Windows File System filter driver development tutorial (5)

Windows File System filter driver development tutorial 5. Bind fs cdo, file system identification, device extension

As mentioned in the previous section, we intend to bind a newly activated fs cdo. The front side said that simply calling wd_dev_attach can easily bind this device. However, not every time my_fs_notify finds a new FS activation, I will bind it directly.

First, determine whether I need to care about the file system type. I use the following function to obtain the device type.

// ------------------ Content in WDF. h -------------------
_ Inline wd_dev_type wd_dev_get_type (in wd_dev * Dev)
{
Return Dev-> devicetype;
}

There are several possible types of CdO devices in the file system. Your filter driver may only be interested in some of them.

Enum {
Wd_dev_disk_fs = file_device_disk_file_system,
Wd_dev_cdrom_fs = file_device_cd_rom_file_system,
Wd_dev_network_fs = file_device_network_file_system
};

You should write a function to determine whether the FS is of your concern.

// ------------- A function to determine whether I am concerned about FS ---------------
Wd_bool my_care (wd_ulong type)
{
Return (type) = wd_dev_disk_fs) |
(Type) = wd_dev_cdrom_fs) |
(Type) = wd_dev_network_fs ));
}

The next problem is that I plan to skip the file system reader. The file system reader is a small replacement of the file system driver. To prevent unused file system drivers from occupying the kernel memory, the Windows system does not load these large drivers, instead of the file system identifier corresponding to the file system driver. When a new physical storage media enters the system, the IO manager tries to identify it from various file systems in sequence ". After successful identification, the real file system driver is loaded immediately, and the corresponding file system identifier is uninstalled. For us, the control device of the file system reader looks like a file system control device. But we do not intend to bind it.

The resolution is based on the driver name. The name of the driver object of the file system identification tool (Attention: driverobject rather than deviceobject !) \ FileSystem \ fs_rec ".

// ------------------- Use theseCodeTo skip the file system reader ----------------------
Wd_wchar name_buf [wd_dev_name_max_len];
Wd_ustr name, TMP;

Wd_ustr_init_em (& name, name_buf, wd_dev_name_max_len );
Wd_ustr_init (& TMP, l "\ FileSystem \ fs_rec ");

// I do not bind an identifier. Therefore, if it is a reader, I will directly return success. Check whether it is identified
// You can check whether the device is \ FileSystem \ fs_rec.
Wd_obj_get_name (wd_dev_drv (fs_dev), & name );
If (wd_ustr_cmp (& name, & TMP, wd_true) = 0)
{
Wd_printf0 ("Attach FS Dev: Is a recogonizer. \ r \ n ");
Return wd_stat_suc;
}

Wd_printf0 ("Attach FS Dev: Not a recogonizer. \ r \ n ");

Next, I will generate my devices. The concept of device extension should be mentioned here. A device object is a data structure. To indicate different devices, a custom space is provided to record the unique information of the device. We determine the device extension for the generated device as follows:

// File filtering system-driven device extension
Typedef struct _ my_dev_ext
{
// The file system driver we bound
Wd_dev * attached_to;
// The device name of the above device.
Wd_ustr dev_name;
// This is the buffer of the above Unicode string
Wd_wchar name_buf [wd_dev_name_max_len];
} My_dev_ext;

It's so simple because we don't have much to record yet. You just need to remember which device you are bound. If you need more information in the future, it will not be too late. The size of the Extended Space is specified at wdf_dev_create (which is generated by this device. After getting the device object pointer, I use the following function to obtain the device extension pointer:

// -------------- Content in WDF. h ------------------
_ Inline wd_void * wd_dev_ext (wd_dev * Dev)
{
Return (Dev-> deviceextension );
}

After a device is generated, in order to make the system look like your device is no different from the original device, you must set the flag of the device to be the same as the device you are bound.

_ Inline wd_void wd_dev_copy_flag (wd_dev * new_dev,
Wd_dev * old_dev)
{
If (old_dev-> flags & do_buffered_io)
New_dev-> flags & = do_buffered_io;
If (old_dev-> flags & do_direct_io)
New_dev-> flags & = do_direct_io;
If (old_dev-> Characteristics & file_device_secure_open)
New_dev-> Characteristics & = file_device_secure_open;
}

The two flags do_buffered_io and do_direct_io indicate that the buffer addresses used for sending read/write requests to these devices are different. This will be discussed later when filtering file reads and writes. Now that everything is done, you should remove the do_device_initializing flag on your new device to indicate that the device is fully usable.

// -------------- Content in WDF. h ------------------
_ Inline wd_void wd_dev_clr_init_flag (wd_dev * Dev)
{
Dev-> flags & = ~ Do_device_initializing;
}

Now I write a function to complete the above process. You only need to call this function at the position indicated in the previous section to bind the file system control device.

// ----------- Bind a file system driver -------------------------
Wd_stat my_attach_fs_dev (wd_dev * fs_dev)
{
Wd_wchar name_buf [wd_dev_name_max_len];
Wd_ustr name, TMP;
Wd_dev * new_dev;
Wd_stat status;
My_dev_ext * ext;
Wd_ustr_init_em (& name, name_buf, wd_dev_name_max_len );
Wd_ustr_init (& TMP, l "\ FileSystem \ fs_rec ");

// If it is not the type I care about, I directly return success
If (! My_care (wd_dev_get_type (fs_dev )))
{
Wd_printf0 ("Attach FS Dev: Not a cared type. \ r \ n "));
Return wd_stat_suc;
}

Wd_printf0 ("Attach FS Dev: Is my cared type. \ r \ n ");

// I do not bind an identifier. Therefore, if it is a reader, I will directly return success. Check whether it is identified
// You can check whether the device is \ FileSystem \ fs_rec.
Wd_obj_get_name (wd_dev_drv (fs_dev), & name );
If (wd_ustr_cmp (& name, & TMP, wd_true) = 0)
{
Wd_printf0 ("Attach FS Dev: Is a recogonizer. \ r \ n ");
Return wd_stat_suc;
}

Wd_printf0 ("Attach FS Dev: Not a recogonizer. \ r \ n ");

// Now generate a device for binding
Status = wd_dev_create (g_drv, sizeof (my_dev_ext), null,
Wd_dev_get_type (fs_dev ),
0, wd_false, & new_dev );
If (! Wd_suc (Status ))
{
Wd_printf0 ("Attach FS Dev: Dev create failed. \ r \ n ");
Return status;
}

Wd_printf0 ("Attach FS Dev: Create Dev success. \ r \ n ");

// Configure the identifier of the device to be bound.
Wd_dev_copy_flag (new_dev, fs_dev );

EXT = (my_dev_ext *) wd_dev_ext (new_dev );

Wd_printf0 ("begin to attach. \ r \ n ");
Status = wd_dev_attach (new_dev, fs_dev, & ext-> attached_to );
Wd_printf0 ("Attach over. Status = % 8x \ r \ n", status );

If (! Wd_suc (Status ))
{
Wd_printf0 ("Attach FS Dev: Dev attach failed. \ r \ n ");
Unreferenced_parameter (new_dev );
Wd_dev_del (new_dev );
Return status;
}

Wd_printf0 ("Attach FS Dev: attach % WZ succeed. \ r \ n", & name );

Wd_ustr_init_em (& ext-> dev_name, ext-> name_buf, wd_dev_name_max_len );
Wd_ustr_copy (& ext-> dev_name, & name );
Wd_dev_clr_init_flag (new_dev );

Return status;
}