2008-04-07

8 new messages in 5 topics - digest

microsoft.public.development.device.drivers
http://groups.google.com/group/microsoft.public.development.device.drivers?hl=en

microsoft.public.development.device.drivers@googlegroups.com

Today's topics:

* Determining a virtual COM port of an USB device - 2 messages, 2 authors
http://groups.google.com/group/microsoft.public.development.device.drivers/browse_thread/thread/7ced944dc5159c9d?hl=en
* about NDIS_WDM - 1 messages, 1 author
http://groups.google.com/group/microsoft.public.development.device.drivers/browse_thread/thread/3f9ddc4640a63dae?hl=en
* The problem of NdisAllocateBuffer In VMWare - 3 messages, 2 authors
http://groups.google.com/group/microsoft.public.development.device.drivers/browse_thread/thread/f4745546f672b3eb?hl=en
* File System Hook - 1 messages, 1 author
http://groups.google.com/group/microsoft.public.development.device.drivers/browse_thread/thread/8bd85e79bb10ae4f?hl=en
* DeviceIoControl returning ERROR_INVALID_PARAMETER - 1 messages, 1 author
http://groups.google.com/group/microsoft.public.development.device.drivers/browse_thread/thread/e77671298696bb8f?hl=en

==============================================================================
TOPIC: Determining a virtual COM port of an USB device
http://groups.google.com/group/microsoft.public.development.device.drivers/browse_thread/thread/7ced944dc5159c9d?hl=en
==============================================================================

== 1 of 2 ==
Date: Sat, Apr 5 2008 11:09 pm
From: "Pavel A."


<chris.aseltine@gmail.com> wrote in message
news:df83d95c-a9eb-4683-9141-4a05ee334f15@b1g2000hsg.googlegroups.com...
.............
> In the case of the symbolic link, you can look for your device's
> hardware ID in it, so that solves your problem of distinguishing
> devices without probing.

Chris, this is risky - MS folks warned several times that the sym. link
format
can change.

--PA

== 2 of 2 ==
Date: Sun, Apr 6 2008 7:53 pm
From: chris.aseltine@gmail.com


On Apr 6, 1:09 am, "Pavel A." <pave...@NOwritemeNO.com> wrote:

> > In the case of the symbolic link, you can look for your device's
> > hardware ID in it, so that solves your problem of distinguishing
> > devices without probing.
>
> Chris, this is risky - MS folks warned several times that the sym. link
> format can change.

Yeah ... I know, I know. But think about it. What choice do you
have? When you call SetupDiEnumDeviceInterfaces() you're basically
saying "give me all the device interfaces registered on the system
with GUID X." The GUID specifies your contract with the driver. It
doesn't tell you anything about the device *behind* the driver. It
also doesn't tell you whose driver it is, either. So what's someone
supposed to do to find *their* device or *their* driver, without
actively probing each interface returned?

Looking at the doc page for SetupDiGetClassDevs, it seems to imply you
can pass a device instance ID to the function and it will limit the
results based on that ID. However I've never experimented with that.


==============================================================================
TOPIC: about NDIS_WDM
http://groups.google.com/group/microsoft.public.development.device.drivers/browse_thread/thread/3f9ddc4640a63dae?hl=en
==============================================================================

== 1 of 1 ==
Date: Sun, Apr 6 2008 8:38 pm
From: Jeff


Tks a lot!

"chris.aseltine@gmail.com" wrote:

> On Apr 3, 5:01 am, Jeff <J...@discussions.microsoft.com> wrote:
>
> > 1. I seen the following sentence in the ndiswdm.html.
> >
> > Remove all the code that are specific to interacting with NDISPROT. You
> > don't have to open a USB device by calling Zw function .
> >
> > I don't know what's the mean of the sentice?
>
> Meaning, if your network adapter loads as the function driver for a
> USB device, your next lower I/O target will be the USB stack PDO
> itself. Therefore, you can do I/O simply by sending URBs down the
> stack, rather than opening a remote I/O target.
>
> > 2. how to config usb device in NICInitAdapterWorker routine?
>
> At a minimum, you'll need to configure and send a SELECT_CONFIGURATION
> URB to your device in order to configure it on the bus and also get
> handles for any pipes that the device exposes.
>


==============================================================================
TOPIC: The problem of NdisAllocateBuffer In VMWare
http://groups.google.com/group/microsoft.public.development.device.drivers/browse_thread/thread/f4745546f672b3eb?hl=en
==============================================================================

== 1 of 3 ==
Date: Sun, Apr 6 2008 8:27 pm
From: havegone

Hi
Now, I want to construct my own icmp packet in IM, but when the
driver running to NdisAllocateBuffer, the computer shut down at once,
the blue screen output the message is DRIVER_LESS_OR_EQUAL_IRQL. I donot
know why, eventhought I lower the IRQL. In addition,
NdisAllocateBufferPool
return Successful, but the return pool handle is NULL.

