CreateMutex
까보면 다나와~
유용한 지식 자료들/드라이버, 커널 관련 (16)

IRP 구조체 중 IoStatus.Status에 대한..

irp->IoStatus.Status = 0; 

실패;


Status의 값은 IRP 요청이 성공했는지 여부를 알려주는 값을 넘겨줌.

0이 아니면 성공, 0이면 실패



  Comments,     Trackbacks

SYSTEM_INFORMATION_CLASS Enumeration


SystemInformationClass Hex값까지 추가해서 올립니다. 


Name

Value

Hex Value

SystemInformationClassMin

0

0

SystemBasicInformation

0

0

SystemProcessorInformation

1

1

SystemPerformanceInformation

2

2

SystemTimeOfDayInformation

3

3

SystemPathInformation

4

4

SystemNotImplemented1

4

4

SystemProcessInformation

5

5

SystemProcessesAndThreadsInformation

5

5

SystemCallCountInfoInformation

6

6

SystemCallCounts

6

6

SystemDeviceInformation

7

7

SystemConfigurationInformation

7

7

SystemProcessorPerformanceInformation

8

8

SystemProcessorTimes

8

8

SystemFlagsInformation

9

9

SystemGlobalFlag

9

9

SystemCallTimeInformation

10

A

SystemNotImplemented2

10

A

SystemModuleInformation

11

B

SystemLocksInformation

12

C

SystemLockInformation

12

C

SystemStackTraceInformation

13

D

SystemNotImplemented3

13

D

SystemPagedPoolInformation

14

E

SystemNotImplemented4

14

E

SystemNonPagedPoolInformation

15

F

SystemNotImplemented5

15

F

SystemHandleInformation

16

10

SystemObjectInformation

17

11

SystemPageFileInformation

18

12

SystemPagefileInformation

18

12

SystemVdmInstemulInformation

19

13

SystemInstructionEmulationCounts

19

13

SystemVdmBopInformation

20

14

SystemInvalidInfoClass1

20

14

SystemFileCacheInformation

21

15

SystemCacheInformation

21

15

SystemPoolTagInformation

22

16

SystemInterruptInformation

23

17

SystemProcessorStatistics

23

17

SystemDpcBehaviourInformation

24

18

SystemDpcInformation

24

18

SystemFullMemoryInformation

25

19

SystemNotImplemented6

25

19

SystemLoadImage

26

1A

SystemUnloadImage

27

1B

SystemTimeAdjustmentInformation

28

1C

SystemTimeAdjustment

28

1C

SystemSummaryMemoryInformation

29

1D

SystemNotImplemented7

29

1D

SystemNextEventIdInformation

30

1E

SystemNotImplemented8

30

1E

SystemEventIdsInformation

31

1F

SystemNotImplemented9

31

1F

SystemCrashDumpInformation

32

20

SystemExceptionInformation

33

21

SystemCrashDumpStateInformation

34

22

SystemKernelDebuggerInformation

35

23

SystemContextSwitchInformation

36

24

SystemRegistryQuotaInformation

37

25

SystemLoadAndCallImage

38

26

SystemPrioritySeparation

39

27

SystemPlugPlayBusInformation

40

28

SystemNotImplemented10

40

28

SystemDockInformation

41

29

SystemNotImplemented11

41

29

SystemInvalidInfoClass2

42

2A

SystemProcessorSpeedInformation

43

2B

SystemInvalidInfoClass3

43

2B

SystemCurrentTimeZoneInformation

44

2C

SystemTimeZoneInformation

44

2C

SystemLookasideInformation

45

2D

SystemSetTimeSlipEvent

46

2E

SystemCreateSession

47

2F

SystemDeleteSession

48

30

SystemInvalidInfoClass4

49

31

SystemRangeStartInformation

50

32

SystemVerifierInformation

51

33

SystemAddVerifier

52

34

SystemSessionProcessesInformation

53

35

SystemInformationClassMax

54

36


  Comments,     Trackbacks

NtQuerySystemInformation (SystemModuleInformation) 정보

먼저 NtQuerySystemInformation은 첫번째 인자인 SystemInformationClass를 참조하여 어떤 정보를 보여줄 것인지 판단하고 두번째 인자인 SystemInformation 버퍼를 통해 결과를 보여준다.

