fs_rec.h File Reference

#include "ntifs.h"
#include "ntdddisk.h"
#include "ntddcdrm.h"

Go to the source code of this file.

Classes
struct	_DEVICE_EXTENSION
Defines
#define	FSREC_DEBUG_LEVEL_FSREC   0x00000001
#define	FSREC_DEBUG_LEVEL_NTFS   0x00000002
#define	FSREC_DEBUG_LEVEL_CDFS   0x00000004
#define	FSREC_DEBUG_LEVEL_UDFS   0x00000008
#define	FSREC_DEBUG_LEVEL_FAT   0x00000010
#define	FSREC_POOL_TAG   'crsF'
#define	SetFlag(Flags, SingleFlag)
#define	ClearFlag(Flags, SingleFlag)
#define	DebugTrace(M)   TRUE
Typedefs
typedef enum _FILE_SYSTEM_TYPE	FILE_SYSTEM_TYPE
typedef enum _FILE_SYSTEM_TYPE *	PFILE_SYSTEM_TYPE
typedef enum _RECOGNIZER_STATE	RECOGNIZER_STATE
typedef enum _RECOGNIZER_STATE *	PRECOGNIZER_STATE
typedef _DEVICE_EXTENSION	DEVICE_EXTENSION
typedef _DEVICE_EXTENSION *	PDEVICE_EXTENSION
Enumerations
enum	_FILE_SYSTEM_TYPE {   CdfsFileSystem = 1, FatFileSystem, HpfsFileSystem, NtfsFileSystem,   UdfsFileSystem }
enum	_RECOGNIZER_STATE { Active, Transparent, FastUnload }
Functions
NTSTATUS	DriverEntry (IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
NTSTATUS	FsRecCleanupClose (IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
NTSTATUS	FsRecCreate (IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
NTSTATUS	FsRecCreateAndRegisterDO (IN PDRIVER_OBJECT DriverObject, IN PDEVICE_OBJECT HeadRecognizer OPTIONAL, OUT PDEVICE_OBJECT *NewRecognizer OPTIONAL, IN PWCHAR RecFileSystem, IN PWCHAR FileSystemName, IN FILE_SYSTEM_TYPE FileSystemType, IN DEVICE_TYPE DeviceType)
NTSTATUS	FsRecFsControl (IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
VOID	FsRecUnload (IN PDRIVER_OBJECT DriverObject)
NTSTATUS	FsRecLoadFileSystem (IN PDEVICE_OBJECT DeviceObject, IN PWCHAR DriverServiceKey)
BOOLEAN	FsRecGetDeviceSectorSize (IN PDEVICE_OBJECT DeviceObject, OUT PULONG BytesPerSector)
BOOLEAN	FsRecGetDeviceSectors (IN PDEVICE_OBJECT DeviceObject, IN ULONG BytesPerSector, OUT PLARGE_INTEGER NumberOfSectors)
BOOLEAN	FsRecReadBlock (IN PDEVICE_OBJECT DeviceObject, IN PLARGE_INTEGER ByteOffset, IN ULONG MinimumBytes, IN ULONG BytesPerSector, OUT PVOID *Buffer, OUT PBOOLEAN IsDeviceFailure OPTIONAL)
NTSTATUS	CdfsRecFsControl (IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
NTSTATUS	UdfsRecFsControl (IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
NTSTATUS	FatRecFsControl (IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
NTSTATUS	NtfsRecFsControl (IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
NTSTATUS	ZwLoadDriver (IN PUNICODE_STRING DriverServiceName)

---

Define Documentation

#define ClearFlag (  Flags, SingleFlag   )

Value: ( \ (Flags) &= ~(SingleFlag) \ ) Definition at line 47 of file fs_rec.h.

#define DebugTrace (  M   )     TRUE

Definition at line 169 of file fs_rec.h.

#define FSREC_DEBUG_LEVEL_CDFS   0x00000004

Definition at line 37 of file fs_rec.h.

#define FSREC_DEBUG_LEVEL_FAT   0x00000010

Definition at line 39 of file fs_rec.h.

#define FSREC_DEBUG_LEVEL_FSREC   0x00000001

Definition at line 35 of file fs_rec.h.

#define FSREC_DEBUG_LEVEL_NTFS   0x00000002

Definition at line 36 of file fs_rec.h.

#define FSREC_DEBUG_LEVEL_UDFS   0x00000008

Definition at line 38 of file fs_rec.h.

#define FSREC_POOL_TAG   'crsF'

Definition at line 41 of file fs_rec.h. Referenced by DriverEntry(), and FsRecReadBlock().

#define SetFlag (  Flags, SingleFlag   )

Value: ( \ (Flags) |= (SingleFlag) \ ) Definition at line 43 of file fs_rec.h.

---

Typedef Documentation

typedef struct _DEVICE_EXTENSION DEVICE_EXTENSION

Referenced by DriverEntry().

typedef enum _FILE_SYSTEM_TYPE FILE_SYSTEM_TYPE

Referenced by FsRecCreateAndRegisterDO().

typedef struct _DEVICE_EXTENSION * PDEVICE_EXTENSION

Referenced by CdfsRecFsControl(), MapperCallback(), MapperConstructRootEnumTree(), MapperFreeList(), and MapperPhantomizeDetectedComPorts().

