Firewall driver with WDK

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Drivers
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - Mirror driver, screen-to-screen BitBlt and consistency. Hi everyone. I'm trying to develop mirror video driver for VNC-like aplication. I've made a "stupid" version that just shares framebuffer into user- space and provide another buffer to store screen updates (just a bounding rect of a CLIPOBJ). But such a driver "produces" too much traffic. It is not much less than while using "blit-and-XOR" approach (BitBlt from screen, XOR with the previous frame and send the result over a wire) in most cases. So, I decided to implement a kind of updates z-Buffer, so that you can discard previous update if it was covered by another one the next moment. But it is not the case in point. The second way of bandwidth utilization improvement is taking screen- to-screen BitBlts into account. They often happen when scrolling appears. When screen-to-screen BitBlt occurs we need to send just a notification with the two rects coordinates instead of the whole bitmap, so this approach can decrease network traffic significally. But there is one problem. If screen-2-screen BitBlt occurs while user- mode application reads frame buffer, data sent to the other client might be inconsistent. And this inconsistency won't be fixed when "screen-to-screen" command is sent because this command carries no bitmap data, and data on the other side of the wire is taken from it's local screen copy which is corrupted. I see two ways of resolving this problem. First is to refuse the idea of taking screen-to-screen BitBlt into account and treat them as a bitmap-to-screen. The second way is to refuse the idea of grabbing the image directly from the framebuffer and create a separate bitmap for each BitBlt and share it's bits into userspace. Please tell me what approach is preferable. I tried to figure it out by disassembling Microsoft's rdpdd.dll, but it's to complex and has many obscure things like additional parameters cheks in DrvXxx berfore calling the corresponding EngXxx and use of private data structures. Tag: Firewall driver with WDK Tag: 98416
  - 2
    - Digitally signed drivers Hi, For installing a drivers which are signed with SPC certificates, on Vista64: 1) Do we need to ask users/clients to install the certificate on target machine? 2) I have a certificate from Verisign. To which certificate stores should the users install the certificates on target machine? 3) Is there a way to install certificates on target/client machines without user requiring to do it manually? Thanks. Tag: Firewall driver with WDK Tag: 98415
  - 3
    - Code for reading image file with jpg format in C Hi all, I want to write a function to read an image file with jpg format in C, C++. Pls let me know if u know. Thanks in advance. Tag: Firewall driver with WDK Tag: 98412
  - 4
    - Filter Centric AVStream driver stops receiveing Process dispach ca I have an AVStream driver I wrote for a card that my company makes, which follows the filter centric model. I also have down stream DirectShow transform filters that interface to the driver through the KSProxy. In general things work pretty good, but when I allow my system to run continuosly for long periods of time (meaning 24-48 hours), my device driver will stop receiving Process dispatch calls from Windows. The down stream transofrm filter is waiting for samples from the driver through the proxy, and the driver is waiting for a Process call from the Windows, the card is waiting for the driver to empty data out of it's full buffers, and the whole system just stops running. Does anyone have any idea what inside Windows causes could cause the Process dispatch to stop being called? Tag: Firewall driver with WDK Tag: 98411
  - 5
