CreateMutex
까보면 다나와~
분류 전체보기 (216)

Truman(PXE를 활용한 악성코드 동적분석 툴) - troubleshooting

.....안돼는 원인을 안거 같다.

Truman은 오래전에 만들어진 것이고, IDE hard disk 상에서 돌아간다.
지금은 SCSI를 사용하고 그것은 커널상의 문제가 있기 때문이다.
따라서 예전 커널을 사용하는 Linux를 사용하면 IDE hard를 hda로 포멧이 가능해서
dd 명령을 구현가능하다.

결론은 정말 포기..

아오!!!

  Comments,     Trackbacks

온라인 게임 드롭퍼
01.exe(3BDC8A7D5A8DDD71E58A5E85AFE43C27) 2011/01/xx

주요 핵심 루틴
1. exception
2. Anti - AntiVirus(AYAgent.aye SkyMon.exe),
 (CreateToolhelp32Snapshot -> Process32First -> _stricmp -> OpenProcess -> TerminateProcess) 프로세스 종료 루틴
3. WFP unlock - sfc_os.dll #5
4. MoveFileExA ComRes.dll -> ComResA.dll
5. CreateFile(FindResourceA) -> ComRes.dll
6. delete itself (wsprintfA -> WinExec)

ps. dummy API - lstrcmpA
  Comments,     Trackbacks

spoo1sv.exe 분석내용(이미지 포함)
처리님 블로그거 불펌????!!! ㅋㅋ

--------------------------------------------------------------------

최근 정상파일을 변경하여 악의적인 목적으로 사용되는 경우가 매우 많이 일어나고 있기 때문에 이번 내용은 이슈는 아니다.
하지만, 이 포스팅을 쓰는 이유는 기존에 나왔던 파일과는 다른 파일명을 사용하여서 기록용으로 포스팅을 한다.

ws2help.dll은 기본적인 Windows에 들어가 있는 정상파일로써, 최근 악성코드에 의해 변조되어 악의적인 행위로 사용되고 있다.
<정상파일 정보>
파일명 : ws2help.dll(Windows Socket 2.0 Helper for Windows NT)
파일위치 : C:\Windows\system32
 


1DB51F51F0602A8FA74AB4FD3E6A872B,19968(XP SP2) - 5.1.2600.2180
90AFFACB3C4F110BA63DF2BE93F2E41A,19968(XP SP3) - 5.1.2600.5512
808AABDF9337312195CAFF76D1804786, 4608(Win7 SP1) -  6.1.7600.16385


이번 악성코드의 특징은 악성 ws2help.dll 과 드롭퍼 자체를 DAT 파일로 백업하여 생성 해 둔 파일이 삭제 시 원상복구 시킨다.
전체적인 흐름은 아래 그림과 같다!!



- 생성 되는 악성 파일
C:\Windows\spoo1sv.exe 
C:\WINDOWS\system32\ws2help.dll
C:\WINDOWS\system32\wimedump.dll 
C:\Windows\tasks\SA01.dat

C:\Windows\tasks\SA02.dat



그럼 간단하게 분석을 해보자~!!

우선 드롭퍼는 자신이 해당 PC에서 자신의 파일이 실행되었는지 Windows폴더에 winurl.dat 확인한다.


이후 감염PC에 생성 할 ws2help.dll의 백업파일을 C:\WINDOWS\tasks\SA01.dat로 생성한다.
여기서 재미있는것은 헤더 시그니쳐를 0x30, 0x30 으로 수정한다는 점이다.(보안제품의 탐지를 우회하려는 행위 인듯...)





악성 ws2help.dll의 백업이 끝나면 현재 실행중인 드롭퍼 또한 C:\WINDOWS\tasks\SA02.dat 파일로 백업시킨다.
그리고 C:\WINDOWS\Windows폴더에 spoo1sv.exe 로 복사한다.




자신의 복사 및 백업파일 저장 작업이 끝나면 ws2help.dll 파일에 대한 WFP(Windows File Protection)를 해제한다.
그리고 %system32%폴더에 wimedump.dll 파일이 있는지 확인 후, 없다면 정상 ws2help.dll 파일을 wimedump.dll 파일이름으로
변경한다.  