typedef enum _FILE_SYSTEM_TYPE * PFILE_SYSTEM_TYPE

typedef enum _RECOGNIZER_STATE * PRECOGNIZER_STATE

typedef enum _RECOGNIZER_STATE RECOGNIZER_STATE

---

Enumeration Type Documentation

enum _FILE_SYSTEM_TYPE

Enumeration values: CdfsFileSystem  FatFileSystem  HpfsFileSystem  NtfsFileSystem  UdfsFileSystem  Definition at line 55 of file fs_rec.h. { CdfsFileSystem = 1, FatFileSystem, HpfsFileSystem, NtfsFileSystem, UdfsFileSystem } FILE_SYSTEM_TYPE, *PFILE_SYSTEM_TYPE;

enum _RECOGNIZER_STATE

Enumeration values: Active  Transparent  FastUnload  Definition at line 67 of file fs_rec.h. { Active, Transparent, FastUnload } RECOGNIZER_STATE, *PRECOGNIZER_STATE;

---

Function Documentation

NTSTATUS CdfsRecFsControl (  IN PDEVICE_OBJECT  DeviceObject, IN PIRP  Irp )

Definition at line 40 of file cdfs_rec.c. References FsRecLoadFileSystem(), IO_NO_INCREMENT, IoCompleteRequest, IoGetCurrentIrpStackLocation, _IRP::IoStatus, Irp, IRP_MN_LOAD_FILE_SYSTEM, IRP_MN_MOUNT_VOLUME, L, _IO_STACK_LOCATION::MinorFunction, NTSTATUS(), PAGED_CODE, and PDEVICE_EXTENSION. Referenced by FsRecFsControl(). 00047 : 00048 00049 This function performs the mount and driver reload functions for this mini- 00050 file system recognizer driver. 00051 00052 Arguments: 00053 00054 DeviceObject - Pointer to this driver's device object. 00055 00056 Irp - Pointer to the I/O Request Packet (IRP) representing the function to 00057 be performed. 00058 00059 Return Value: 00060 00061 The function value is the final status of the operation. 00062 00063 00064 -*/ 00065 00066 { 00067 NTSTATUS status; 00068 PIO_STACK_LOCATION irpSp; 00069 PDEVICE_EXTENSION deviceExtension; 00070 00071 PAGED_CODE(); 00072 00073 // 00074 // Begin by determining what function that is to be performed. 00075 // 00076 00077 deviceExtension = (PDEVICE_EXTENSION) DeviceObject->DeviceExtension; 00078 irpSp = IoGetCurrentIrpStackLocation( Irp ); 00079 00080 switch ( irpSp->MinorFunction ) { 00081 00082 case IRP_MN_MOUNT_VOLUME: 00083 00084 // 00085 // Always request the filesystem driver. 00086 // 00087 00088 status = STATUS_FS_DRIVER_REQUIRED; 00089 break; 00090 00091 case IRP_MN_LOAD_FILE_SYSTEM: 00092 00093 status = FsRecLoadFileSystem( DeviceObject, 00094 L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Cdfs" ); 00095 break; 00096 00097 default: 00098 00099 status = STATUS_INVALID_DEVICE_REQUEST; 00100 break; 00101 } 00102 00103 // 00104 // Finally, complete the request and return the same status code to the 00105 // caller. 00106 // 00107 00108 Irp->IoStatus.Status = status; 00109 IoCompleteRequest( Irp, IO_NO_INCREMENT ); 00110 00111 return status; 00112 } }

NTSTATUS DriverEntry (  IN PDRIVER_OBJECT  DriverObject, IN PUNICODE_STRING  RegistryPath )

Definition at line 67 of file fs_rec.c. : This routine is invoked once when the driver is loaded to allow the driver to initialize itself. The initialization for the driver consists of simply creating a device object for each type of file system recognized by this driver, and then registering each as active file systems. Arguments: DriverObject - Pointer to the driver object for this driver. RegistryPath - Pointer to the registry service node for this driver. Return Value: The function value is the final status of the initialization for the driver. --*/ { PDEVICE_OBJECT UdfsMainRecognizerDeviceObject; NTSTATUS status; ULONG count = 0; PAGED_CODE(); // // Mark the entire driver as pagable. // MmPageEntireDriver ((PVOID)DriverEntry); // // Begin by initializing the driver object so that it the driver is // prepared to provide services. // DriverObject->MajorFunction[IRP_MJ_FILE_SYSTEM_CONTROL] = FsRecFsControl; DriverObject->MajorFunction[IRP_MJ_CREATE] = FsRecCreate; DriverObject->MajorFunction[IRP_MJ_CLEANUP] = FsRecCleanupClose; DriverObject->MajorFunction[IRP_MJ_CLOSE] = FsRecCleanupClose; DriverObject->DriverUnload = FsRecUnload; FsRecLoadSync = ExAllocatePoolWithTag( NonPagedPool, sizeof(KEVENT), FSREC_POOL_TAG ); if (FsRecLoadSync == NULL) { return STATUS_INSUFFICIENT_RESOURCES; } KeInitializeEvent( FsRecLoadSync, SynchronizationEvent, TRUE ); // // Create and initialize each of the file system driver type device // objects. // status = FsRecCreateAndRegisterDO( DriverObject, NULL, NULL, L"\\Cdfs", L"\\FileSystem\\CdfsRecognizer", CdfsFileSystem, FILE_DEVICE_CD_ROM_FILE_SYSTEM ); if (NT_SUCCESS( status )) { count++; } status = FsRecCreateAndRegisterDO( DriverObject, NULL, &UdfsMainRecognizerDeviceObject, L"\\UdfsCdRom", L"\\FileSystem\\UdfsCdRomRecognizer", UdfsFileSystem, FILE_DEVICE_CD_ROM_FILE_SYSTEM ); if (NT_SUCCESS( status )) { count++; } status = FsRecCreateAndRegisterDO( DriverObject, UdfsMainRecognizerDeviceObject, NULL, L"\\UdfsDisk", L"\\FileSystem\\UdfsDiskRecognizer", UdfsFileSystem, FILE_DEVICE_DISK_FILE_SYSTEM ); if (NT_SUCCESS( status )) { count++; } status = FsRecCreateAndRegisterDO( DriverObject, NULL, NULL, L"\\Fat", L"\\FileSystem\\FatRecognizer", FatFileSystem, FILE_DEVICE_DISK_FILE_SYSTEM ); if (NT_SUCCESS( status )) { count++; } status = FsRecCreateAndRegisterDO( DriverObject, NULL, NULL, L"\\Ntfs", L"\\FileSystem\\NtfsRecognizer", NtfsFileSystem, FILE_DEVICE_DISK_FILE_SYSTEM ); if (NT_SUCCESS( status )) { count++; } if (count) { return STATUS_SUCCESS; } else { return STATUS_IMAGE_ALREADY_LOADED; } }