    - how to get the status of threads related to a driver Hi everyone, I am a new hand for driver devlopment. Now I face with a problem. I want to view the status of threads related to a driver. For example, are threads related to usbvideo driver runing or suspending (waiting for events). These information is very inportant for me to judge whether the thread related to driver occupy the cpu or not. Is there any way to make it possible? Does windbg provide the command to view it? Your help is very appriciated. Thanks. Tag: Firewall driver with WDK Tag: 98396
  - 6
    - WinDbg & kernel-mode debugging of virtual machines Are there any good white papers or other discussions about setting up WinDbg for kernel-mode debugging of a driver within a virtual machine hosted within VMware Workstation? I'm getting started on some file system filter driver and/or file system minifilter driver development. I have a build environment set up on Vista Ultimate x64, and have a variety of VM guests for WinXP Pro SP2 x86, Vista Business x86 & x64, and Win2K3 R2 x86 & x64. My intent was to use these VMs as my test environment instead of having a separate physical computer with multiple bootable partitions, etc.... Since kernel-mode debugging with WinDbg involves having a COM port or FireWire connection between the debug host & the test system, I was looking for some sort of virtual COM port that I could run under Vista that would connect up to the named pipe that VMware Workstation can associate with a COM port inside of a VM guest. Does such a thing exist? Is anybody else successfully doing kernel-mode debugging of a driver on Windows running as a VMware guest? TIA, Chuck -- Chuck Chopp ChuckChopp (at) rtfmcsi (dot) com http://www.rtfmcsi.com RTFM Consulting Services Inc. 864 801 2795 voice & voicemail 103 Autumn Hill Road 864 801 2774 fax Greer, SC 29651 Do not send me unsolicited commercial email. Tag: Firewall driver with WDK Tag: 98392
  - 7
    - KMDF Buffered vs Direct IO I have a KMDF driver that sets the IO type to Direct and uses WdfRequestRetrieve(Output/Input)Buffer call inside EvtIoRead/EvtIoWrite to get a pointer to the request buffer. This works fine. However, if I switch the device IO type to Buffered, then the WdfRequestRetrieveX functions return SUCCESS status, yet set the buffer pointer to NULL. I don't see any explanation for this in the documentation, as these functions are supposed to work identically regardless for both Direct and Buffered IO type; furthermore, I imagine that a buffer retrieval problem would be indicated by the returned status. Any ideas? Tag: Firewall driver with WDK Tag: 98391
  - 8
    - Errors reading crash-dump file using i386kd I tried to read .dmp file as follows: i386kd -z c:\Windows\Memory.dmp Dumpcheck too throws up similar errors: dumpcheck c:\Windows\Memory.dmp Then I get these errors: ========================================================================= Microsoft (R) Windows Debugger Version 6.6.0007.5 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [c:\WINDOWS\MEMORY.DMP] Kernel Complete Dump File: Full address space is available Symbol search path is: C:\WINDOWS\symbols\ Executable search path is: C:\WINDOWS *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrn Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible Product: WinNt, suite: TerminalServer SingleUserTS Built by: 2600.xpsp_sp2_gdr.050301-1519 Kernel base = 0x804d7000 PsLoadedModuleList = 0x805531a0 Debug session time: Wed Aug 29 11:43:57.906 2007 (GMT+5) System Uptime: 0 days 1:50:41.502 *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrn Loading Kernel Symbols ................................................................................. Loading User Symbols Loading unloaded module list .............. ERROR: FindPlugIns 8007010b ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 7E, {c0000005, b9678000, f7a37bb8, f7a378b4} ***** Kernel symbols are WRONG. Please