(또 NtQuerySystemInformation은 두번의 호출로 값을 얻어오기도 하는데 방식은 4번째 인자가 있고 없고의 차이가 있다. 있으면 Information 크기를 얻어오고, 없으면 Information 크기로 값을 얻어오는 것 같다. 더 확인이 필요함....그러니깐 4번쩌 인자가 들어갔을 때 그 크기를 구해오는 거고 크기를 바탕으로 다시한번 함수를 호출하는 방식으로 정보를 얻는 것..)


NtQuerySystemInformation으로 SystemModuleInformation정보를 얻고자 할 때, 로드되는 메모리 구조는 다음과 같다.



typedef struct _SYSTEM_MODULE_INFORMATION {

  ULONG                ModulesCount; 0000006f

  SYSTEM_MODULE        Modules[0];

} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;

 

typedef struct _SYSTEM_MODULE { 

 ULONG Reserved[2];     00000000 00000000

 PVOID Base;                 804d9000

 ULONG Size;                 001f8c80

 ULONG Flags;                0c004000

 USHORT Index;              0000

 USHORT Unknown;        0000

 USHORT LoadCount;      0001

 USHORT ModuleNameOffset; 0012

 CHAR ImageName[256];

} SYSTEM_MODULE , *PSYSTEM_MODULE 


위의 이미지를 예로 들면 ntkrnlpa.exe의 IMG_BASE는 '804d9000'이 되겠다.

활용하자면 NtQuerySystemInformation의 SYSTEM_MODULE_INFORMATION으로 로드된 모듈과 img base, 또는 로드된 모듈 개수, 또는 커널 이미지 정보를 확인 가능하다.


  Comments,     Trackbacks

IRP Dispatch routines

[00] IRP_MJ_CREATE
[01] IRP_MJ_CREATE_NAMED_PIPE
[02] IRP_MJ_CLOSE
[03] IRP_MJ_READ
[04] IRP_MJ_WRITE
[05] IRP_MJ_QUERY_INFORMATION
[06] IRP_MJ_SET_INFORMATION
[07] IRP_MJ_QUERY_EA
[08] IRP_MJ_SET_EA
[09] IRP_MJ_FLUSH_BUFFERS

[0a] IRP_MJ_QUERY_VOLUME_INFORMATION

[0b] IRP_MJ_SET_VOLUME_INFORMATION

[0c] IRP_MJ_DIRECTORY_CONTROL
[0d] IRP_MJ_FILE_SYSTEM_CONTROL
[0e] IRP_MJ_DEVICE_CONTROL #14번, 많이 쓰임
[0f] IRP_MJ_INTERNAL_DEVICE_CONTROL
[10] IRP_MJ_SHUTDOWN
[11] IRP_MJ_LOCK_CONTROL
[12] IRP_MJ_CLEANUP
[13] IRP_MJ_CREATE_MAILSLOT
[14] IRP_MJ_QUERY_SECURITY
[15] IRP_MJ_SET_SECURITY
[16] IRP_MJ_POWER
[17] IRP_MJ_SYSTEM_CONTROL
[18] IRP_MJ_DEVICE_CHANGE
[19] IRP_MJ_QUERY_QUOTA
[1a] IRP_MJ_SET_QUOTA
[1b] IRP_MJ_PNP

  Comments,     Trackbacks

SDT 후킹의 창과 방패에 대해 쉽게 설명한 글

http://www.imaso.co.kr/?doc=bbs/gnuboard.php&bo_table=article&wr_id=32168


아래는 커널 정보를 알아오는 코드 잘 설명한 글

http://blog.naver.com/PostView.nhn?blogId=autolee2&logNo=110090433672

  Comments,     Trackbacks

IRP_MJ_QUERY_SECURITY ?

IRP_MJ_QUERY_SECURITY ?

보안정보를 가져올 때 사용하는 함수이다. 봇에서 후킹을 하는 데, 알아보기엔 시간이...

http://msdn.microsoft.com/en-us/library/windows/hardware/ff549298(v=vs.85).aspx


Anti AV 관련한거로 추측해봅니다만, 누구 악성코드에서 왜 사용하는지 알려주세요.
plz, let me know why they are using.
  Comments,     Trackbacks

Volume, Cluster, Block, Page, Sector

정리가 안돼서 일단 적어본다.

Volume - 디스크에서 하나의 논리적인 파티션.
Cluster - Sector들의 모음, Windows에서 사용하는 모든 파일 시스템은 파일을 저장하기 위해 할당할 수 있는 가장 작은 디스크 공간을 나타내는 클러스터 크기를 기반으로 하드디스크를 구성
FAT 시스템에서는 512 바이트 단위로 맞춰져있음.