NTSTATUS FatRecFsControl (  IN PDEVICE_OBJECT  DeviceObject, IN PIRP  Irp )

Definition at line 43 of file fat_rec.c. References _DEVICE_OBJECT::Characteristics, ExFreePool(), FALSE, FsRecGetDeviceSectorSize(), FsRecLoadFileSystem(), FsRecReadBlock(), IO_NO_INCREMENT, IoCompleteRequest, IoGetCurrentIrpStackLocation, _IRP::IoStatus, Irp, IRP_MN_LOAD_FILE_SYSTEM, IRP_MN_MOUNT_VOLUME, IsFatVolume(), L, _IO_STACK_LOCATION::MinorFunction, NTSTATUS(), NULL, PAGED_CODE, _IO_STACK_LOCATION::Parameters, PPACKED_BOOT_SECTOR, and TRUE. Referenced by FsRecFsControl(). : This function performs the mount and driver reload functions for this mini- file system recognizer driver. Arguments: DeviceObject - Pointer to this driver's device object. Irp - Pointer to the I/O Request Packet (IRP) representing the function to be performed. Return Value: The function value is the final status of the operation. --*/ { NTSTATUS status; PIO_STACK_LOCATION irpSp; PDEVICE_EXTENSION deviceExtension; PDEVICE_OBJECT targetDevice; PPACKED_BOOT_SECTOR buffer; LARGE_INTEGER byteOffset; UNICODE_STRING driverName; ULONG bytesPerSector; BOOLEAN isDeviceFailure = FALSE; PAGED_CODE(); // // Begin by determining what function that is to be performed. // deviceExtension = (PDEVICE_EXTENSION) DeviceObject->DeviceExtension; irpSp = IoGetCurrentIrpStackLocation( Irp ); switch ( irpSp->MinorFunction ) { case IRP_MN_MOUNT_VOLUME: // // Attempt to mount a volume: Determine whether or not the volume in // question is a FAT volume and, if so, let the I/O system know that it // is by returning a special status code so that this driver can get // called back to load the FAT file system. // status = STATUS_UNRECOGNIZED_VOLUME; // // Attempt to determine whether or not the target volume being mounted // is a FAT volume. Note that if an error occurs, and this is a floppy // drive, and the error occurred on the actual read from the device, // then the FAT file system will actually be loaded to handle the // problem since this driver is a place holder and does not need to // know all of the protocols for handling floppy errors. // targetDevice = irpSp->Parameters.MountVolume.DeviceObject; // // First retrieve the sector size for this media. // if (FsRecGetDeviceSectorSize( targetDevice, &bytesPerSector )) { byteOffset.QuadPart = 0; buffer = NULL; if (FsRecReadBlock( targetDevice, &byteOffset, 512, bytesPerSector, &buffer, &isDeviceFailure ) && IsFatVolume( buffer )) { status = STATUS_FS_DRIVER_REQUIRED; } if (buffer != NULL) { ExFreePool( buffer ); } } else { // // Devices that can't get us this much ... // isDeviceFailure = TRUE; } // // See if we should make the real filesystem take a shot at a wacky floppy. // if (isDeviceFailure) { if (targetDevice->Characteristics & FILE_FLOPPY_DISKETTE) { status = STATUS_FS_DRIVER_REQUIRED; } } break; case IRP_MN_LOAD_FILE_SYSTEM: status = FsRecLoadFileSystem( DeviceObject, L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Fastfat" ); break; default: status = STATUS_INVALID_DEVICE_REQUEST; } // // Finally, complete the request and return the same status code to the // caller. // Irp->IoStatus.Status = status; IoCompleteRequest( Irp, IO_NO_INCREMENT ); return status; }

NTSTATUS FsRecCleanupClose (  IN PDEVICE_OBJECT  DeviceObject, IN PIRP  Irp )

Definition at line 195 of file fs_rec.c. References IO_NO_INCREMENT, IoCompleteRequest, Irp, and PAGED_CODE. Referenced by DriverEntry(). : This routine is invoked when someone attempts to cleanup or close one of the system recognizer's registered device objects. Arguments: DeviceObject - Pointer to the device object being closed. Irp - Pointer to the cleanup/close IRP. Return Value: The final function value is STATUS_SUCCESS. --*/ { PAGED_CODE(); // // Simply complete the request successfully (note that IoStatus.Status in // Irp is already initialized to STATUS_SUCCESS). // IoCompleteRequest( Irp, IO_NO_INCREMENT ); return STATUS_SUCCESS; }

NTSTATUS FsRecCreate (  IN PDEVICE_OBJECT  DeviceObject, IN PIRP  Irp )