fix symbols to do analysis. ***** Kernel symbols are WRONG. Please fix symbols to do analysis. *** WARNING: Unable to verify timestamp for w2k_kill.sys *** ERROR: Module load completed but symbols could not be loaded for w2k_kill.sys *** WARNING: Unable to verify timestamp for mssmbios.sys ********************************************************************************* *** *** Your debugger is not using the correctsymbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full typeinformation. *** *** *** *** Certain .pdb files (such as the public OS symbols) donot *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to work. *** *** Type referenced: mssmbios!_SMBIOS_DATA_OBJECT *** *** *** *********************************************************************************** *********************************************************************************** [3 repeatations of the above block within asterisks] Probably caused by : w2k_kill.sys ( w2k_kill+1000 ) Followup: MachineOwner --------- ======================================================================== I had installed these: Windows XP SP2 x86 Retail Symbols (c:\Windows\Symbols): [http://msdl.microsoft.com/download/symbols/packages/windowsxp/ WindowsXP-KB835935-SP2-slp-Symbols.exe] Debugging Tools for Windows 32-bit Versions: Previous Release version 6.6.7.5 - July 18, 2006 [http://msdl.microsoft.com/download/symbols/debuggers/ dbg_x86_6.6.07.5.exe] And my system specs are: MS Windows XP Professional Version 2002 Service Pack 2 AMD Athlon 64 Processor I have set the following environment variables: _NT_EXECUTABLE_IMAGE_PATH to C:\Windows _NT_SYMBOL_PATH to C:\Wndows\Symbols -------------------------------------------------------------------------------------------------------------------------------------------- Where have I gone wrong in setting up my debugging environment? Tag: Firewall driver with WDK Tag: 98389
  - 9
    - Problem using WriteFile I am using WriteFile to write directly to LPT1, where I have an Epson POS printer. This works fine unless I have a printer (anything, 'Generic / Text only', the printer itself) setup to use LPT1 in windows. Somehow having LPT1 in use in windows is preventing my data from sending correctly. I have enabled the option 'Use any interrupt' on my LPT1, and that works only until I reboot the machine. Has anyone ever encountered this before? Tag: Firewall driver with WDK Tag: 98387
  - 10
    - Formatting DVD-RAM with UDF filesystem on Vista Hi, I have an app that will run on Vista and needs to format a DVD-RAM using the UDF filesystem. The application is in Delphi. I'm looking for functions from Win32 (or other) API, which can be used by the application directly without user interaction. Thanks for any help. Tag: Firewall driver with WDK Tag: 98383
  - 11
    - BSOD in usbuhci Hi Guys, I need your help in debugging a BSOD in usbuhci. Our device sits on uhci controller, has two bulk endpoints - in and out. When application starts streaming I submit 10 bulk in request to the controller, when the request is completed data is copied into user buffer and request (irp/urb/data buffer) is re-sent to the controller. From time to time (once in few seconds) I submit bulk out request. Now the problem: the BSOD I get appears once in a month, at this rate it is very hard to understand under what conditions it occurs. Here is crash dump analysis, hope you'd help me to figure this out. Does the crash happen with bulk in or bulk out request? The bulk in buffers are allocated in system memory, bulk out buffer is a user buffer which is locked and mapped. So what is the problem? Thanks, Anatoly. ============================================================= Microsoft (R) Windows Debugger Version 6.7.0005.1 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [T:\Bugs\Bug #1292\MEMORY.DMP] Kernel Complete Dump File: Full address space is