << 16) | (0x0601 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_STORAGE_FREE_BC_STREAM = (IOCTL_STORAGE_BASE << 16) | (0x0602 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_STORAGE_CHECK_PRIORITY_HINT_SUPPORT = (IOCTL_STORAGE_BASE << 16) | (0x0620 << 2) | (Method.Buffered) | (0 << 14),
        OBSOLETE_IOCTL_STORAGE_RESET_BUS = (IOCTL_STORAGE_BASE << 16) | (0x0400 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        OBSOLETE_IOCTL_STORAGE_RESET_DEVICE = (IOCTL_STORAGE_BASE << 16) | (0x0401 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_BASE = FileDevice.DISK,
        IOCTL_DISK_GET_DRIVE_GEOMETRY = (IOCTL_DISK_BASE << 16) | (0x0000 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_GET_PARTITION_INFO = (IOCTL_DISK_BASE << 16) | (0x0001 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_SET_PARTITION_INFO = (IOCTL_DISK_BASE << 16) | (0x0002 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_GET_DRIVE_LAYOUT = (IOCTL_DISK_BASE << 16) | (0x0003 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_SET_DRIVE_LAYOUT = (IOCTL_DISK_BASE << 16) | (0x0004 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_VERIFY = (IOCTL_DISK_BASE << 16) | (0x0005 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_FORMAT_TRACKS = (IOCTL_DISK_BASE << 16) | (0x0006 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_REASSIGN_BLOCKS = (IOCTL_DISK_BASE << 16) | (0x0007 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_PERFORMANCE = (IOCTL_DISK_BASE << 16) | (0x0008 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_IS_WRITABLE = (IOCTL_DISK_BASE << 16) | (0x0009 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_LOGGING = (IOCTL_DISK_BASE << 16) | (0x000a << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_FORMAT_TRACKS_EX = (IOCTL_DISK_BASE << 16) | (0x000b << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_HISTOGRAM_STRUCTURE = (IOCTL_DISK_BASE << 16) | (0x000c << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_HISTOGRAM_DATA = (IOCTL_DISK_BASE << 16) | (0x000d << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_HISTOGRAM_RESET = (IOCTL_DISK_BASE << 16) | (0x000e << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_REQUEST_STRUCTURE = (IOCTL_DISK_BASE << 16) | (0x000f << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_REQUEST_DATA = (IOCTL_DISK_BASE << 16) | (0x0010 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_PERFORMANCE_OFF = (IOCTL_DISK_BASE << 16) | (0x0018 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_CONTROLLER_NUMBER = (IOCTL_DISK_BASE << 16) | (0x0011 << 2) | (Method.Buffered) | (0 << 14),
        SMART_GET_VERSION = (IOCTL_DISK_BASE << 16) | (0x0020 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        SMART_SEND_DRIVE_COMMAND = (IOCTL_DISK_BASE << 16) | (0x0021 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        SMART_RCV_DRIVE_DATA = (IOCTL_DISK_BASE << 16) | (0x0022 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_GET_PARTITION_INFO_EX = (IOCTL_DISK_BASE << 16) | (0x0012 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_SET_PARTITION_INFO_EX = (IOCTL_DISK_BASE << 16) | (0x0013 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_GET_DRIVE_LAYOUT_EX = (IOCTL_DISK_BASE << 16) | (0x0014 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_SET_DRIVE_LAYOUT_EX = (IOCTL_DISK_BASE << 16) | (0x0015 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_CREATE_DISK = (IOCTL_DISK_BASE << 16) | (0x0016 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_GET_LENGTH_INFO = (IOCTL_DISK_BASE << 16) | (0x0017 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_GET_DRIVE_GEOMETRY_EX = (IOCTL_DISK_BASE << 16) | (0x0028 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_REASSIGN_BLOCKS_EX = (IOCTL_DISK_BASE << 16) | (0x0029 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_UPDATE_DRIVE_SIZE = (IOCTL_DISK_BASE << 16) | (0x0032 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_GROW_PARTITION = (IOCTL_DISK_BASE << 16) | (0x0034 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_GET_CACHE_INFORMATION = (IOCTL_DISK_BASE << 16) | (0x0035 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_SET_CACHE_INFORMATION = (IOCTL_DISK_BASE << 16) | (0x0036 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_GET_WRITE_CACHE_STATE = (IOCTL_DISK_BASE << 16) | (0x0037 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        OBSOLETE_DISK_GET_WRITE_CACHE_STATE = (IOCTL_DISK_BASE << 16) | (0x0037 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_DELETE_DRIVE_LAYOUT = (IOCTL_DISK_BASE << 16) | (0x0040 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_UPDATE_PROPERTIES = (IOCTL_DISK_BASE << 16) | (0x0050 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_FORMAT_DRIVE = (IOCTL_DISK_BASE << 16) | (0x00f3 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_SENSE_DEVICE = (IOCTL_DISK_BASE << 16) | (0x00f8 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_CHECK_VERIFY = (IOCTL_DISK_BASE << 16) | (0x0200 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_MEDIA_REMOVAL = (IOCTL_DISK_BASE << 16) | (0x0201 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_EJECT_MEDIA = (IOCTL_DISK_BASE << 16) | (0x0202 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_LOAD_MEDIA = (IOCTL_DISK_BASE << 16) | (0x0203 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_RESERVE = (IOCTL_DISK_BASE << 16) | (0x0204 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_RELEASE = (IOCTL_DISK_BASE << 16) | (0x0205 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_FIND_NEW_DEVICES = (IOCTL_DISK_BASE << 16) | (0x0206 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_GET_MEDIA_TYPES = (IOCTL_DISK_BASE << 16) | (0x0300 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_RESET_SNAPSHOT_INFO = (IOCTL_DISK_BASE << 16) | (0x0084 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_CHANGER_BASE = FileDevice.CHANGER,
        IOCTL_CHANGER_GET_PARAMETERS = (IOCTL_CHANGER_BASE << 16) | (0x0000 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_CHANGER_GET_STATUS = (IOCTL_CHANGER_BASE << 16) | (0x0001 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_CHANGER_GET_PRODUCT_DATA = (IOCTL_CHANGER_BASE << 16) | (0x0002 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_CHANGER_SET_ACCESS = (IOCTL_CHANGER_BASE << 16) | (0x0004 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_CHANGER_GET_ELEMENT_STATUS = (IOCTL_CHANGER_BASE << 16) | (0x0005 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_CHANGER_INITIALIZE_ELEMENT_STATUS = (IOCTL_CHANGER_BASE << 16) | (0x0006 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_CHANGER_SET_POSITION = (IOCTL_CHANGER_BASE << 16) | (0x0007 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_CHANGER_EXCHANGE_MEDIUM = (IOCTL_CHANGER_BASE << 16) | (0x0008 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_CHANGER_MOVE_MEDIUM = (IOCTL_CHANGER_BASE << 16) | (0x0009 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_CHANGER_REINITIALIZE_TRANSPORT = (IOCTL_CHANGER_BASE << 16) | (0x000A << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_CHANGER_QUERY_VOLUME_TAGS = (IOCTL_CHANGER_BASE << 16) | (0x000B << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_SERIAL_LSRMST_INSERT = (FileDevice.SERIAL_PORT << 16) | (31 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_SERENUM_EXPOSE_HARDWARE = (FileDevice.SERENUM << 16) | (128 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_SERENUM_REMOVE_HARDWARE = (FileDevice.SERENUM << 16) | (129 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_SERENUM_PORT_DESC = (FileDevice.SERENUM << 16) | (130 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_SERENUM_GET_PORT_NAME = (FileDevice.SERENUM << 16) | (131 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_REQUEST_OPLOCK_LEVEL_1 = (FileDevice.FILE_SYSTEM << 16) | (0 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_REQUEST_OPLOCK_LEVEL_2 = (FileDevice.FILE_SYSTEM << 16) | (1 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_REQUEST_BATCH_OPLOCK = (FileDevice.FILE_SYSTEM << 16) | (2 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_OPLOCK_BREAK_ACKNOWLEDGE = (FileDevice.FILE_SYSTEM << 16) | (3 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_OPBATCH_ACK_CLOSE_PENDING = (FileDevice.FILE_SYSTEM << 16) | (4 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_OPLOCK_BREAK_NOTIFY = (FileDevice.FILE_SYSTEM << 16) | (5 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_LOCK_VOLUME = (FileDevice.FILE_SYSTEM << 16) | (6 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_UNLOCK_VOLUME = (FileDevice.FILE_SYSTEM << 16) | (7 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_DISMOUNT_VOLUME = (FileDevice.FILE_SYSTEM << 16) | (8 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_IS_VOLUME_MOUNTED = (FileDevice.FILE_SYSTEM << 16) | (10 