Definition at line 233 of file fs_rec.c. References _FILE_OBJECT::FileName, _IO_STACK_LOCATION::FileObject, IO_NO_INCREMENT, IoCompleteRequest, IoGetCurrentIrpStackLocation, _IRP::IoStatus, Irp, NTSTATUS(), and PAGED_CODE. Referenced by DriverEntry(). : This routine is invoked when someone attempts to open one of the file system recognizer's registered device objects. Arguments: DeviceObject - Pointer to the device object being opened. Irp - Pointer to the create IRP. Return Value: The final function value indicates whether or not the open was successful. --*/ { PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation( Irp ); NTSTATUS status; PAGED_CODE(); // // Simply ensure that the name of the "file" being opened is NULL, and // complete the request accordingly. // if (irpSp->FileObject->FileName.Length) { status = STATUS_OBJECT_PATH_NOT_FOUND; } else { status = STATUS_SUCCESS; } Irp->IoStatus.Status = status; Irp->IoStatus.Information = FILE_OPENED; IoCompleteRequest( Irp, IO_NO_INCREMENT ); return status; }

NTSTATUS FsRecCreateAndRegisterDO (  IN PDRIVER_OBJECT  DriverObject, IN PDEVICE_OBJECT HeadRecognizer  OPTIONAL, OUT PDEVICE_OBJECT *NewRecognizer  OPTIONAL, IN PWCHAR  RecFileSystem, IN PWCHAR  FileSystemName, IN FILE_SYSTEM_TYPE  FileSystemType, IN DEVICE_TYPE  DeviceType )

Definition at line 282 of file fs_rec.c. References Active, _DEVICE_EXTENSION::CoRecognizer, _DEVICE_OBJECT::DeviceExtension, _DEVICE_OBJECT::DeviceObjectExtension, FALSE, FILE_SYSTEM_TYPE, _DEVICE_EXTENSION::FileSystemType, IoCreateDevice(), IoRegisterFileSystem(), NT_SUCCESS, NTSTATUS(), NULL, PAGED_CODE, RtlInitUnicodeString(), _DEVICE_EXTENSION::State, and ZwCreateFile(). Referenced by DriverEntry(). : This routine creates a device object for the specified file system type and registers it as an active file system. Arguments: DriverObject - Pointer to the driver object for this driver. HeadRecognizer - Optionally supplies a pre-existing recognizer that the newly created DO should be jointly serialized and unregistered with. This is useful if a given filesystem exists on multiple device types and thus requires multiple recognizers. NewDeviceObject - Receives the created DO on success.. RecFileSystem - Name of the file system to be recognized. FileSystemName - Name of file system device object to be registered. FileSystemType - Type of this file system recognizer device object. DeviceType - Type of media this file system recognizer device object will inspect. Return Value: The final function value indicates whether or not the device object was successfully created and registered. --*/ { PDEVICE_OBJECT deviceObject; NTSTATUS status; UNICODE_STRING nameString; OBJECT_ATTRIBUTES objectAttributes; HANDLE fsHandle; IO_STATUS_BLOCK ioStatus; PDEVICE_EXTENSION deviceExtension; PAGED_CODE(); if (NewRecognizer) { *NewRecognizer = NULL; } // // Begin by attempting to open the file system driver's device object. If // it works, then the file system is already loaded, so don't load this // driver. Otherwise, this mini-driver is the one that should be loaded. // RtlInitUnicodeString( &nameString, RecFileSystem ); InitializeObjectAttributes( &objectAttributes, &nameString, OBJ_CASE_INSENSITIVE, (HANDLE) NULL, (PSECURITY_DESCRIPTOR) NULL ); status = ZwCreateFile( &fsHandle, SYNCHRONIZE, &objectAttributes, &ioStatus, (PLARGE_INTEGER) NULL, 0, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN, 0, (PVOID) NULL, 0 ); if (NT_SUCCESS( status )) { ZwClose( fsHandle ); } else if (status != STATUS_OBJECT_NAME_NOT_FOUND) { status = STATUS_SUCCESS; } if (NT_SUCCESS( status )) { return STATUS_IMAGE_ALREADY_LOADED; } // // Attempt to create a device object for this driver. This device object // will be used to represent the driver as an active file system in the // system. // RtlInitUnicodeString( &nameString, FileSystemName ); status = IoCreateDevice( DriverObject, sizeof( DEVICE_EXTENSION ), &nameString, DeviceType, 0, FALSE, &deviceObject ); if (!NT_SUCCESS( status )) { return status; } // // Initialize the device extension for this device object. // deviceExtension = (PDEVICE_EXTENSION) deviceObject->DeviceExtension; deviceExtension->FileSystemType = FileSystemType; deviceExtension->State = Active; // // Is this a filesystem being jointly recognized by recognizers for // different device types? // if (HeadRecognizer) { // // Link into the list. // deviceExtension->CoRecognizer = ((PDEVICE_EXTENSION)HeadRecognizer->DeviceExtension)->CoRecognizer; ((PDEVICE_EXTENSION)HeadRecognizer->DeviceExtension)->CoRecognizer = deviceObject; } else { // // Initialize the list of codependant recognizer objects. // deviceExtension->CoRecognizer = deviceObject; } #if _PNP_POWER_ deviceObject->DeviceObjectExtension->PowerControlNeeded = FALSE; #endif // // Finally, register this driver as an active, loaded file system and // return to the caller. // if (NewRecognizer) { *NewRecognizer = deviceObject; } IoRegisterFileSystem( deviceObject ); return STATUS_SUCCESS; }

NTSTATUS FsRecFsControl (  IN PDEVICE_OBJECT  DeviceObject, IN PIRP  Irp )