available Symbol search path is: SRV*c:\temp\s*http://msdl.microsoft.com/download/symbols;SRV*c:\temp\e*http://msdl.microsoft.com/download/symbols Executable search path is: Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible Product: WinNt, suite: TerminalServer SingleUserTS Built by: 6000.16386.x86fre.vista_rtm.061101-2205 Kernel base = 0x81800000 PsLoadedModuleList = 0x81911db0 Debug session time: Wed Aug 29 17:28:27.079 2007 (GMT+2) System Uptime: 1 days 14:42:12.809 Loading Kernel Symbols ................................................................................................................................................... Loading User Symbols Loading unloaded module list ......................................... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck A, {d9afcc, 2, 0, 818834f3} Probably caused by : usbuhci.sys ( usbuhci!UhciMapAsyncTransferToTds+1a9 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: 00d9afcc, memory referenced Arg2: 00000002, IRQL Arg3: 00000000, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: 818834f3, address which referenced memory Debugging Details: ------------------ READ_ADDRESS: 00d9afcc CURRENT_IRQL: 2 FAULTING_IP: nt!memcpy+33 818834f3 f3a5 rep movs dword ptr es:[edi],dword ptr [esi] DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0xA PROCESS_NAME: Idle TRAP_FRAME: 818f19a8 -- (.trap 0xffffffff818f19a8) ErrCode = 00000000 eax=00d9b00c ebx=100000e1 ecx=00000010 edx=00000000 esi=00d9afcc edi=83c78040 eip=818834f3 esp=818f1a1c ebp=818f1a24 iopl=0 nv up ei pl nz ac po nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010212 nt!memcpy+0x33: 818834f3 f3a5 rep movs dword ptr es:[edi],dword ptr [esi] es:0023:83c78040=000000ff ds:0023:00d9afcc=???????? Resetting default scope LAST_CONTROL_TRANSFER: from 818834f3 to 8188fc44 STACK_TEXT: 818f19a8 818834f3 badb0d00 00000000 4f444648 nt!KiTrap0E+0x2ac 818f1a24 87436a79 83c78040 00d9afcc 00000040 nt!memcpy+0x33 818f1a74 87436ee7 84b04144 83be2f6c 00e89bf4 usbuhci!UhciMapAsyncTransferToTds+0x1a9 818f1aa0 8743501c 84b04144 00000000 83c78be0 usbuhci!UhciBulkOrInterruptTransfer+0xb5 818f1ac4 87dd2653 84b04144 83be2f6c 83e899dc usbuhci!UhciSubmitTransfer+0x72 818f1aec 87dd224b 84b03002 83be2db8 83e89918 USBPORT!MPf_SubmitTransfer+0x67 818f1b00 87dcbbd8 84b030e0 83be2db8 83e89918 USBPORT!MPx_SubmitTransfer+0x35 818f1b2c 87dcd704 38496573 00000004 00000010 USBPORT!USBPORT_iSetGlobalEndpointStateTx+0x16f 818f1b60 87dcdfe4 84b03028 00000000 31627573 USBPORT!USBPORT_Core_iSubmitTransferToMiniport+0x194 818f1bcc 81ba5f38 84b03028 00000000 84b030e8 USBPORT!USBPORT_Core_ProcessScatterGatherList+0x660 818f1bf8 81ba6116 8374f530 84b03028 88a95ec0 hal!HalBuildScatterGatherList+0x1ba 818f1c28 87dce524 84bfc4e8 84b03028 88a95ec0 hal!HalGetScatterGatherList+0x26 818f1c7c 87dc756d 84b03028 84b03ac0 000000dc USBPORT!USBPORT_Core_iMapTransfer+0x315 818f1cc0 87dc55b9 84b03028 84b03ac0 84b03002 USBPORT!USBPORT_Core_UsbMapDpc_Worker+0x397 818f1ce8 818a93ae 84b03acc 34776478 00000000 USBPORT!USBPORT_Xdpc_Worker+0x273 818f1d50 818912ae 00000000 0000000e 00000000 nt!KiRetireDpcList+0x147 818f1d54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x46 STACK_COMMAND: kb FOLLOWUP_IP: usbuhci!UhciMapAsyncTransferToTds+1a9 87436a79 8b45d8 mov eax,dword ptr [ebp-28h] SYMBOL_STACK_INDEX: 2 SYMBOL_NAME: usbuhci!UhciMapAsyncTransferToTds+1a9 FOLLOWUP_NAME: MachineOwner MODULE_NAME: usbuhci IMAGE_NAME: usbuhci.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4549b268 FAILURE_BUCKET_ID: 0xA_usbuhci!UhciMapAsyncTransferToTds+1a9 BUCKET_ID: 0xA_usbuhci!UhciMapAsyncTransferToTds+1a9 Followup: MachineOwner --------- Tag: Firewall driver with WDK Tag: 98382
  - 12
