S
skri
Guest
Hi All,
I am analyzing some code that uses the IoGetDeviceObjectPointer() function to get device object. The function call is invoked like this
IoGetDeviceObjectPointer(L"\\DosDevices\\PhysicalDrive1", FILE_READ_ATTRIBUTES, &FileObj, &DevObj);
Here it is invoking the call for USB pen drive attached to the system.
When i see the devstack in the debugger, the devstack is like this "PartMgr->Disk->USB. When i examine the returned FileObj and DevObj, the FileObj->DeviceObject is pointing to "Disk" and DevObj is pointing to "PartMgr".
Why the FileObj->DeviceObject is not pointing to "PartMgr" instead pointing to "Disk" device object?
I came to know that the IoGetDeviceObjectPointer is internally invoking the ZwOpenFile and sending IRP_MJ_CREATE ioctl. I am assuming that "PartMgr" not able to handle "IRP_MJ_CREATE" and it forwards to the disk class, that is the reason FileObj->DeviceObject is pointing to "Disk" .
Thanks,
Sai
Continue reading...
I am analyzing some code that uses the IoGetDeviceObjectPointer() function to get device object. The function call is invoked like this
IoGetDeviceObjectPointer(L"\\DosDevices\\PhysicalDrive1", FILE_READ_ATTRIBUTES, &FileObj, &DevObj);
Here it is invoking the call for USB pen drive attached to the system.
When i see the devstack in the debugger, the devstack is like this "PartMgr->Disk->USB. When i examine the returned FileObj and DevObj, the FileObj->DeviceObject is pointing to "Disk" and DevObj is pointing to "PartMgr".
Why the FileObj->DeviceObject is not pointing to "PartMgr" instead pointing to "Disk" device object?
I came to know that the IoGetDeviceObjectPointer is internally invoking the ZwOpenFile and sending IRP_MJ_CREATE ioctl. I am assuming that "PartMgr" not able to handle "IRP_MJ_CREATE" and it forwards to the disk class, that is the reason FileObj->DeviceObject is pointing to "Disk" .
Thanks,
Sai
Continue reading...