Cluster의 경우 512 byte ~ 4 kbyte단위로 각각 나뉘는데
512byte는 1 Cluster가 1 Sector, 4 kbyte는 1 Cluster가 8 Sector이다.
클러스터 크기 최대 NTFS 볼륨 크기(바이트 RAW)
512 2,199,023,255,552(2TB)
1024 4,398,046,511,104(4TB)
2048 8,796,093,022,208(8TB)
4096 17,592,186,044,416(17TB)

볼륨 크기 NTFS 클러스터 크기
7MB - 512MB 512바이트
513MB - 1,024MB 1KB
1,025MB - 2GB 2KB
2GB - 2TB 4KB

따라서 클러스터는 파일 저장에 필요한 최소한의 단위이고, Sector는 클러스터 크기를 지정하는 기준이 되는 것으로 512바이트를 보통 사용한다.

하지만 새로운 하드디스크의 경우 4096 byte를 한 Sector로 사용한다.(-_-).



Block - 이것은 NTFS에서 사용하는 클러스터와 같은 것임
Page - 물리디스크를 논리적으로 분리할때 필요한 단위....(-_-), 4096 byte가 1 page라고.. 알고있음.


총 정리하면...확실하지 않지만,,
Volume은 파티션이고, Cluster는 sector(512)들의 묶음이자 데이터 블록으로도 불린다. 보통 Cluster는 4096 kib(8 sector) 크기이며, Logical Block Address(LBA)는 하드시스크 전체에서 본 Sector의 주소라고 보면 될 것 같다.

http://www.ntfs.com/hard-disk-basics.htm
여기에 더 잘 나와있음.

almost always 512 bytes in size because 512
if the file size is 800 bytes, two 512 k sectors are allocated for the file.
Cluster size can be changed to optimize file storage.


따라서 클러스터의 크기는 가변적이고 섹터의 크기는 거의 512로 고정되어있다고 생각하면 될 듯
  Comments,     Trackbacks

IOCTL definitions for the SCSI scanner device driver
퍼옴
- http://kztechs.googlecode.com/svn/trunk/trunk/include/ntddk/inc/ddk/wlh/scsiscan.h
 


/****************************************************************************
*
*  (C) COPYRIGHT 1996-2000, MICROSOFT CORP.
*
*  FILE:        scsiscan.h
*
*  VERSION:     1.0
*
*  DATE:        2/11/1997
*
*  DESCRIPTION:
*    IOCTL definitions for the SCSI scanner device driver.
*
*****************************************************************************/

//
// Turns off []
//
#pragma warning(disable : 4200)

#ifndef _SCSISCAN_H_
#define _SCSISCAN_H_

// SCSISCAN_CMD.SrbFlags

#define SRB_FLAGS_DISABLE_SYNCH_TRANSFER    0x00000008
#define SRB_FLAGS_DISABLE_AUTOSENSE         0x00000020
#define SRB_FLAGS_DATA_IN                   0x00000040
#define SRB_FLAGS_DATA_OUT                  0x00000080
#define SRB_FLAGS_NO_DATA_TRANSFER          0x00000000

// SCSISCAN_CMD.SrbStatus definitions

#define SRB_STATUS_PENDING                  0x00
#define SRB_STATUS_SUCCESS                  0x01
#define SRB_STATUS_ABORTED                  0x02
#define SRB_STATUS_ABORT_FAILED             0x03
#define SRB_STATUS_ERROR                    0x04
#define SRB_STATUS_BUSY                     0x05
#define SRB_STATUS_INVALID_REQUEST          0x06
#define SRB_STATUS_INVALID_PATH_ID          0x07
#define SRB_STATUS_NO_DEVICE                0x08
#define SRB_STATUS_TIMEOUT                  0x09
#define SRB_STATUS_SELECTION_TIMEOUT        0x0A
#define SRB_STATUS_COMMAND_TIMEOUT          0x0B
#define SRB_STATUS_MESSAGE_REJECTED         0x0D
#define SRB_STATUS_BUS_RESET                0x0E
#define SRB_STATUS_PARITY_ERROR             0x0F
#define SRB_STATUS_REQUEST_SENSE_FAILED     0x10
#define SRB_STATUS_NO_HBA                   0x11
#define SRB_STATUS_DATA_OVERRUN             0x12
#define SRB_STATUS_UNEXPECTED_BUS_FREE      0x13
#define SRB_STATUS_PHASE_SEQUENCE_FAILURE   0x14
#define SRB_STATUS_BAD_SRB_BLOCK_LENGTH     0x15
#define SRB_STATUS_REQUEST_FLUSHED          0x16
#define SRB_STATUS_INVALID_LUN              0x20
#define SRB_STATUS_INVALID_TARGET_ID        0x21
#define SRB_STATUS_BAD_FUNCTION             0x22
#define SRB_STATUS_ERROR_RECOVERY           0x23

