从minifilter枚举USB大容量存储设备 [英] Enumerating USB mass storage device from minifilter

问题描述

我正在开发基于文件系统minifilter的产品。
我的问题是，从我的文件系统minifilter驱动程序，是否可以找到插入我系统的USB大容量存储设备？我怎么能得到这个？
例如：
这里给出了我的InstanceSetupCallback函数的代码。我的意图是仅附加到USB磁盘卷（即;不要附加到任何硬盘卷）。但不幸的是，当我插入大容量USB存储设备并检查FLT_VOLUME_PROPERTIES结构的DeviceType参数时，返回的值是FILE_DEVICE_DISK_FILE_SYSTEM，就像硬盘一样。

我应该在这里做什么检查，以确定该卷是USB大容量存储设备？
是否可以通过这种方式识别USB大容量存储设备？

如何在InstanceSetupCallback中判断volumedevice是否为usb？

Hi , 
I'm working on a file system minifilter based product.
My question is, from my file system minifilter driver, is it possible to find out the USB mass storage devices plugged into my system? How can I achive this?
for example:
Given here is the code for my InstanceSetupCallback function. My intent there is to attach only to USB DISK volumes (ie; do not to
attach to any harddisk volumes ). But unfortunately, when I plug in a mass USB storage device and check the DeviceType parameter of FLT_VOLUME_PROPERTIES structure, the value returned is FILE_DEVICE_DISK_FILE_SYSTEM ,as harddisk does.

What should be the checking that I should make here, to determine that the volume is a USB mass storage device?
Is it possible to identify the USB mass storage device this way?

and how do i judge a volumedevice is usb in InstanceSetupCallback?

NTSTATUS InstanceSetupCallback（IN PCFLT_RELATED_OBJECTS FltObjects，
IN FLT_INSTANCE_SETUP_FLAGS标志，
IN DEVICE_TYPE VolumeDeviceType，
IN FLT_FILESYSTEM_TYPE
VolumeFilesystemType）
{NTSTATUS status;
PFLT_VOLUME_PROPERTIES VolumeProperties;
ULONG returnedLength;

NTSTATUS InstanceSetupCallback(IN PCFLT_RELATED_OBJECTS  FltObjects,
                               IN FLT_INSTANCE_SETUP_FLAGS  Flags,
                               IN DEVICE_TYPE  VolumeDeviceType,
                               IN FLT_FILESYSTEM_TYPE
VolumeFilesystemType)
{
    NTSTATUS status;
    PFLT_VOLUME_PROPERTIES   VolumeProperties;
    ULONG returnedLength;

//仅附加到磁盘卷
if（VolumeDeviceType！= FILE_DEVICE_DISK_FILE_SYSTEM）
{return return STATUS_FLT_DO_NOT_ATTACH;
}

    // Attach only to the disk volumes
    if (VolumeDeviceType != FILE_DEVICE_DISK_FILE_SYSTEM)
    {
        return STATUS_FLT_DO_NOT_ATTACH;
    }

//为FLT_VOLUME_PROPERTIES结构分配内存
VolumeProperties =（PFLT_VOLUME_PROPERTIES）ExAllocatePoolWithTag
（NonPagedPool，sizeof（FLT_VOLUME_PROPERTIES）+ 512，FILE_POOL_TAG）;
if（NULL == VolumeProperties）
{
DbgPrint（" OBFilter：没有足够的内存来分配
FLT_VOLUME_PROPERTIES：InstanceSetupCallback"）;
返回STATUS_FLT_DO_NOT_ATTACH;
}

    //Allocate memory for FLT_VOLUME_PROPERTIES structure
    VolumeProperties = ( PFLT_VOLUME_PROPERTIES )ExAllocatePoolWithTag
( NonPagedPool, sizeof(FLT_VOLUME_PROPERTIES) + 512, FILE_POOL_TAG );
    if( NULL == VolumeProperties )
    {
        DbgPrint("OBFilter: not enough memory to allocate
FLT_VOLUME_PROPERTIES: InstanceSetupCallback" );
        return STATUS_FLT_DO_NOT_ATTACH;
    }

//获取卷属性
returnedLength = 0;
status = FltGetVolumeProperties（FltObjects-> Volume，
VolumeProperties，sizeof（FLT_VOLUME_PROPERTIES）+ 512，
& returnedLength）;
if（（！NT_SUCCESS（status））/ * ||（VolumeProperties-> DeviceType！=
FILE_DEVICE_DISK）* /）
{
DbgPrint（" OBFilter：Error geting volume properties：
InstanceSetupCallback"）;
返回STATUS_FLT_DO_NOT_ATTACH;
}

    //Get the volume properties
    returnedLength = 0;
    status = FltGetVolumeProperties( FltObjects->Volume,
VolumeProperties, sizeof(FLT_VOLUME_PROPERTIES) + 512,
&returnedLength );
    if ( (!NT_SUCCESS(status))/* || ( VolumeProperties->DeviceType !=
FILE_DEVICE_DISK )*/ )
    {
        DbgPrint("OBFilter: Error geting volume properties:
InstanceSetupCallback" );
        return STATUS_FLT_DO_NOT_ATTACH;
    }

//如果卷的类型不是FILE_DEVICE_DISK，请不要附加。状态= STATUS_SUCCESS;
if（FILE_DEVICE_DISK！= VolumeProperties-> DeviceType）
{
DbgPrint（" OBFilter：不想附加到这个卷：InstanceSetupCallback"）;
status = STATUS_FLT_DO_NOT_ATTACH;
}

    //Do not attach if the volume is not of type FILE_DEVICE_DISK
    status = STATUS_SUCCESS;
    if( FILE_DEVICE_DISK != VolumeProperties->DeviceType )
    {
        DbgPrint("OBFilter: Not interested in attaching to this
volume: InstanceSetupCallback" );
        status = STATUS_FLT_DO_NOT_ATTACH;
    }

ExFreePool（VolumeProperties）;

    ExFreePool( VolumeProperties );

返回状态;

}

推荐答案

nope，我的朋友。

内核不明白真正的原始设备。

nope, my friend.

that kernel does not understand real raw devices.

这篇关于从minifilter枚举USB大容量存储设备的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！