Definition at line 446 of file fs_rec.c. References Active, CdfsFileSystem, CdfsRecFsControl(), FatFileSystem, FatRecFsControl(), _DEVICE_EXTENSION::FileSystemType, IO_NO_INCREMENT, IoCompleteRequest, IoGetCurrentIrpStackLocation, _IRP::IoStatus, Irp, IRP_MN_MOUNT_VOLUME, _IO_STACK_LOCATION::MinorFunction, NtfsFileSystem, NtfsRecFsControl(), NTSTATUS(), PAGED_CODE, _DEVICE_EXTENSION::State, Transparent, UdfsFileSystem, and UdfsRecFsControl(). Referenced by DriverEntry(). : This function performs the mount and driver reload functions for this mini- file system recognizer driver. Arguments: DeviceObject - Pointer to this driver's device object. Irp - Pointer to the I/O Request Packet (IRP) representing the function to be performed. Return Value: The function value is the final status of the operation. --*/ { PDEVICE_EXTENSION deviceExtension; PIO_STACK_LOCATION irpSp; NTSTATUS status; PAGED_CODE(); // // Simply vector to the appropriate FS control function given the type // of file system being interrogated. // deviceExtension = (PDEVICE_EXTENSION) DeviceObject->DeviceExtension; irpSp = IoGetCurrentIrpStackLocation( Irp ); // // Handle the inactive recognizer states directly. // if (deviceExtension->State != Active && irpSp->MinorFunction == IRP_MN_MOUNT_VOLUME) { if (deviceExtension->State == Transparent) { status = STATUS_UNRECOGNIZED_VOLUME; } else { status = STATUS_FS_DRIVER_REQUIRED; } Irp->IoStatus.Status = status; IoCompleteRequest( Irp, IO_NO_INCREMENT ); return status; } switch ( deviceExtension->FileSystemType ) { case FatFileSystem: status = FatRecFsControl( DeviceObject, Irp ); break; case NtfsFileSystem: status = NtfsRecFsControl( DeviceObject, Irp ); break; case CdfsFileSystem: status = CdfsRecFsControl( DeviceObject, Irp ); break; case UdfsFileSystem: status = UdfsRecFsControl( DeviceObject, Irp ); break; default: status = STATUS_INVALID_DEVICE_REQUEST; } return status; }

BOOLEAN FsRecGetDeviceSectors (  IN PDEVICE_OBJECT  DeviceObject, IN ULONG  BytesPerSector, OUT PLARGE_INTEGER  NumberOfSectors )

Definition at line 703 of file fs_rec.c. References Executive, FALSE, IoBuildDeviceIoControlRequest(), IoCallDriver, IoGetNextIrpStackLocation, KeInitializeEvent, KernelMode, KeWaitForSingleObject(), NT_SUCCESS, NTSTATUS(), NULL, PAGED_CODE, RtlExtendedLargeIntegerDivide(), SetFlag, SL_OVERRIDE_VERIFY_VOLUME, TRUE, and VOID(). Referenced by NtfsRecFsControl(). : This routine returns information about the partition represented by the device object. Arguments: DeviceObject - Pointer to the device object from which to read. BytesPerSector - The number of bytes per sector for the device being read. NumberOfSectors - Variable to receive the number of sectors for this partition. Return Value: The function value is TRUE if the information was found, otherwise FALSE. --*/ { PARTITION_INFORMATION partitionInfo; IO_STATUS_BLOCK ioStatus; KEVENT event; PIRP irp; NTSTATUS status; ULONG remainder; PAGED_CODE(); // // We only do this for disks right now. This is likely to change when we // have to recognize CDUDF media. // if (DeviceObject->DeviceType != FILE_DEVICE_DISK) { return FALSE; } // // Get the number of sectors on this partition. // KeInitializeEvent( &event, SynchronizationEvent, FALSE ); irp = IoBuildDeviceIoControlRequest( IOCTL_DISK_GET_PARTITION_INFO, DeviceObject, (PVOID) NULL, 0, &partitionInfo, sizeof( partitionInfo ), FALSE, &event, &ioStatus ); if (!irp) { return FALSE; } // // Override verify logic - we don't care. The fact we're in the picture means // someone is trying to mount new/changed media in the first place. // SetFlag( IoGetNextIrpStackLocation( irp )->Flags, SL_OVERRIDE_VERIFY_VOLUME ); status = IoCallDriver( DeviceObject, irp ); if (status == STATUS_PENDING) { (VOID) KeWaitForSingleObject( &event, Executive, KernelMode, FALSE, (PLARGE_INTEGER) NULL ); status = ioStatus.Status; } if (!NT_SUCCESS( status )) { return FALSE; } *NumberOfSectors = RtlExtendedLargeIntegerDivide( partitionInfo.PartitionLength, BytesPerSector, &remainder ); return TRUE; }

BOOLEAN FsRecGetDeviceSectorSize (  IN PDEVICE_OBJECT  DeviceObject, OUT PULONG  BytesPerSector )

Definition at line 800 of file fs_rec.c. References Executive, FALSE, IoBuildDeviceIoControlRequest(), IoCallDriver, IoGetNextIrpStackLocation, KeInitializeEvent, KernelMode, KeWaitForSingleObject(), NT_SUCCESS, NTSTATUS(), NULL, PAGED_CODE, SetFlag, SL_OVERRIDE_VERIFY_VOLUME, TRUE, and VOID(). Referenced by FatRecFsControl(), NtfsRecFsControl(), and UdfsRecFsControl(). : This routine returns the sector size of the underlying device. Arguments: DeviceObject - Pointer to the device object from which to read. BytesPerSector - Variable to receive the number of bytes per sector for the device being read. Return Value: The function value is TRUE if the information was found, otherwise FALSE. --*/ { DISK_GEOMETRY diskGeometry; IO_STATUS_BLOCK ioStatus; KEVENT event; PIRP irp; NTSTATUS status; ULONG ControlCode; PAGED_CODE(); // // Figure out what kind of device we have so we can use the right IOCTL. // switch (DeviceObject->DeviceType) { case FILE_DEVICE_CD_ROM: ControlCode = IOCTL_CDROM_GET_DRIVE_GEOMETRY; break; case FILE_DEVICE_DISK: ControlCode = IOCTL_DISK_GET_DRIVE_GEOMETRY; break; default: return FALSE; } KeInitializeEvent( &event, SynchronizationEvent, FALSE ); irp = IoBuildDeviceIoControlRequest( ControlCode, DeviceObject, (PVOID) NULL, 0, &diskGeometry, sizeof( diskGeometry ), FALSE, &event, &ioStatus ); if (!irp) { return FALSE; } // // Override verify logic - we don't care. The fact we're in the picture means // someone is trying to mount new/changed media in the first place. // SetFlag( IoGetNextIrpStackLocation( irp )->Flags, SL_OVERRIDE_VERIFY_VOLUME ); status = IoCallDriver( DeviceObject, irp ); if (status == STATUS_PENDING) { (VOID) KeWaitForSingleObject( &event, Executive, KernelMode, FALSE, (PLARGE_INTEGER) NULL ); status = ioStatus.Status; } if (!NT_SUCCESS( status )) { return FALSE; } // // Ensure that the drive actually knows how many bytes there are per // sector. Floppy drives do not know if the media is unformatted. // if (!diskGeometry.BytesPerSector) { return FALSE; } // // Store the return values for the caller. // *BytesPerSector = diskGeometry.BytesPerSector; return TRUE; }

NTSTATUS FsRecLoadFileSystem (  IN PDEVICE_OBJECT  DeviceObject, IN PWCHAR  DriverServiceKey )

Definition at line 579 of file fs_rec.c. References Active, _DEVICE_EXTENSION::CoRecognizer, Executive, FALSE, FastUnload, FsRecLoadSync, IoUnregisterFileSystem(), KeEnterCriticalRegion, KeLeaveCriticalRegion, KernelMode, KeSetEvent(), KeWaitForSingleObject(), NTSTATUS(), NULL, PAGED_CODE, RtlInitUnicodeString(), _DEVICE_EXTENSION::State, Transparent, and ZwLoadDriver(). Referenced by CdfsRecFsControl(), FatRecFsControl(), NtfsRecFsControl(), and UdfsRecFsControl(). : This routine performs the common work of loading a filesystem on behalf of one of our recognizers. Arguments: DeviceObject - Pointer to the device object for the recognizer. DriverServiceName - Specifies the name of the node in the registry associated with the driver to be loaded. Return Value: NTSTATUS. The recognizer will be set into a transparent mode on return. --*/ { UNICODE_STRING driverName; PDEVICE_EXTENSION deviceExtension = (PDEVICE_EXTENSION) DeviceObject->DeviceExtension; NTSTATUS status = STATUS_IMAGE_ALREADY_LOADED; PAGED_CODE(); // // Quickly check if the recognizer has already fired. // if (deviceExtension->State != Transparent) { // // Serialize all threads trying to load this filesystem. // // We need to do this for several reasons. With the new behavior in // IoRegisterFileSystem, we do not know ahead of time whether the // filesystem has been loaded ahead or behind this recognizer in the // scan queue. This means that we cannot make this recognizer transparent // before the real filesystem has become registered, or else if the // filesystem loads behind us we may let threads go through that will // not find it in that window of time. // // The reason this is possible is that NtLoadDriver does not guarantee // that if it returns STATUS_IMAGE_ALREADY_LOADED, that the driver in // question has actually initialized itself, which *is* guaranteed if // it returns STATUS_SUCCESS. We have to keep these threads bottled // up until they can rescan with the promise that what they need is there. // // As a bonus, we can now guarantee that the recognizer goes away in // all cases, not just when the driver successfully loads itself. // KeWaitForSingleObject( FsRecLoadSync, Executive, KernelMode, FALSE, NULL ); KeEnterCriticalRegion(); // // Attempt the filesystem load precisely once for all recognizers // of a given filesystem. // if (deviceExtension->State == Active) { // // For bonus points, in the future we may want to log an event // on failure. // RtlInitUnicodeString( &driverName, DriverServiceName ); status = ZwLoadDriver( &driverName ); // // Now walk all codependant recognizers and instruct them to go // into the fast unload state. Since IO only expects the fsDO // it is asking to load a filesystem to to unregister itself, if // we unregistered all of the co-recognizers they would dangle. // Unfortunately, this means that fsrec may wind up hanging around // quite a bit longer than strictly neccesary. // // Note: we come right back to the original DeviceObject at the // end of this loop (important). It is also very important that // we only did this once since after we release the mutex the co- // recognizers may begin going away in any order. // while (deviceExtension->State != FastUnload) { deviceExtension->State = FastUnload; DeviceObject = deviceExtension->CoRecognizer; deviceExtension = DeviceObject->DeviceExtension; } } // // Unregister this recognizer precisely once. // if (deviceExtension->State != Transparent) { IoUnregisterFileSystem( DeviceObject ); deviceExtension->State = Transparent; } KeSetEvent( FsRecLoadSync, 0, FALSE ); KeLeaveCriticalRegion(); } return status; }