그리고 system32폴더와 system32\dllcache 폴더에 리소스로 가지고 있던 악성 ws2help.dll 파일을 생성한다.



이번 악성 ws2help.dll의 경우는 원본파일의 코드를 가지고 있지 않아서 백업 한 wimedump.dll 파일의 Export Table을 참조한다.





모든 작업을 마친 드롭퍼는 자신을 삭제하고 ws2help.dll에 의해 windows폴더내의 spoo1sv.exe 행태로 다시 실행된다. spoo1sv.exe로 실행되면 처음과 다른 아래와 같은 루트를 따라간다.

삭제시키는 국내 보안프로그램은 아래그림과 같이 V3 365, V3 Lite, Naver 백신, Alyac 총 4가지이며 알약은 1.0만 해당된다.(2.0은 안전) 



현재 알약에서는 Spyware.OnlineGames.wime, Trojan.Drpper.OnlineGames.wime으로 탐지한다.



  Comments,     Trackbacks

spoo1sv.exe

spoo1sv.exe (게임 계정 해킹 프로그램 드럽퍼)

-> IAT reconstruction
-> Create "C:\\WINDOWS\\tasks\\SA01.dat" (Resource of Malicious Dll) -> MZ => 3030
-> Copy itself "C:\\WINDOWS\\tasks\\SA02.dat"
-> Copy itself "C:\\WINDOWS\\spoo1sv.exe"
-> Change signature "C:\\WINDOWS\\tasks\\SA02.dat" MZ to 00
-> sfc_os.dll load and WPA clear ("C:\\WINDOWS\\system32\\ws2help.dll", "C:\\WINDOWS\\system32\\dllcache\\ws2help.dll")
-> check "%system32%\wimedump.dll" file exists. if the file does not exists, move file from wehelp.dll to wimedump.dll(same directory)
-> Create "C:\\WINDOWS\\system32\\ws2help.dll" (Resource of Malicious Dll)
-> Copy "C:\\WINDOWS\\system32\\ws2help.dll" to "C:\\WINDOWS\\system32\\dllcache\\ws2help.dll"
-> Create_Version_File
-> Delete itself

추가 - (우와 이거때문에 많은 분이 찾으셨네요.)

치료하려면
0. 우선 프로세스 목록에서 spoo1sv.exe를 종료하고 spoo1sv.exe를 삭제
1. "C:\windows\system32\dllcache\ws2help.dll" -> 삭제
2. "C:\windows\system32\ws2help.dll" -> 삭제
3. "C:\windows\system32\wimedump.dll.dll" -> ws2help.dll로 이름 변경 ->
"C:\windows\system32\dllcache\"에 복사
4. windows 폴더에서 winurl.dat, version.dat 삭제

또는 알약2.0 버젼으로 설치하셔서 치료(2.0대 버젼에서 안티백신 로직을 잘 피해갔네요.)

  Comments,     Trackbacks

Ubuntu 10.04 LTS, PXE + Truman 설치

기초 지식,
# Ubuntu 10.04 LTS는 NTFS를 마운트 하기 위한 별도의 패키지가 필요하지 않다.
# Ubuntu 10.04 LTS의 PXE 셋팅을 위해서는 DHCP server(dhcp3-server), TFTP server(xinetd + tftpd-hpa)가 셋팅되어야 한다.
# xinetd와 inetd는 같이 설치될 수 없다. inetd는 openbsd-inetd가 있다.(Truman은 xinetd가 필요)
# 만약 VMware 내에서 Network 구성을 하고자 하면 같은 NIC을 가지고 하면 된다.

1. apt-get -y install dhcp3-server apache2 xinetd tftpd-hpa
::PXE 구성을 위해

2. apt-get -y install tcpdump ngrep wireshark
::Truman 설치를 위해

3. 그외 각종 설정...차후 보강
  Comments,     Trackbacks

Volume, Cluster, Block, Page, Sector

정리가 안돼서 일단 적어본다.