#define SRB_STATUS_QUEUE_FROZEN             0x40
#define SRB_STATUS_AUTOSENSE_VALID          0x80

#define SRB_STATUS(Status) (Status & ~(SRB_STATUS_AUTOSENSE_VALID | SRB_STATUS_QUEUE_FROZEN))

typedef struct _SCSISCAN_CMD {
	ULONG   Reserved1;	
	ULONG   Size;
	ULONG   SrbFlags;				
	UCHAR   CdbLength;
	UCHAR   SenseLength;
	UCHAR	Reserved2;
	UCHAR	Reserved3;
	ULONG   TransferLength;
	UCHAR	Cdb[16];	
	PUCHAR  pSrbStatus;
	PUCHAR	pSenseBuffer;
} SCSISCAN_CMD, *PSCSISCAN_CMD;
	
// Temporarily set to 128. Should be determined by other definition.
#define MAX_STRING 128

typedef struct _SCSISCAN_INFO{
	ULONG   Size;
	ULONG   Flags;
    UCHAR   PortNumber;
    UCHAR   PathId;
    UCHAR   TargetId;
    UCHAR   Lun;
    UCHAR   AdapterName[MAX_STRING];
	ULONG   Reserved;
} SCSISCAN_INFO, *PSCSISCAN_INFO;

#define SCSISCAN_RESERVED         0x000
#define SCSISCAN_CMD_CODE         0x004
#define SCSISCAN_LOCKDEVICE       0x005
#define SCSISCAN_UNLOCKDEVICE     0x006
#define SCSISCAN_SET_TIMEOUT      0x007
#define SCSISCAN_GET_INFO         0x008

//---------------------------------------------------------------------------
// IOCTL definitions.
// Use these definitions when calling DeviceIoControl
//---------------------------------------------------------------------------
#define IOCTL_SCSISCAN_CMD		     CTL_CODE(FILE_DEVICE_SCANNER, SCSISCAN_CMD_CODE,	    METHOD_OUT_DIRECT, FILE_ANY_ACCESS)
#define IOCTL_SCSISCAN_LOCKDEVICE    CTL_CODE(FILE_DEVICE_SCANNER, SCSISCAN_LOCKDEVICE,		METHOD_OUT_DIRECT, FILE_ANY_ACCESS)
#define IOCTL_SCSISCAN_UNLOCKDEVICE  CTL_CODE(FILE_DEVICE_SCANNER, SCSISCAN_UNLOCKDEVICE,	METHOD_OUT_DIRECT, FILE_ANY_ACCESS)
#define IOCTL_SCSISCAN_SET_TIMEOUT   CTL_CODE(FILE_DEVICE_SCANNER, SCSISCAN_SET_TIMEOUT,	METHOD_BUFFERED,   FILE_ANY_ACCESS)
#define IOCTL_SCSISCAN_GET_INFO      CTL_CODE(FILE_DEVICE_SCANNER, SCSISCAN_GET_INFO   ,	METHOD_OUT_DIRECT, FILE_ANY_ACCESS)

#endif


  Comments,     Trackbacks

IO_STACK_LOCATION defines (Major 함수별 파라미터)

Ref-

http://www.osronline.com/ddkx/kmarch/k112_49bm.htm


IO_STACK_LOCATION

The IO_STACK_LOCATION structure defines an I/O stack location, which is an entry in the I/O stack that is associated with each IRP. Each I/O stack location in an IRP has some common members and some request-type-specific members.