BOOLEAN FsRecReadBlock (  IN PDEVICE_OBJECT  DeviceObject, IN PLARGE_INTEGER  ByteOffset, IN ULONG  MinimumBytes, IN ULONG  BytesPerSector, OUT PVOID *  Buffer, OUT PBOOLEAN IsDeviceFailure  OPTIONAL )

Definition at line 907 of file fs_rec.c. References Buffer, ExAllocatePoolWithTag, Executive, FALSE, FSREC_POOL_TAG, IoBuildSynchronousFsdRequest(), IoCallDriver, IoGetNextIrpStackLocation, IRP_MJ_READ, KeInitializeEvent, KernelMode, KeWaitForSingleObject(), NonPagedPool, NT_SUCCESS, NTSTATUS(), NULL, PAGE_SIZE, PAGED_CODE, RoundUp, SetFlag, SL_OVERRIDE_VERIFY_VOLUME, TRUE, and VOID(). Referenced by FatRecFsControl(), IsUdfsVolume(), and NtfsRecFsControl(). : This routine reads a minimum numbers of bytes into a buffer starting at the byte offset from the base of the device represented by the device object. Arguments: DeviceObject - Pointer to the device object from which to read. ByteOffset - Pointer to a 64-bit byte offset from the base of the device from which to start the read. MinimumBytes - Supplies the minimum number of bytes to be read. BytesPerSector - The number of bytes per sector for the device being read. Buffer - Variable to receive a pointer to the allocated buffer containing the bytes read. IsDeviceFailure - Variable to receive an indication whether a failure was a result of talking to the device. Return Value: The function value is TRUE if the bytes were read, otherwise FALSE. --*/ { #define RoundUp( x, y ) ( ((x + (y-1)) / y) * y ) IO_STATUS_BLOCK ioStatus; KEVENT event; PIRP irp; NTSTATUS status; PAGED_CODE(); if (IsDeviceFailure) { *IsDeviceFailure = FALSE; } KeInitializeEvent( &event, SynchronizationEvent, FALSE ); // // Set the minimum number of bytes to read to the maximum of the bytes that // the caller wants to read, and the number of bytes in a sector. // if (MinimumBytes < BytesPerSector) { MinimumBytes = BytesPerSector; } else { MinimumBytes = RoundUp( MinimumBytes, BytesPerSector ); } // // Allocate a buffer large enough to contain the bytes required, round the // request to a page boundary to solve any alignment requirements. // if (!*Buffer) { *Buffer = ExAllocatePoolWithTag( NonPagedPool, (MinimumBytes + PAGE_SIZE - 1) & ~(PAGE_SIZE - 1), FSREC_POOL_TAG ); if (!*Buffer) { return FALSE; } } // // Read the actual bytes off of the media. // irp = IoBuildSynchronousFsdRequest( IRP_MJ_READ, DeviceObject, *Buffer, MinimumBytes, ByteOffset, &event, &ioStatus ); if (!irp) { return FALSE; } // // Override verify logic - we don't care. The fact we're in the picture means // someone is trying to mount new/changed media in the first place. // SetFlag( IoGetNextIrpStackLocation( irp )->Flags, SL_OVERRIDE_VERIFY_VOLUME ); status = IoCallDriver( DeviceObject, irp ); if (status == STATUS_PENDING) { (VOID) KeWaitForSingleObject( &event, Executive, KernelMode, FALSE, (PLARGE_INTEGER) NULL ); status = ioStatus.Status; } if (!NT_SUCCESS( status )) { if (IsDeviceFailure) { *IsDeviceFailure = TRUE; } return FALSE; } return TRUE; }

VOID FsRecUnload (  IN PDRIVER_OBJECT  DriverObject  )

Definition at line 539 of file fs_rec.c. References ExFreePool(), FsRecLoadSync, IoDeleteDevice(), and PAGED_CODE. Referenced by DriverEntry(). : This routine cleans up the driver's data structures so that it can be unloaded. Arguments: DriverObject - Pointer to the driver object for this driver. Return Value: None. --*/ { PAGED_CODE(); // // Simply delete all of the device objects that this driver has created, the // load event, and return. // while (DriverObject->DeviceObject) { IoDeleteDevice( DriverObject->DeviceObject ); } ExFreePool( FsRecLoadSync ); return; }

NTSTATUS NtfsRecFsControl (  IN PDEVICE_OBJECT  DeviceObject, IN PIRP  Irp )