Volume - 디스크에서 하나의 논리적인 파티션.
Cluster - Sector들의 모음, Windows에서 사용하는 모든 파일 시스템은 파일을 저장하기 위해 할당할 수 있는 가장 작은 디스크 공간을 나타내는 클러스터 크기를 기반으로 하드디스크를 구성
FAT 시스템에서는 512 바이트 단위로 맞춰져있음.

Cluster의 경우 512 byte ~ 4 kbyte단위로 각각 나뉘는데
512byte는 1 Cluster가 1 Sector, 4 kbyte는 1 Cluster가 8 Sector이다.
클러스터 크기 최대 NTFS 볼륨 크기(바이트 RAW)
512 2,199,023,255,552(2TB)
1024 4,398,046,511,104(4TB)
2048 8,796,093,022,208(8TB)
4096 17,592,186,044,416(17TB)

볼륨 크기 NTFS 클러스터 크기
7MB - 512MB 512바이트
513MB - 1,024MB 1KB
1,025MB - 2GB 2KB
2GB - 2TB 4KB

따라서 클러스터는 파일 저장에 필요한 최소한의 단위이고, Sector는 클러스터 크기를 지정하는 기준이 되는 것으로 512바이트를 보통 사용한다.

하지만 새로운 하드디스크의 경우 4096 byte를 한 Sector로 사용한다.(-_-).



Block - 이것은 NTFS에서 사용하는 클러스터와 같은 것임
Page - 물리디스크를 논리적으로 분리할때 필요한 단위....(-_-), 4096 byte가 1 page라고.. 알고있음.


총 정리하면...확실하지 않지만,,
Volume은 파티션이고, Cluster는 sector(512)들의 묶음이자 데이터 블록으로도 불린다. 보통 Cluster는 4096 kib(8 sector) 크기이며, Logical Block Address(LBA)는 하드시스크 전체에서 본 Sector의 주소라고 보면 될 것 같다.

http://www.ntfs.com/hard-disk-basics.htm
여기에 더 잘 나와있음.

almost always 512 bytes in size because 512
if the file size is 800 bytes, two 512 k sectors are allocated for the file.
Cluster size can be changed to optimize file storage.


따라서 클러스터의 크기는 가변적이고 섹터의 크기는 거의 512로 고정되어있다고 생각하면 될 듯
  Comments,     Trackbacks

IOCTL definitions for the SCSI scanner device driver
퍼옴
- http://kztechs.googlecode.com/svn/trunk/trunk/include/ntddk/inc/ddk/wlh/scsiscan.h
 


/****************************************************************************
*
*  (C) COPYRIGHT 1996-2000, MICROSOFT CORP.
*
*  FILE:        scsiscan.h
*
*  VERSION:     1.0
*
*  DATE:        2/11/1997
*
*  DESCRIPTION:
*    IOCTL definitions for the SCSI scanner device driver.
*
*****************************************************************************/

//
// Turns off []
//
#pragma warning(disable : 4200)

#ifndef _SCSISCAN_H_
#define _SCSISCAN_H_

// SCSISCAN_CMD.SrbFlags

#define SRB_FLAGS_DISABLE_SYNCH_TRANSFER    0x00000008
#define SRB_FLAGS_DISABLE_AUTOSENSE         0x00000020
#define SRB_FLAGS_DATA_IN                   0x00000040
#define SRB_FLAGS_DATA_OUT                  0x00000080
#define SRB_FLAGS_NO_DATA_TRANSFER          0x00000000