typedef struct _IO_STACK_LOCATION {
  UCHAR  MajorFunction;
  UCHAR  MinorFunction;
  UCHAR  Flags;
  UCHAR  Control;
  union {
        //
        // Parameters for IRP_MJ_CREATE 
        //
        struct {
            PIO_SECURITY_CONTEXT SecurityContext;
            ULONG Options;
            USHORT POINTER_ALIGNMENT FileAttributes;
            USHORT ShareAccess;
            ULONG POINTER_ALIGNMENT EaLength;
        } Create;
        //
        // Parameters for IRP_MJ_READ 
        //
        struct {
            ULONG Length;
            ULONG POINTER_ALIGNMENT Key;
            LARGE_INTEGER ByteOffset;
        } Read;
        //
        // Parameters for IRP_MJ_WRITE 
        //
        struct {
            ULONG Length;
            ULONG POINTER_ALIGNMENT Key;
            LARGE_INTEGER ByteOffset;
        } Write;
        //
        // Parameters for IRP_MJ_QUERY_INFORMATION 
        //
        struct {
            ULONG Length;
            FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
        } QueryFile;
        //
        // Parameters for IRP_MJ_SET_INFORMATION 
        //
        struct {
            ULONG Length;
            FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
            PFILE_OBJECT FileObject;
            union {
                struct {
                    BOOLEAN ReplaceIfExists;
                    BOOLEAN AdvanceOnly;
                };
                ULONG ClusterCount;
                HANDLE DeleteHandle;
            };
        } SetFile;
        //
        // Parameters for IRP_MJ_QUERY_VOLUME_INFORMATION 
        //
        struct {
            ULONG Length;
            FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass;
        } QueryVolume;
        //
        // Parameters for IRP_MJ_DEVICE_CONTROL and IRP_MJ_INTERNAL_DEVICE_CONTROL 
        //
        struct {
            ULONG OutputBufferLength;
            ULONG POINTER_ALIGNMENT InputBufferLength;
            ULONG POINTER_ALIGNMENT IoControlCode;
            PVOID Type3InputBuffer;
        } DeviceIoControl;
        //
        // Nonsystem service parameters.
        //
        // Parameters for IRP_MN_MOUNT_VOLUME 
        //
        struct {
            PVOID DoNotUse1;
            PDEVICE_OBJECT DeviceObject;
        } MountVolume;
        //
        // Parameters for IRP_MN_VERIFY_VOLUME 
        //
        struct {
            PVOID DoNotUse1;
            PDEVICE_OBJECT DeviceObject;
        } VerifyVolume;
        //
        // Parameters for Scsi using IRP_MJ_INTERNAL_DEVICE_CONTROL 
        //
        struct {
            struct _SCSI_REQUEST_BLOCK *Srb;
        } Scsi;
        //
        // Parameters for IRP_MN_QUERY_DEVICE_RELATIONS 
        //
        struct {
            DEVICE_RELATION_TYPE Type;
        } QueryDeviceRelations;
        //
        // Parameters for IRP_MN_QUERY_INTERFACE 
        //
        struct {
            CONST GUID *InterfaceType;
            USHORT Size;
            USHORT Version;
            PINTERFACE Interface;
            PVOID InterfaceSpecificData;
        } QueryInterface;
        //
        // Parameters for IRP_MN_QUERY_CAPABILITIES 
        //
        struct {
            PDEVICE_CAPABILITIES Capabilities;
        } DeviceCapabilities;
        //
        // Parameters for IRP_MN_FILTER_RESOURCE_REQUIREMENTS 
        //
        struct {
            PIO_RESOURCE_REQUIREMENTS_LIST IoResourceRequirementList;
        } FilterResourceRequirements;
        //
        // Parameters for IRP_MN_READ_CONFIG and IRP_MN_WRITE_CONFIG 
        //
        struct {
            ULONG WhichSpace;
            PVOID Buffer;
            ULONG Offset;
            ULONG POINTER_ALIGNMENT Length;
        } ReadWriteConfig;
        //
        // Parameters for IRP_MN_SET_LOCK 
        //
        struct {
            BOOLEAN Lock;
        } SetLock;
        //
        // Parameters for IRP_MN_QUERY_ID 
        //
        struct {
            BUS_QUERY_ID_TYPE IdType;
        } QueryId;
        //
        // Parameters for IRP_MN_QUERY_DEVICE_TEXT 
        //
        struct {
            DEVICE_TEXT_TYPE DeviceTextType;
            LCID POINTER_ALIGNMENT LocaleId;
        } QueryDeviceText;
        //
        // Parameters for IRP_MN_DEVICE_USAGE_NOTIFICATION 
        //
        struct {
            BOOLEAN InPath;
            BOOLEAN Reserved[3];
            DEVICE_USAGE_NOTIFICATION_TYPE POINTER_ALIGNMENT Type;
        } UsageNotification;
        //
        // Parameters for IRP_MN_WAIT_WAKE 
        //
        struct {
            SYSTEM_POWER_STATE PowerState;
        } WaitWake;
        //
        // Parameter for IRP_MN_POWER_SEQUENCE 
        //
        struct {
            PPOWER_SEQUENCE PowerSequence;
        } PowerSequence;
        //
        // Parameters for IRP_MN_SET_POWER and IRP_MN_QUERY_POWER 
        //
        struct {
            ULONG SystemContext;
            POWER_STATE_TYPE POINTER_ALIGNMENT Type;
            POWER_STATE POINTER_ALIGNMENT State;
            POWER_ACTION POINTER_ALIGNMENT ShutdownType;
        } Power;
        //
        // Parameters for IRP_MN_START_DEVICE 
        //
        struct {
            PCM_RESOURCE_LIST AllocatedResources;
            PCM_RESOURCE_LIST AllocatedResourcesTranslated;
        } StartDevice;
        //
        // Parameters for WMI Minor IRPs 
        //
        struct {
            ULONG_PTR ProviderId;
            PVOID DataPath;
            ULONG BufferSize;
            PVOID Buffer;
        } WMI;
        //
        // Others - driver-specific
        //
        struct {
            PVOID Argument1;
            PVOID Argument2;
            PVOID Argument3;
            PVOID Argument4;
        } Others;
    } Parameters;
  PDEVICE_OBJECT  DeviceObject;
  PFILE_OBJECT  FileObject;
  .
  .
} IO_STACK_LOCATION, *PIO_STACK_LOCATION;