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_IS_PATHNAME_VALID = (FileDevice.FILE_SYSTEM << 16) | (11 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_MARK_VOLUME_DIRTY = (FileDevice.FILE_SYSTEM << 16) | (12 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_QUERY_RETRIEVAL_POINTERS = (FileDevice.FILE_SYSTEM << 16) | (14 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_GET_COMPRESSION = (FileDevice.FILE_SYSTEM << 16) | (15 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SET_COMPRESSION = (FileDevice.FILE_SYSTEM << 16) | (16 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        FSCTL_SET_BOOTLOADER_ACCESSED = (FileDevice.FILE_SYSTEM << 16) | (19 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_OPLOCK_BREAK_ACK_NO_2 = (FileDevice.FILE_SYSTEM << 16) | (20 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_INVALIDATE_VOLUMES = (FileDevice.FILE_SYSTEM << 16) | (21 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_QUERY_FAT_BPB = (FileDevice.FILE_SYSTEM << 16) | (22 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_REQUEST_FILTER_OPLOCK = (FileDevice.FILE_SYSTEM << 16) | (23 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_FILESYSTEM_GET_STATISTICS = (FileDevice.FILE_SYSTEM << 16) | (24 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_GET_NTFS_VOLUME_DATA = (FileDevice.FILE_SYSTEM << 16) | (25 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_GET_NTFS_FILE_RECORD = (FileDevice.FILE_SYSTEM << 16) | (26 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_GET_VOLUME_BITMAP = (FileDevice.FILE_SYSTEM << 16) | (27 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_GET_RETRIEVAL_POINTERS = (FileDevice.FILE_SYSTEM << 16) | (28 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_MOVE_FILE = (FileDevice.FILE_SYSTEM << 16) | (29 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_IS_VOLUME_DIRTY = (FileDevice.FILE_SYSTEM << 16) | (30 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_ALLOW_EXTENDED_DASD_IO = (FileDevice.FILE_SYSTEM << 16) | (32 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_FIND_FILES_BY_SID = (FileDevice.FILE_SYSTEM << 16) | (35 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_SET_OBJECT_ID = (FileDevice.FILE_SYSTEM << 16) | (38 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_GET_OBJECT_ID = (FileDevice.FILE_SYSTEM << 16) | (39 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_DELETE_OBJECT_ID = (FileDevice.FILE_SYSTEM << 16) | (40 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SET_REPARSE_POINT = (FileDevice.FILE_SYSTEM << 16) | (41 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_GET_REPARSE_POINT = (FileDevice.FILE_SYSTEM << 16) | (42 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_DELETE_REPARSE_POINT = (FileDevice.FILE_SYSTEM << 16) | (43 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_ENUM_USN_DATA = (FileDevice.FILE_SYSTEM << 16) | (44 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_SECURITY_ID_CHECK = (FileDevice.FILE_SYSTEM << 16) | (45 << 2) | (Method.Neither) | (FileAccess.Read << 14),
        FSCTL_READ_USN_JOURNAL = (FileDevice.FILE_SYSTEM << 16) | (46 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_SET_OBJECT_ID_EXTENDED = (FileDevice.FILE_SYSTEM << 16) | (47 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_CREATE_OR_GET_OBJECT_ID = (FileDevice.FILE_SYSTEM << 16) | (48 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SET_SPARSE = (FileDevice.FILE_SYSTEM << 16) | (49 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SET_ZERO_DATA = (FileDevice.FILE_SYSTEM << 16) | (50 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_QUERY_ALLOCATED_RANGES = (FileDevice.FILE_SYSTEM << 16) | (51 << 2) | (Method.Neither) | (FileAccess.Read << 14),
        FSCTL_ENABLE_UPGRADE = (FileDevice.FILE_SYSTEM << 16) | (52 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_SET_ENCRYPTION = (FileDevice.FILE_SYSTEM << 16) | (53 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_ENCRYPTION_FSCTL_IO = (FileDevice.FILE_SYSTEM << 16) | (54 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_WRITE_RAW_ENCRYPTED = (FileDevice.FILE_SYSTEM << 16) | (55 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_READ_RAW_ENCRYPTED = (FileDevice.FILE_SYSTEM << 16) | (56 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_CREATE_USN_JOURNAL = (FileDevice.FILE_SYSTEM << 16) | (57 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_READ_FILE_USN_DATA = (FileDevice.FILE_SYSTEM << 16) | (58 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_WRITE_USN_CLOSE_RECORD = (FileDevice.FILE_SYSTEM << 16) | (59 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_EXTEND_VOLUME = (FileDevice.FILE_SYSTEM << 16) | (60 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_QUERY_USN_JOURNAL = (FileDevice.FILE_SYSTEM << 16) | (61 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_DELETE_USN_JOURNAL = (FileDevice.FILE_SYSTEM << 16) | (62 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_MARK_HANDLE = (FileDevice.FILE_SYSTEM << 16) | (63 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SIS_COPYFILE = (FileDevice.FILE_SYSTEM << 16) | (64 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SIS_LINK_FILES = (FileDevice.FILE_SYSTEM << 16) | (65 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        FSCTL_RECALL_FILE = (FileDevice.FILE_SYSTEM << 16) | (69 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_READ_FROM_PLEX = (FileDevice.FILE_SYSTEM << 16) | (71 << 2) | (Method.OutDirect) | (FileAccess.Read << 14),
        FSCTL_FILE_PREFETCH = (FileDevice.FILE_SYSTEM << 16) | (72 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_MAKE_MEDIA_COMPATIBLE = (FileDevice.FILE_SYSTEM << 16) | (76 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_SET_DEFECT_MANAGEMENT = (FileDevice.FILE_SYSTEM << 16) | (77 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_QUERY_SPARING_INFO = (FileDevice.FILE_SYSTEM << 16) | (78 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_QUERY_ON_DISK_VOLUME_INFO = (FileDevice.FILE_SYSTEM << 16) | (79 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SET_VOLUME_COMPRESSION_STATE = (FileDevice.FILE_SYSTEM << 16) | (80 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_TXFS_MODIFY_RM = (FileDevice.FILE_SYSTEM << 16) | (81 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_QUERY_RM_INFORMATION = (FileDevice.FILE_SYSTEM << 16) | (82 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        FSCTL_TXFS_ROLLFORWARD_REDO = (FileDevice.FILE_SYSTEM << 16) | (84 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_ROLLFORWARD_UNDO = (FileDevice.FILE_SYSTEM << 16) | (85 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_START_RM = (FileDevice.FILE_SYSTEM << 16) | (86 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_SHUTDOWN_RM = (FileDevice.FILE_SYSTEM << 16) | (87 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_READ_BACKUP_INFORMATION = (FileDevice.FILE_SYSTEM << 16) | (88 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        FSCTL_TXFS_WRITE_BACKUP_INFORMATION = (FileDevice.FILE_SYSTEM << 16) | (89 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_CREATE_SECONDARY_RM = (FileDevice.FILE_SYSTEM << 16) | (90 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_GET_METADATA_INFO = (FileDevice.FILE_SYSTEM << 16) | (91 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        FSCTL_TXFS_GET_TRANSACTED_VERSION = (FileDevice.FILE_SYSTEM << 16) | (92 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        FSCTL_TXFS_SAVEPOINT_INFORMATION = (FileDevice.FILE_SYSTEM << 16) | (94 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_CREATE_MINIVERSION = (FileDevice.FILE_SYSTEM << 16) | (95 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_TRANSACTION_ACTIVE = (FileDevice.FILE_SYSTEM << 16) | (99 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        FSCTL_SET_ZERO_ON_DEALLOCATION = (FileDevice.FILE_SYSTEM << 16) | (101 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SET_REPAIR = (FileDevice.FILE_SYSTEM << 16) | (102 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_GET_REPAIR = (FileDevice.FILE_SYSTEM << 16) | (103 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_WAIT_FOR_REPAIR = (FileDevice.FILE_SYSTEM << 16) | (104 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_INITIATE_REPAIR = (FileDevice.FILE_SYSTEM << 16) | (106 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_CSC_INTERNAL = (FileDevice.FILE_SYSTEM << 16) | (107 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_SHRINK_VOLUME = (FileDevice.FILE_SYSTEM << 16) | (108 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SET_SHORT_NAME_BEHAVIOR = (FileDevice.FILE_SYSTEM << 16) | (109 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_DFSR_SET_GHOST_HANDLE_STATE = (FileDevice.FILE_SYSTEM << 16) | (110 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_TXFS_LIST_TRANSACTION_LOCKED_FILES = (FileDevice.FILE_SYSTEM << 16) | (120 << 2) | (Method.Buffered) | (FileAccess.Read),