--
havegone
------------------------------------------------------------------------
Posted via http://www.codecomments.com
------------------------------------------------------------------------

== 2 of 3 ==
Date: Sun, Apr 6 2008 11:08 pm
From: PCAUSA


On Apr 6, 11:27 pm, havegone <havegone.37h...@mail.codecomments.com>
wrote:
> Hi
> Now, I want to construct my own icmp packet in IM, but when the
> driver running to NdisAllocateBuffer, the computer shut down at once,
> the blue screen output the message is DRIVER_LESS_OR_EQUAL_IRQL. I donot
> know why, eventhought I lower the IRQL. In addition,
> NdisAllocateBufferPool
> return Successful, but the return pool handle is NULL.
>
> --
> havegone
> ------------------------------------------------------------------------
> Posted viahttp://www.codecomments.com
> ------------------------------------------------------------------------

NdisAllocateBufferPool returns NULL on current Windows versions. So,
that is nothing to worry about.

Clearly some parameter that you are passing to NdisAllocateBuffer is
invalid.

You do understand that the fourth parameter (VirtualAddress) is an
input to NdisAllocateBuffer. You should have allocated the virtual
memory before making the call.

You simply cannot lower IRQL ever!!! You can only raise IRQL. You can
only call NdisAllocateBuffer when you are at IRQL <= DISPATCH_LEVEL.

It is also vertain that the bug you are seeing has nothing specific to
do with VMWare.

This paper at NDIS.com may be helpful:

http://ndis.com/papers/ndispacket/ndispacket1.htm

Thomas F. Divine
http://www.pcausa.com

== 3 of 3 ==
Date: Sun, Apr 6 2008 11:11 pm
From: PCAUSA


On Apr 7, 2:08 am, PCAUSA <pca...@gmail.com> wrote:
> On Apr 6, 11:27 pm, havegone <havegone.37h...@mail.codecomments.com>
> wrote:
>
> > Hi
> > Now, I want to construct my own icmp packet in IM, but when the
> > driver running to NdisAllocateBuffer, the computer shut down at once,
> > the blue screen output the message is DRIVER_LESS_OR_EQUAL_IRQL. I donot
> > know why, eventhought I lower the IRQL. In addition,
> > NdisAllocateBufferPool
> > return Successful, but the return pool handle is NULL.
>
> > --
> > havegone
> > ------------------------------------------------------------------------
> > Posted viahttp://www.codecomments.com
> > ------------------------------------------------------------------------
>
> NdisAllocateBufferPool returns NULL on current Windows versions. So,
> that is nothing to worry about.
>
> Clearly some parameter that you are passing to NdisAllocateBuffer is
> invalid.
>
> You do understand that the fourth parameter (VirtualAddress) is an
> input to NdisAllocateBuffer. You should have allocated the virtual
> memory before making the call.
>
> You simply cannot lower IRQL ever!!! You can only raise IRQL. You can
> only call NdisAllocateBuffer when you are at IRQL <= DISPATCH_LEVEL.
>
> It is also vertain that the bug you are seeing has nothing specific to
> do with VMWare.
>
> This paper at NDIS.com may be helpful:
>
> http://ndis.com/papers/ndispacket/ndispacket1.htm
>
> Thomas F. Divinehttp://www.pcausa.com

Sorry. You can certainly lower IRQL _IFF_ you have previously raised
it yourself but I don't think that is what you are talking about.

Good luck,

Thomas F. Divine
http://www.pcausa.com


==============================================================================
TOPIC: File System Hook
http://groups.google.com/group/microsoft.public.development.device.drivers/browse_thread/thread/8bd85e79bb10ae4f?hl=en
==============================================================================