Members

MajorFunction
The IRP major function code indicating the type of I/O operation to be performed.
MinorFunction
A subfunction code for MajorFunction. The PnP Manager, the Power Manager, file system drivers, and SCSI class drivers set this member for some requests.
Flags
Request-type-specific values used almost exclusively by file system drivers. Removable-media device drivers check whether this member is set with SL_OVERRIDE_VERIFY_VOLUME for read requests to determine whether to continue the read operation even if the device object’s Flags is set with DO_VERIFY_VOLUME. Intermediate drivers layered over a removable-media device driver must copy this member into the I/O stack location of the next-lower driver in all incoming IRP_MJ_READ requests.
Control
Drivers can check this member to determine whether it is set with SL_PENDING_RETURNED. Drivers have read-only access to this member.
Parameters
A union that depends on the major and minor IRP function code values contained in MajorFunction and MinorFunction. For more information, see IRP Major Function Codes.
DeviceObject
A pointer to the driver-created DEVICE_OBJECT structure representing the target physical, logical, or virtual device for which this driver is to handle the IRP.
FileObject
A pointer to a FILE_OBJECT structure that represents the file object, if any, that is associated with DeviceObject pointer.

Headers

Defined in wdm.h and ntddk.h. Include wdm.h or ntddk.h.

Comments

For each IRP, there is one IO_STACK_LOCATION structure for each driver in a driver stack. Each IRP's set of I/O stack locations is appended to the IRP, following the IRP structure.

Every higher-level driver is responsible for setting up the I/O stack location for the next-lower driver in each IRP. A driver must callIoGetCurrentIrpStackLocation to get a pointer to its own stack location for each IRP. Higher-level drivers can callIoGetNextIrpStackLocation to get a pointer to the next-lower driver’s stack location.

The higher-level driver must set up the stack location contents before calling IoCallDriver to pass an IRP to the lower-level driver. If the driver will pass the input IRP on to the next lower-level driver, the dispatch routine should call IoSkipCurrentIrpStackLocation orIoCopyCurrentIrpStackLocationToNext to set up the I/O stack location of the next-lower driver.

A higher-level driver’s call to IoCallDriver sets the DeviceObject member to the next-lower-level driver’s target device object, in the I/O stack location of the lower driver. The I/O Manager passes each higher-level driver’s IoCompletion routine a pointer to its own device object when the IoCompletion routine is called on completion of the IRP.

If a higher-level driver allocates IRPs to make requests of its own, its IoCompletion routine is passed a NULL DeviceObject pointer if that driver neither allocates a stack location for itself nor sets up the DeviceObject pointer in its own stack location of the newly allocated IRP.

In some cases, a higher-level driver layered over a mass-storage device driver is responsible for splitting up large transfer requests for the underlying device driver. In particular, SCSI class drivers must check the Parameters.Read.Length and Parameters.Write.Length, determine whether the size of the requested transfer exceeds the underlying HBA’s transfer capabilities, and, if so, split the Length of the original request into a sequence of partial transfers to satisfy the original IRP.

  Comments,     Trackbacks

10byte CDB structure



아래는 명령이 WRITE(2A)일때 cdb구조


WRPROTECT가 001이면


WRPROTECT가 100이면

  Comments,     Trackbacks