// SCSISCAN_CMD.SrbStatus definitions

#define SRB_STATUS_PENDING                  0x00
#define SRB_STATUS_SUCCESS                  0x01
#define SRB_STATUS_ABORTED                  0x02
#define SRB_STATUS_ABORT_FAILED             0x03
#define SRB_STATUS_ERROR                    0x04
#define SRB_STATUS_BUSY                     0x05
#define SRB_STATUS_INVALID_REQUEST          0x06
#define SRB_STATUS_INVALID_PATH_ID          0x07
#define SRB_STATUS_NO_DEVICE                0x08
#define SRB_STATUS_TIMEOUT                  0x09
#define SRB_STATUS_SELECTION_TIMEOUT        0x0A
#define SRB_STATUS_COMMAND_TIMEOUT          0x0B
#define SRB_STATUS_MESSAGE_REJECTED         0x0D
#define SRB_STATUS_BUS_RESET                0x0E
#define SRB_STATUS_PARITY_ERROR             0x0F
#define SRB_STATUS_REQUEST_SENSE_FAILED     0x10
#define SRB_STATUS_NO_HBA                   0x11
#define SRB_STATUS_DATA_OVERRUN             0x12
#define SRB_STATUS_UNEXPECTED_BUS_FREE      0x13
#define SRB_STATUS_PHASE_SEQUENCE_FAILURE   0x14
#define SRB_STATUS_BAD_SRB_BLOCK_LENGTH     0x15
#define SRB_STATUS_REQUEST_FLUSHED          0x16
#define SRB_STATUS_INVALID_LUN              0x20
#define SRB_STATUS_INVALID_TARGET_ID        0x21
#define SRB_STATUS_BAD_FUNCTION             0x22
#define SRB_STATUS_ERROR_RECOVERY           0x23

#define SRB_STATUS_QUEUE_FROZEN             0x40
#define SRB_STATUS_AUTOSENSE_VALID          0x80

#define SRB_STATUS(Status) (Status & ~(SRB_STATUS_AUTOSENSE_VALID | SRB_STATUS_QUEUE_FROZEN))

typedef struct _SCSISCAN_CMD {
	ULONG   Reserved1;	
	ULONG   Size;
	ULONG   SrbFlags;				
	UCHAR   CdbLength;
	UCHAR   SenseLength;
	UCHAR	Reserved2;
	UCHAR	Reserved3;
	ULONG   TransferLength;
	UCHAR	Cdb[16];	
	PUCHAR  pSrbStatus;
	PUCHAR	pSenseBuffer;
} SCSISCAN_CMD, *PSCSISCAN_CMD;
	
// Temporarily set to 128. Should be determined by other definition.
#define MAX_STRING 128

typedef struct _SCSISCAN_INFO{
	ULONG   Size;
	ULONG   Flags;
    UCHAR   PortNumber;
    UCHAR   PathId;
    UCHAR   TargetId;
    UCHAR   Lun;
    UCHAR   AdapterName[MAX_STRING];
	ULONG   Reserved;
} SCSISCAN_INFO, *PSCSISCAN_INFO;

#define SCSISCAN_RESERVED         0x000
#define SCSISCAN_CMD_CODE         0x004
#define SCSISCAN_LOCKDEVICE       0x005
#define SCSISCAN_UNLOCKDEVICE     0x006
#define SCSISCAN_SET_TIMEOUT      0x007
#define SCSISCAN_GET_INFO         0x008

//---------------------------------------------------------------------------
// IOCTL definitions.
// Use these definitions when calling DeviceIoControl
//---------------------------------------------------------------------------
#define IOCTL_SCSISCAN_CMD		     CTL_CODE(FILE_DEVICE_SCANNER, SCSISCAN_CMD_CODE,	    METHOD_OUT_DIRECT, FILE_ANY_ACCESS)
#define IOCTL_SCSISCAN_LOCKDEVICE    CTL_CODE(FILE_DEVICE_SCANNER, SCSISCAN_LOCKDEVICE,		METHOD_OUT_DIRECT, FILE_ANY_ACCESS)
#define IOCTL_SCSISCAN_UNLOCKDEVICE  CTL_CODE(FILE_DEVICE_SCANNER, SCSISCAN_UNLOCKDEVICE,	METHOD_OUT_DIRECT, FILE_ANY_ACCESS)
#define IOCTL_SCSISCAN_SET_TIMEOUT   CTL_CODE(FILE_DEVICE_SCANNER, SCSISCAN_SET_TIMEOUT,	METHOD_BUFFERED,   FILE_ANY_ACCESS)
#define IOCTL_SCSISCAN_GET_INFO      CTL_CODE(FILE_DEVICE_SCANNER, SCSISCAN_GET_INFO   ,	METHOD_OUT_DIRECT, FILE_ANY_ACCESS)