== 1 of 1 ==
Date: Mon, Apr 7 2008 12:02 am
From: doskey


On 4月6日, 上午11时17分, "Allan" <mmr...@hotmail.com> wrote:
> Thanks! I had just got the answer too.
>
> Ok. I had found the solution.
> There is no need to track the file handle for my case.
> I just need to track the event to "File Open" to the Config.ini file, and
> track a corresponding "File Close" event. I would be able to tell the same
> handle had written data to the Config.ini file.
>
> There is a ready made software File Monitor or Process Monitor.
>
> http://technet.microsoft.com/en-us/sysinternals/bb545046.aspx
>
> // File Open
> 8:10:06 PM Project1.exe:1856 C:\gb\file.txt Options: OverwriteIf Access:
> 00120196
> 8:10:06 PM Project1.exe:1856 C:\gb\ Options: Open Directory Access:
> 00100000
>
> // File Write Data
> 8:10:11 PM Project1.exe:1856 Msimtf.dll Attributes: A
> 8:10:11 PM Project1.exe:1856 Msimtf.dll Options: Open Access: 00100020
> 8:10:11 PM Project1.exe:1856 Msimtf.dll Length: 159232
> 8:10:11 PM Project1.exe:1856 Msimtf.dll
> 8:10:11 PM Project1.exe:1856 Msimtf.dll
> 8:10:11 PM Project1.exe:1856 Msimtf.dll Attributes: A
> 8:10:11 PM Project1.exe:1856 Msimtf.dll Options: Open Access: 00100020
> 8:10:11 PM Project1.exe:1856 Msimtf.dll Length: 159232
> 8:10:11 PM Project1.exe:1856 Msimtf.dll
> 8:10:11 PM Project1.exe:1856 Msimtf.dll
>
> // File Close
> 8:10:16 PM Project1.exe:1856 C:\gb\file.txt Offset: 0 Length: 5
> 8:10:16 PM Project1.exe:1856 C:\gb\file.txt
> 8:10:16 PM Project1.exe:1856 C:
> 8:10:16 PM Project1.exe:1856 C:\gb\file.txt
>
> "Maxim S. Shatskih" <ma...@storagecraft.com> wrote in messagenews:e9DjI$wlIHA.5268@TK2MSFTNGP05.phx.gbl...
>
> > FILEMON
>
> > --
> > Maxim Shatskih, Windows DDK MVP
> > StorageCraft Corporation
> > ma...@storagecraft.com
> >http://www.storagecraft.com
>
> > "Allan" <mmr...@hotmail.com> wrote in message
> >news:uJGDe6wlIHA.4684@TK2MSFTNGP06.phx.gbl...
> >> I need to monitor a particular file if the same file handle is being used
> >> to
> >> write data to it.
> >> Is it possible to hook the file system to get information like these?
> >> Is there ready made software that does this?
>
> >> File File Handle Event
> >> Config.ini 1 File Opened
> >> Config.ini 1 File Append Data
> >> Config.ini 1 File Append Data
> >> Config.ini 1 File Append Data
> >> Config.ini 1 File Closed

I think you don't need FSD filter or minifilter driver.
You maybe need a SSDT hook driver. You can hook some native API such
as NtCreateFile, NtWriteFile and NtReadFile.
I think it can do this case. :)


==============================================================================
TOPIC: DeviceIoControl returning ERROR_INVALID_PARAMETER
http://groups.google.com/group/microsoft.public.development.device.drivers/browse_thread/thread/e77671298696bb8f?hl=en
==============================================================================

== 1 of 1 ==
Date: Mon, Apr 7 2008 12:07 am
From: mooni


Hi all,

I got handle of my USB disk using following instruction.
handle = CreateFile(dev_name, 0, 0, NULL, OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL, NULL);

I am getting this handle successfully. The problem I was facing previously
was that my ISR was not getting invoked on attaching USB disk. What I did, I
checked the registry values and found out that I was passing wrong GUID in
notification filter. Just to tell you I was passing {0xc5e4c602, 0xa413,
0x4caa, {0x9b, 0xbd, 0x2e, 0x35, 0x4c, 0x1b, 0xdd, 0xfc}} which was not
working.

I then had to look in registery that when I plug in my device it is
registered at some other Interface GUID which is {0xa5dcbf10, 0x6530, 0x11d2,
{0x90, 0x1f, 0x00, 0xc0, 0x4f, 0xb9, 0x51, 0xed}}.

Now when I set this value in notification filter and then pass this
notification filter to RegisterDeviceNotification I get ISR invoked
successfully.

But now the problem is that when I call DeviceIoControl method as shown
below it returns error. I've checked the error code and it is returning error
number 87 which means invalid parameter. code snippet is below

unsigned int usb_get_last_status(libusb_usb_dev_handle *dev)
{
usb_context_t ctx;
unsigned int ret = 0;
DWORD err = 0;
unsigned int status = 0xfffffffe;

memset(&ctx, 0, sizeof(usb_context_t));
ctx.dev = dev;
ctx.control_code = LIBUSB_IOCTL_USBD_STATUS_READ;
ctx.ol.Offset = 0;
ctx.ol.OffsetHigh = 0;
ctx.ol.hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);

if(ctx.ol.hEvent)
{
ResetEvent(ctx.ol.hEvent);
if(!DeviceIoControl(ctx.dev->impl_info,
ctx.control_code,&ctx.req,sizeof(ctx.req),
&status,
sizeof(status),
&ret,
&ctx.ol))
{
err = GetLastError();
}

..........................
Can anyone tell me the reason of it and any solution to the problem?

==============================================================================

You received this message because you are subscribed to the Google Groups "microsoft.public.development.device.drivers"
group.

To post to this group, visit http://groups.google.com/group/microsoft.public.development.device.drivers?hl=en

To unsubscribe from this group, send email to microsoft.public.development.device.drivers-unsubscribe@googlegroups.com

To change the way you get mail from this group, visit:
http://groups.google.com/group/microsoft.public.development.device.drivers/subscribe?hl=en

To report abuse, send email explaining the problem to abuse@googlegroups.com

==============================================================================
Google Groups: http://groups.google.com?hl=en

No comments: