none
Problem with IRP creation RRS feed

  • Question

  • Hello, 

    I am trying to develop a file system driver to encrypt what is written on the disk. For this, I am intercepting IRPs and in the case of IRP_MJ_WRITE I would like to create a new IRP with a new UserBuffer. I am currently using IoBuildAsynchronousFsdRequest to create the new IRP but when I call IoCallDriver with my new IRP I get a BSOD. I understand that some information is missing in the new IRP (for instance the address on the disk where the data is to be written ?) but I am not sure how to fill it. 

    Can anyone help me ? 

    if(Irp->UserBuffer){
    memcpy(buffer, Irp->UserBuffer, end_of_file);
    crypted_Irp = IoBuildAsynchronousFsdRequest(IRP_MJ_WRITE,
    pNextDevice,
    buffer,
    end_of_file,
    &(pCurrentStackLocation->Parameters.Write.ByteOffset),
    &newStatusBlock);

    status = IoCallDriver(pNextDevice, crypted_Irp);
    Irp->IoStatus.Status=newStatusBlock.Status;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return status;

    Matthieu

    Tuesday, August 6, 2013 3:46 PM

All replies

  • First if you are doing a mini-filter why are you messing with IRP's yourself?  A mini-filter will have the ability to issue a new call downwards with FltWriteFile, so just use that.  If you really need an IRP_MJ_WRITE then look at http://msdn.microsoft.com/en-us/library/windows/hardware/ff549427(v=vs.85).aspx the ByteOffset parameter is the one for where the file goes on disk.

    Note: if this is a filter driver you should not be bypassing the file system anyway.


    Don Burn Windows Filesystem and Driver Consulting Website: http://www.windrvr.com Blog: http://msmvps.com/blogs/WinDrvr

    • Marked as answer by Doron Holan [MSFT] Tuesday, August 6, 2013 5:15 PM
    • Unmarked as answer by MatthieuM Tuesday, August 6, 2013 5:18 PM
    Tuesday, August 6, 2013 4:13 PM
  • Thanks for the reply. I am not trying to develop a filter driver but a legacy driver. Do you have any idea why the code above does not work ?
    Tuesday, August 6, 2013 4:23 PM
  • If you are developing a legacy filter driver then drop it and go to a mini-filter.  Legacy filter drivers are not worth it.

    On your code you need a completion routine to call IoFreeIrp.  Other than that I am not sure what the problem is.  Put a breakpoint on the IoCallDriver and dump the IRP with !irp.  If you don't see the problem post the output here.


    Don Burn Windows Filesystem and Driver Consulting Website: http://www.windrvr.com Blog: http://msmvps.com/blogs/WinDrvr

    • Marked as answer by Doron Holan [MSFT] Tuesday, August 6, 2013 5:15 PM
    • Unmarked as answer by MatthieuM Tuesday, August 6, 2013 5:18 PM
    Tuesday, August 6, 2013 4:30 PM