#endif


  Comments,     Trackbacks

IO_STACK_LOCATION defines (Major 함수별 파라미터)

Ref-

http://www.osronline.com/ddkx/kmarch/k112_49bm.htm


IO_STACK_LOCATION

The IO_STACK_LOCATION structure defines an I/O stack location, which is an entry in the I/O stack that is associated with each IRP. Each I/O stack location in an IRP has some common members and some request-type-specific members.

typedef struct _IO_STACK_LOCATION {
  UCHAR  MajorFunction;
  UCHAR  MinorFunction;
  UCHAR  Flags;
  UCHAR  Control;
  union {
        //
        // Parameters for IRP_MJ_CREATE 
        //
        struct {
            PIO_SECURITY_CONTEXT SecurityContext;
            ULONG Options;
            USHORT POINTER_ALIGNMENT FileAttributes;
            USHORT ShareAccess;
            ULONG POINTER_ALIGNMENT EaLength;
        } Create;
        //
        // Parameters for IRP_MJ_READ 
        //
        struct {
            ULONG Length;
            ULONG POINTER_ALIGNMENT Key;
            LARGE_INTEGER ByteOffset;
        } Read;
        //
        // Parameters for IRP_MJ_WRITE 
        //
        struct {
            ULONG Length;
            ULONG POINTER_ALIGNMENT Key;
            LARGE_INTEGER ByteOffset;
        } Write;
        //
        // Parameters for IRP_MJ_QUERY_INFORMATION 
        //
        struct {
            ULONG Length;
            FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
        } QueryFile;
        //
        // Parameters for IRP_MJ_SET_INFORMATION 
        //
        struct {
            ULONG Length;
            FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
            PFILE_OBJECT FileObject;
            union {
                struct {
                    BOOLEAN ReplaceIfExists;
                    BOOLEAN AdvanceOnly;
                };
                ULONG ClusterCount;
                HANDLE DeleteHandle;
            };
        } SetFile;
        //
        // Parameters for IRP_MJ_QUERY_VOLUME_INFORMATION 
        //
        struct {
            ULONG Length;
            FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass;
        } QueryVolume;
        //
        // Parameters for IRP_MJ_DEVICE_CONTROL and IRP_MJ_INTERNAL_DEVICE_CONTROL 
        //
        struct {
            ULONG OutputBufferLength;
            ULONG POINTER_ALIGNMENT InputBufferLength;
            ULONG POINTER_ALIGNMENT IoControlCode;
            PVOID Type3InputBuffer;
        } DeviceIoControl;
        //
        // Nonsystem service parameters.
        //
        // Parameters for IRP_MN_MOUNT_VOLUME 
        //
        struct {
            PVOID DoNotUse1;
            PDEVICE_OBJECT DeviceObject;
        } MountVolume;
        //
        // Parameters for IRP_MN_VERIFY_VOLUME 
        //
        struct {
            PVOID DoNotUse1;
            PDEVICE_OBJECT DeviceObject;
        } VerifyVolume;
        //
        // Parameters for Scsi using IRP_MJ_INTERNAL_DEVICE_CONTROL 
        //
        struct {
            struct _SCSI_REQUEST_BLOCK *Srb;
        } Scsi;
        //
        // Parameters for IRP_MN_QUERY_DEVICE_RELATIONS 
        //