Definition at line 42 of file ntfs_rec.c. References ExFreePool(), FsRecGetDeviceSectors(), FsRecGetDeviceSectorSize(), FsRecLoadFileSystem(), FsRecReadBlock(), IO_NO_INCREMENT, IoCompleteRequest, IoGetCurrentIrpStackLocation, _IRP::IoStatus, Irp, IRP_MN_LOAD_FILE_SYSTEM, IRP_MN_MOUNT_VOLUME, IsNtfsVolume(), L, _IO_STACK_LOCATION::MinorFunction, NTSTATUS(), NULL, PACKED_BOOT_SECTOR, PAGED_CODE, and _IO_STACK_LOCATION::Parameters. Referenced by FsRecFsControl(). : This function performs the mount and driver reload functions for this mini- file system recognizer driver. Arguments: DeviceObject - Pointer to this driver's device object. Irp - Pointer to the I/O Request Packet (IRP) representing the function to be performed. Return Value: The function value is the final status of the operation. --*/ { NTSTATUS status; PIO_STACK_LOCATION irpSp; PDEVICE_EXTENSION deviceExtension; PDEVICE_OBJECT targetDevice; PPACKED_BOOT_SECTOR buffer; LARGE_INTEGER byteOffset; LARGE_INTEGER secondByteOffset; LARGE_INTEGER lastByteOffset; UNICODE_STRING driverName; ULONG bytesPerSector; LARGE_INTEGER numberOfSectors; PAGED_CODE(); // // Begin by determining what function that is to be performed. // deviceExtension = (PDEVICE_EXTENSION) DeviceObject->DeviceExtension; irpSp = IoGetCurrentIrpStackLocation( Irp ); switch ( irpSp->MinorFunction ) { case IRP_MN_MOUNT_VOLUME: // // Attempt to mount a volume: Determine whether or not the volume in // question is an NTFS volume and, if so, let the I/O system know that it // is by returning a special status code so that this driver can get // called back to load the NTFS file system. // status = STATUS_UNRECOGNIZED_VOLUME; // // Attempt to determine whether or not the target volume being mounted // is an NTFS volume. // targetDevice = irpSp->Parameters.MountVolume.DeviceObject; if (FsRecGetDeviceSectorSize( targetDevice, &bytesPerSector ) && FsRecGetDeviceSectors( targetDevice, bytesPerSector, &numberOfSectors )) { byteOffset.QuadPart = 0; buffer = NULL; secondByteOffset.QuadPart = numberOfSectors.QuadPart >> 1; secondByteOffset.QuadPart *= (LONG) bytesPerSector; lastByteOffset.QuadPart = (numberOfSectors.QuadPart - 1) * (LONG) bytesPerSector; if (FsRecReadBlock( targetDevice, &byteOffset, sizeof( PACKED_BOOT_SECTOR ), bytesPerSector, (PVOID *)&buffer, NULL ) && IsNtfsVolume( buffer, bytesPerSector, &numberOfSectors )) { status = STATUS_FS_DRIVER_REQUIRED; } else { if (FsRecReadBlock( targetDevice, &secondByteOffset, sizeof( PACKED_BOOT_SECTOR ), bytesPerSector, (PVOID *)&buffer, NULL ) && IsNtfsVolume( buffer, bytesPerSector, &numberOfSectors )) { status = STATUS_FS_DRIVER_REQUIRED; } else { if (FsRecReadBlock( targetDevice, &lastByteOffset, sizeof( PACKED_BOOT_SECTOR ), bytesPerSector, (PVOID *)&buffer, NULL ) && IsNtfsVolume( buffer, bytesPerSector, &numberOfSectors )) { status = STATUS_FS_DRIVER_REQUIRED; } } } if (buffer != NULL) { ExFreePool( buffer ); } } break; case IRP_MN_LOAD_FILE_SYSTEM: status = FsRecLoadFileSystem( DeviceObject, L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Ntfs" ); break; default: status = STATUS_INVALID_DEVICE_REQUEST; } // // Finally, complete the request and return the same status code to the // caller. // Irp->IoStatus.Status = status; IoCompleteRequest( Irp, IO_NO_INCREMENT ); return status; }

NTSTATUS UdfsRecFsControl (  IN PDEVICE_OBJECT  DeviceObject, IN PIRP  Irp )

Definition at line 60 of file udfs_rec.c. References FsRecGetDeviceSectorSize(), FsRecLoadFileSystem(), IO_NO_INCREMENT, IoCompleteRequest, IoGetCurrentIrpStackLocation, _IRP::IoStatus, Irp, IRP_MN_LOAD_FILE_SYSTEM, IRP_MN_MOUNT_VOLUME, IsUdfsVolume(), L, _IO_STACK_LOCATION::MinorFunction, NTSTATUS(), PAGED_CODE, and _IO_STACK_LOCATION::Parameters. Referenced by FsRecFsControl(). : This function performs the mount and driver reload functions for this mini- file system recognizer driver. Arguments: DeviceObject - Pointer to this driver's device object. Irp - Pointer to the I/O Request Packet (IRP) representing the function to be performed. Return Value: The function value is the final status of the operation. -*/ { NTSTATUS status; PIO_STACK_LOCATION irpSp; PDEVICE_EXTENSION deviceExtension; UNICODE_STRING driverName; ULONG bytesPerSector; PDEVICE_OBJECT targetDevice; PAGED_CODE(); // // Begin by determining what function that is to be performed. // deviceExtension = (PDEVICE_EXTENSION) DeviceObject->DeviceExtension; irpSp = IoGetCurrentIrpStackLocation( Irp ); switch ( irpSp->MinorFunction ) { case IRP_MN_MOUNT_VOLUME: // // Attempt to mount a volume: There are two different cases here: // // 1) The device is being opened for DASD access, that is, no // file system is required, thus it is OK to allow RAW to // to open it. // // 2) We need to rummage the media to see if this is a UDF volume. // status = STATUS_UNRECOGNIZED_VOLUME; targetDevice = irpSp->Parameters.MountVolume.DeviceObject; if (FsRecGetDeviceSectorSize( targetDevice, &bytesPerSector )) { if (IsUdfsVolume( targetDevice, bytesPerSector )) { status = STATUS_FS_DRIVER_REQUIRED; } } break; case IRP_MN_LOAD_FILE_SYSTEM: status = FsRecLoadFileSystem( DeviceObject, L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Udfs" ); break; default: status = STATUS_INVALID_DEVICE_REQUEST; } // // Finally, complete the request and return the same status code to the // caller. // Irp->IoStatus.Status = status; IoCompleteRequest( Irp, IO_NO_INCREMENT ); return status; }

NTSTATUS ZwLoadDriver (  IN PUNICODE_STRING  DriverServiceName  )

Referenced by FsRecLoadFileSystem(), and FsRtlRegisterUncProvider().

---