        FSCTL_TXFS_LIST_TRANSACTIONS = (FileDevice.FILE_SYSTEM << 16) | (121 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        FSCTL_QUERY_PAGEFILE_ENCRYPTION = (FileDevice.FILE_SYSTEM << 16) | (122 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_RESET_VOLUME_ALLOCATION_HINTS = (FileDevice.FILE_SYSTEM << 16) | (123 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_QUERY_DEPENDENT_VOLUME = (FileDevice.FILE_SYSTEM << 16) | (124 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SD_GLOBAL_CHANGE = (FileDevice.FILE_SYSTEM << 16) | (125 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_TXFS_READ_BACKUP_INFORMATION2 = (FileDevice.FILE_SYSTEM << 16) | (126 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_LOOKUP_STREAM_FROM_CLUSTER = (FileDevice.FILE_SYSTEM << 16) | (127 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_TXFS_WRITE_BACKUP_INFORMATION2 = (FileDevice.FILE_SYSTEM << 16) | (128 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_FILE_TYPE_NOTIFICATION = (FileDevice.FILE_SYSTEM << 16) | (129 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_GET_BOOT_AREA_INFO = (FileDevice.FILE_SYSTEM << 16) | (140 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_GET_RETRIEVAL_POINTER_BASE = (FileDevice.FILE_SYSTEM << 16) | (141 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SET_PERSISTENT_VOLUME_STATE = (FileDevice.FILE_SYSTEM << 16) | (142 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_QUERY_PERSISTENT_VOLUME_STATE = (FileDevice.FILE_SYSTEM << 16) | (143 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_REQUEST_OPLOCK = (FileDevice.FILE_SYSTEM << 16) | (144 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_CSV_TUNNEL_REQUEST = (FileDevice.FILE_SYSTEM << 16) | (145 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_IS_CSV_FILE = (FileDevice.FILE_SYSTEM << 16) | (146 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_QUERY_FILE_SYSTEM_RECOGNITION = (FileDevice.FILE_SYSTEM << 16) | (147 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_CSV_GET_VOLUME_PATH_NAME = (FileDevice.FILE_SYSTEM << 16) | (148 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_CSV_GET_VOLUME_NAME_FOR_VOLUME_MOUNT_POINT = (FileDevice.FILE_SYSTEM << 16) | (149 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_CSV_GET_VOLUME_PATH_NAMES_FOR_VOLUME_NAME = (FileDevice.FILE_SYSTEM << 16) | (150 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_IS_FILE_ON_CSV_VOLUME = (FileDevice.FILE_SYSTEM << 16) | (151 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_MARK_AS_SYSTEM_HIVE = FSCTL_SET_BOOTLOADER_ACCESSED,
        //IOCTL_AVIO_ALLOCATE_STREAM    =    (FILE_DEVICE_AVIO<<16)|( 1<<2)|( Method.Buffered)|( 0<<14),
        //IOCTL_AVIO_FREE_STREAM    =    (FILE_DEVICE_AVIO<<16)|( 2<<2)|( Method.Buffered)|( 0<<14),
        //IOCTL_AVIO_MODIFY_STREAM    =    (FILE_DEVICE_AVIO<<16)|( 3<<2)|( Method.Buffered)|( 0<<14),
        IOCTL_VOLUME_BASE = 0x00000056,
        IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS = (IOCTL_VOLUME_BASE << 16) | (0 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_VOLUME_ONLINE = (IOCTL_VOLUME_BASE << 16) | (2 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_VOLUME_OFFLINE = (IOCTL_VOLUME_BASE << 16) | (3 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_VOLUME_IS_CLUSTERED = (IOCTL_VOLUME_BASE << 16) | (12 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_VOLUME_GET_GPT_ATTRIBUTES = (IOCTL_VOLUME_BASE << 16) | (14 << 2) | (Method.Buffered) | (0 << 14)
저작자표시 비영리 변경금지

'유용한 지식 자료들 > 드라이버, 커널 관련' 카테고리의 다른 글

SCSI REQUEST BLOCK의 CDB[0].OperationCode Commands  (1) 2011.10.11
atapi object +74h hook  (0) 2011.09.28
atapi의 특정 Major Function 후킹  (0) 2011.09.28
드라이버와 어플리케이션과의 통신  (0) 2011.09.26
후킹을 통한 프로세스 및 파일 보호  (0) 2011.09.22
  Comments,     Trackbacks
카테고리
최근 작성 글
최근 작성 댓글
최근 작성 트랙백
공지사항
링크
글 보관함
캘린더
«   2024/04   »
일 월 화 수 목 금 토
1 2 3 4 5 6
7 8 9 10 11 12 13
14 15 16 17 18 19 20
21 22 23 24 25 26 27
28 29 30
태그
xref77ddosdispatchCVE-2010-3962invalid flag referenceMS WBT SERVERversion.dat33ddosida.cfgida cfg북위례vspherehtml colorsetupball.bmpSystemInformationClassNtMapViewOfSectionWinDbgMUICacheIDAbreadkpointwintmp.datSYSTEM_INFORMATION_CLASSprintSepsRemote Desktop Packetwinurl.datahnurl.sysRDTiocontrolcode예치금koobface
TODAY TOTAL
아리스리's Blog : Powered by and Designed by Lawlite

티스토리툴바