        struct {
            DEVICE_RELATION_TYPE Type;
        } QueryDeviceRelations;
        //
        // Parameters for IRP_MN_QUERY_INTERFACE 
        //
        struct {
            CONST GUID *InterfaceType;
            USHORT Size;
            USHORT Version;
            PINTERFACE Interface;
            PVOID InterfaceSpecificData;
        } QueryInterface;
        //
        // Parameters for IRP_MN_QUERY_CAPABILITIES 
        //
        struct {
            PDEVICE_CAPABILITIES Capabilities;
        } DeviceCapabilities;
        //
        // Parameters for IRP_MN_FILTER_RESOURCE_REQUIREMENTS 
        //
        struct {
            PIO_RESOURCE_REQUIREMENTS_LIST IoResourceRequirementList;
        } FilterResourceRequirements;
        //
        // Parameters for IRP_MN_READ_CONFIG and IRP_MN_WRITE_CONFIG 
        //
        struct {
            ULONG WhichSpace;
            PVOID Buffer;
            ULONG Offset;
            ULONG POINTER_ALIGNMENT Length;
        } ReadWriteConfig;
        //
        // Parameters for IRP_MN_SET_LOCK 
        //
        struct {
            BOOLEAN Lock;
        } SetLock;
        //
        // Parameters for IRP_MN_QUERY_ID 
        //
        struct {
            BUS_QUERY_ID_TYPE IdType;
        } QueryId;
        //
        // Parameters for IRP_MN_QUERY_DEVICE_TEXT 
        //
        struct {
            DEVICE_TEXT_TYPE DeviceTextType;
            LCID POINTER_ALIGNMENT LocaleId;
        } QueryDeviceText;
        //
        // Parameters for IRP_MN_DEVICE_USAGE_NOTIFICATION 
        //
        struct {
            BOOLEAN InPath;
            BOOLEAN Reserved[3];
            DEVICE_USAGE_NOTIFICATION_TYPE POINTER_ALIGNMENT Type;
        } UsageNotification;
        //
        // Parameters for IRP_MN_WAIT_WAKE 
        //
        struct {
            SYSTEM_POWER_STATE PowerState;
        } WaitWake;
        //
        // Parameter for IRP_MN_POWER_SEQUENCE 
        //
        struct {
            PPOWER_SEQUENCE PowerSequence;
        } PowerSequence;
        //
        // Parameters for IRP_MN_SET_POWER and IRP_MN_QUERY_POWER 
        //
        struct {
            ULONG SystemContext;
            POWER_STATE_TYPE POINTER_ALIGNMENT Type;
            POWER_STATE POINTER_ALIGNMENT State;
            POWER_ACTION POINTER_ALIGNMENT ShutdownType;
        } Power;
        //
        // Parameters for IRP_MN_START_DEVICE 
        //
        struct {
            PCM_RESOURCE_LIST AllocatedResources;
            PCM_RESOURCE_LIST AllocatedResourcesTranslated;
        } StartDevice;
        //
        // Parameters for WMI Minor IRPs 
        //
        struct {
            ULONG_PTR ProviderId;
            PVOID DataPath;
            ULONG BufferSize;
            PVOID Buffer;
        } WMI;
        //
        // Others - driver-specific
        //
        struct {
            PVOID Argument1;
            PVOID Argument2;
            PVOID Argument3;
            PVOID Argument4;
        } Others;
    } Parameters;
  PDEVICE_OBJECT  DeviceObject;
  PFILE_OBJECT  FileObject;
  .
  .
} IO_STACK_LOCATION, *PIO_STACK_LOCATION;

