CODEWITHSUNDEEP
windows-7usbdriver
user1547696
user1547696

Reputation: 23

how to handle IRP_MN_QUERY_DEVICE_RELATIONS in USB filter driver

I am new in driver development. I started to develop usb filter driver for Windows7 in order to hide from user some usb device types. I attach my driver on USB hub and can intercept IRP_MN_QUERY_DEVICE_RELATIONS. I have a few questions:

1 - On IRP_MN_QUERY_DEVICE_RELATIONS (QueryDeviceRelations.Type is BusRelations) I receive a pointer to DEVICE_RELATIONS struct.As I understand the Objects array in the struct should hold pointers to PDOs. But, when I test DO_BUS_ENUMERATED_DEVICE flag (From msdn: The operating system sets this flag in each physical device object (PDO). Drivers must not modify this flag.) sometime I see this flag is turned on, and some time the flag is turned off. Does it means that sometime I see PDO and sometime I see FDO? Or some another explanation for this issue? When I get some PDEVICE_OBJECT, how can I know Is it PDO or FDO?

2 - When the user plugs in some usb device, and the filter driver should handle IRP_MN_QUERY_DEVICE_RELATIONS, how can I determine which device from Object array is just now plugged in device and which one was plugged in before, and which one is marked as inactive?

Thanks in advance. Felix.

Upvotes: 2

Views: 1938

Answers (2)

Ilya
Ilya

Reputation: 5613

I've never seen FDOs arrive in a BusRelations update, but perhaps you have another filter driver on your way? Anyway, Tamir answered that question just fine :)

About your second question, the only way I know is to keep a copy of the previously-received Objects array and compare. Don't try to rely on any particular ordering of devices since it can change between versions.

Upvotes: 0

Tamir
Tamir

Reputation: 2533

There is undocumented member DeviceNode in DEVOBJ_EXTENSION because it is not a part of WDM.h and NTDDK.h, so private to the IO or PnP Managers. In any case it is NULL for non-PDO's so "unsupported way" is 

if (DeviceObject->DeviceObjectExtension->DeviceNode) {
        // PDO!
    } else {
        // non-PDO!
    }

I'd prefer not to use it. Instead of it, you can find actual device object via IoGetDeviceObjectPointer or by walking through devobj list starting from PDRIVER_OBJECT. In order to determinate whether devobj is PDO send QDR/TargetDeviceRelation (unref PDEVICE_OBJECT in list when done). If succeeded, resulting devobj in the QDR will be the PDO your device. Here is a good explanation of this. Another option is to use DO_BUS_ENUMERATED_DEVICE. Also take into account that this flag does not means initialized PDO. It set before initialization and upon structure allocation.

Upvotes: 1

Related Questions