Use a Windows kernel driver to create a virtual disk device

I recently read the code of an open-source program called filedisk to learn about the disk device driver.

To sum up

The function of filedisk is to map a file on the disk into a disk drive.

Used like a general disk volume

The principle of filedisk is simply to use the driver to create a disk device (iocreatedevice)

Then, use definedosdevice in the user State program to mount the device to a drive letter.

That is, all operations to this drive letter are directed to the virtual disk device created using the kernel driver.

In the kernel driver, you can process all irp_mj_write and irp_mj_read requests.

As for how to process these two read/write requests, a lot of things can be derived.

For example, data encryption during read/write processing becomes transparent encryption.

For example, truecrypt does.

If you copy a few copies of the write operation to another device, it becomes an image.

In filedisk, the read and write operations are completely directed to a disk file. In this way, the file is virtualized into a disk.

In fact, this method has been done before, but it will not always be able to read the source code of filedisk before you know that in addition to read/write operations

You also need to process many deviceiocontrol requests.

As a disk driver, the following requests are processed in filedisk:

IO requests that directly return status_invalid_device_request have

Ioctl_disk_check_verify

Ioctl_cdrom_check_verify

Ioctl_storage_check_verify

Ioctl_storage_check_verify2

Ioctl_disk_media_removal

Ioctl_storage_media_removal

Ioctl_cdrom_read_toc

Ioctl_disk_set_partition_info

IO requests that require special processing

Ioctl_disk_get_drive_geometry

Ioctl_disk_get_length_info

Ioctl_disk_get_partition_info

Ioctl_disk_verify

Ioctl_disk_get_partition_info_ex

Ioctl_disk_is_writable

To process IO requests that need to be processed, follow the instructions in DDK documentation.

For example, ioctl_disk_get_drive_geometry is used to obtain some information about the physical device.

Ioctl_disk_get_partition_info is used to obtain partition table information on the disk.

In the past, this was not handled, leading to failure... failed.

Although I read filedisk, I know that these requests need to be processed.

However, I still don't know where I/O control requests need to be processed by the disk drive volume driver.

The above is the content of filedisk. After these operations, you can write a complete virtual disk device.

Note that you need to create a system thread when processing read/write requests.

Read/write IRP packets received in the distribution routine are inserted into a queue and processed in the created system thread.

This should be a standard practice to avoid the deadlock caused by waiting in the distribution routine.

Well, the next step is to try to combine this with the filter driver...

Well, many applications can be derived from this.