Members

MajorFunction
The IRP major function code indicating the type of I/O operation to be performed.
MinorFunction
A subfunction code for MajorFunction. The PnP Manager, the Power Manager, file system drivers, and SCSI class drivers set this member for some requests.
Flags
Request-type-specific values used almost exclusively by file system drivers. Removable-media device drivers check whether this member is set with SL_OVERRIDE_VERIFY_VOLUME for read requests to determine whether to continue the read operation even if the device object’s Flags is set with DO_VERIFY_VOLUME. Intermediate drivers layered over a removable-media device driver must copy this member into the I/O stack location of the next-lower driver in all incoming IRP_MJ_READ requests.
Control
Drivers can check this member to determine whether it is set with SL_PENDING_RETURNED. Drivers have read-only access to this member.
Parameters
A union that depends on the major and minor IRP function code values contained in MajorFunction and MinorFunction. For more information, see IRP Major Function Codes.
DeviceObject
A pointer to the driver-created DEVICE_OBJECT structure representing the target physical, logical, or virtual device for which this driver is to handle the IRP.
FileObject
A pointer to a FILE_OBJECT structure that represents the file object, if any, that is associated with DeviceObject pointer.

Headers

Defined in wdm.h and ntddk.h. Include wdm.h or ntddk.h.

Comments

For each IRP, there is one IO_STACK_LOCATION structure for each driver in a driver stack. Each IRP's set of I/O stack locations is appended to the IRP, following the IRP structure.

Every higher-level driver is responsible for setting up the I/O stack location for the next-lower driver in each IRP. A driver must callIoGetCurrentIrpStackLocation to get a pointer to its own stack location for each IRP. Higher-level drivers can callIoGetNextIrpStackLocation to get a pointer to the next-lower driver’s stack location.

The higher-level driver must set up the stack location contents before calling IoCallDriver to pass an IRP to the lower-level driver. If the driver will pass the input IRP on to the next lower-level driver, the dispatch routine should call IoSkipCurrentIrpStackLocation orIoCopyCurrentIrpStackLocationToNext to set up the I/O stack location of the next-lower driver.

A higher-level driver’s call to IoCallDriver sets the DeviceObject member to the next-lower-level driver’s target device object, in the I/O stack location of the lower driver. The I/O Manager passes each higher-level driver’s IoCompletion routine a pointer to its own device object when the IoCompletion routine is called on completion of the IRP.

If a higher-level driver allocates IRPs to make requests of its own, its IoCompletion routine is passed a NULL DeviceObject pointer if that driver neither allocates a stack location for itself nor sets up the DeviceObject pointer in its own stack location of the newly allocated IRP.

In some cases, a higher-level driver layered over a mass-storage device driver is responsible for splitting up large transfer requests for the underlying device driver. In particular, SCSI class drivers must check the Parameters.Read.Length and Parameters.Write.Length, determine whether the size of the requested transfer exceeds the underlying HBA’s transfer capabilities, and, if so, split the Length of the original request into a sequence of partial transfers to satisfy the original IRP.

  Comments,     Trackbacks

10byte CDB structure



아래는 명령이 WRITE(2A)일때 cdb구조


WRPROTECT가 001이면


WRPROTECT가 100이면

  Comments,     Trackbacks

SCSI REQUEST BLOCK의 CDB[0].OperationCode Commands
CDB[0] OperationCode 2A = Write

다음은 CDB에 들어가는 명령코드의 값과 행위.(나는 누구인가..여긴 또 어디인가...-_-)
List of SCSI commands
Code Command
00 TEST UNIT READY (mandatory)
01 RECALIBRATE or REWIND
03 REQUEST SENSE (mandatory except RBC)
04 FORMAT UNIT
05 READ BLOCK LIMITS
07 REASSIGN BLOCKS
07 INITIALIZE ELEMENT STATUS
08 READ (6)
0A WRITE (6)
0B SEEK (6)
0F READ REVERSE (6)
10 WRITE FILEMARKS (6)
11 SPACE (6)
12 INQUIRY (mandatory)
13 VERIFY(6)
14 RECOVER BUFFERED DATA
15 MODE SELECT (6)
16 RESERVE (6)
17 RELEASE (6)
18 COPY
19 ERASE (6)
1A MODE SENSE (6)
1B START/STOP UNIT
1B LOAD UNLOAD
1C RECEIVE DIAGNOSTIC RESULTS
1D SEND DIAGNOSTIC
1E PREVENT/ALLOW MEDIUM REMOVAL
23 READ FORMAT CAPACITIES (MMC)
24 SET WINDOW
25 READ CAPACITY (10)
28 READ (10)
29 READ GENERATION
2A WRITE (10)
2B SEEK (10)
2C ERASE (10)
2D READ UPDATED BLOCK
2E WRITE AND VERIFY (10)
2F VERIFY (10)
30 SEARCH DATA HIGH (10)
31 SEARCH DATA EQUAL (10)
32 SEARCH DATA LOW (10)
33 SET LIMITS (10)
34 PRE-FETCH (10)
35 SYNCHRONIZE CACHE (10)
36 LOCK/UNLOCK CACHE (10)
37 READ DEFECT DATA (10)
37 INITIALIZE ELEMENT STATUS WITH RANGE
38 MEDIUM SCAN
39 COMPARE
3A COPY AND VERIFY
3B WRITE BUFFER
3C READ BUFFER
3D UPDATE BLOCK
3E READ LONG
3F WRITE LONG
40 CHANGE DEFINITION
41 WRITE SAME (10)
44 REPORT DENSITY SUPPORT
45 PLAY AUDIO (10)
46 GET CONFIGURATION
47 PLAY AUDIO MSF
48 AUDIO TRACK INDEX (not mentioned in T10 overview)
49 AUDIO TRACK RELATIVE 10 (not mentioned in T10 overview)
4A GET EVENT STATUS NOTIFICATION
4B PAUSE / RESUME
4C LOG SELECT
4D LOG SENSE
50 XDWRITE (10)
51 XPWRITE (10) /*READ DISC INFORMATION CDB (in mmc5r02c 6.22.2)*/
52 XDREAD (10)
53 XDWRITEREAD (10)
54 SEND OPC INFORMATION
55 MODE SELECT (10)
56 RESERVE (10)
57 RELEASE (10)
58 REPAIR TRACK
5A MODE SENSE (10)
5B CLOSE TRACK / SESSION
5C READ BUFFER CAPACITY
5D SEND CUE SHEET
5E PERSISTENT RESERVE IN
5F PERSISTENT RESERVE OUT
7E EXTENDED CDB
7F VARIABLE LENGTH CDB
80 XDWRITE EXTENDED (16)
80 WRITE FILEMARKS (16)
81 REBUILD (16)
81 READ REVERSE (16)
82 REGENERATE (16)
83 EXTENDED COPY
84 RECEIVE COPY RESULTS
85 ATA COMMAND PASS THROUGH (16)
86 ACCESS CONTROL IN
87 ACCESS CONTROL OUT
88 READ (16)
89 COMPARE AND WRITE
8A WRITE (16)
8B ORWRITE
8C READ ATTRIBUTE
8D WRITE ATTRIBUTE
8E WRITE AND VERIFY (16)
8F VERIFY (16)
90 PRE-FETCH (16)
91 SYNCHRONIZE CACHE (16)
92 SPACE (16)
92 LOCK UNLOCK CACHE (16)
93 WRITE SAME (16)
9E SERVICE ACTION IN (16)
9F SERVICE ACTION OUT (16)
A0 REPORT LUNS
A1 ATA COMMAND PASS THROUGH (12)
A2 SECURITY PROTOCOL IN
A2 SEND EVENT (not mentioned in T10 overview)
A3 REPORT SUPPORTED OPCODES
A4 MAINTENANCE (OUT) (REPORT_KEY)
A5 MOVE MEDIUM
A5 PLAY AUDIO 12 (not mentioned in T10 overview)
A6 EXCHANGE MEDIUM
A7 MOVE MEDIUM ATTACHED
A8 READ (12)
A9 SERVICE ACTION OUT (12)
A9 AUDIO TRACK RELATIVE 12 (not mentioned in T10 overview)
AA WRITE (12)
AB SERVICE ACTION IN (12)
AC ERASE (12)
AD READ DVD STRUCTURE
AE WRITE AND VERIFY (12)
AF VERIFY (12)
B0 SEARCH DATA HIGH (12)
B1 SEARCH DATA EQUAL (12)
B2 SEARCH DATA LOW (12)
B3 SET LIMITS (12)
B4 READ ELEMENT STATUS ATTACHED
B5 SECURITY PROTOCOL OUT
B6 SEND VOLUME TAG
B7 READ DEFECT DATA (12)
B8 READ ELEMENT STATUS
B9 READ CD MSF
BA REDUNDANCY GROUP (IN)
BB REDUNDANCY GROUP (OUT)
BC SPARE (IN)
BC PLAY CD (not mentioned in T10 overview)
BD SPARE (OUT)
BE VOLUME SET (IN)
BF VOLUME SET (OUT)
  Comments,     Trackbacks