    - How to detect user context An application can request my driver for some service. I want to know the user name and other informations (sid etc). -- Sincerely, Maruf Maniruzzaman, Software Engineer, KAZ Software Limited, Dhaka, Bangladesh. http://kaz.com.bd http://kuashaonline.com This posting is provided "AS IS", and confers no rights. Tag: Firewall driver with WDK Tag: 98362
  - 13
    - Dsound and sound filter driver first fo all I'm sorry caurse i'm not good at english I had make sound filter dirver and inject to "Media Class" to Upper Just I want that chang the PCM data to speaker but, the driver wasn't work sometimes i intercept IOCTL_KS_WRITE_STREAM but directsound play doesn't make IOCTL_KS_WRITE_STREAM the driver was work with some sound card , doesn't work with another sound card sound chip waveout dsound Sigmatel work work Realtek work X c-media work X how can i intercept directsound buffer with Realtek and c-media sound card? Tag: Firewall driver with WDK Tag: 98361
  - 14
    - When and how does KeDelayExecutionThread get alerted? Hi all, The DDK documetation says: "If the value of Alertable is TRUE and one of the following conditions is present, the thread will be alerted: 1, If the origin of the alert is an internal, undocumented kernel-mode routine used to alert threads. 2, The origin of the alert is a user-mode APC, and the value of the WaitMode parameter is UserMode. In the first of these two cases, the thread's wait is satisfied with a completion status of STATUS_ALERTED; in the second case, it is satisfied with a completion status of STATUS_USER_APC." However, the parameters passed into KeDelayExecutionThread doesn't include any dispatcher object such as event, semaphore, mutex, etc. My question is: By which dispatcher object does current sleeping thread get alerted? Except by user APC. Thanks in advance. Tag: Firewall driver with WDK Tag: 98358
  - 15
    - Responding to keystrokes on Windows Logon desktop Is there any way to listen for a keystroke/hotkey on the Windows Logon screen? I'd like to respond to a particular keystroke, run a program, then refresh the logon screen. No UI necessary. Is that possible to do without messing with msgina.dll? This would be for both XP and Vista. Tag: Firewall driver with WDK Tag: 98356
  - 16
    - Setting OID_802_11_BSSID through DeviceIOControl() Hi I am trying to control the association of a wireless adapter through NDIS miniport driver. I did not write a specific driver myself. Using DeviceIOControl() function, I can query all the OIDs of interest without any difficulty, that is fine. My problem is that I need to set OID_802_11_BSSID to a specific value to control where I want my wireless adapter to connect. Here is the code snippet that I am trying to get to work: BOOL SetAssociated( LPCTSTR lpAdapterName, NDIS_802_11_MAC_ADDRESS DestinationMacAddress) { UCHAR SetBuffer[sizeof(NDISUIO_SET_OID) + sizeof(NDIS_802_11_MAC_ADDRESS)]; PNDISUIO_SET_OID pSetOid; DWORD dwBytesReturned=0; int i = 0, nResult; TCHAR szOut[64]; long e; HANDLE hNIC; UCHAR szMACFileName[512]; pSetOid = (PNDISUIO_SET_OID) &SetBuffer[0]; pSetOid->Oid = OID_802_11_BSSID; for ( i = 0; i < 6; i++ ) { pSetOid->Data[i] = DestinationMacAddress[i]; } // // Construct a device name to pass to CreateFile // strcpy(szMACFileName, DEVICE_PREFIX); strcat(szMACFileName, lpAdapterName); hNIC = CreateFile( szMACFileName, GENERIC_READ|GENERIC_WRITE, // Device Query Access FILE_SHARE_READ | FILE_SHARE_WRITE, //FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED, //0, NULL //INVALID_HANDLE_VALUE ); nResult = GetLastError(); if (hNIC != INVALID_HANDLE_VALUE) { // // We successfully opened the driver, format the IOCTL to pass the // driver. // nResult = DeviceIoControl( hNIC, IOCTL_NDISUIO_SET_OID_VALUE, (LPVOID) &SetBuffer[0], sizeof(SetBuffer), (LPVOID) &SetBuffer[0], 0, &dwBytesReturned, NULL ); if( nResult == 0) /// there was an error, print it out. { e = GetLastError(); wsprintf(szOut, TEXT("Set Associated AP/PC ERROR\nError Code: %d"),e ); MessageBox(0,szOut,TEXT("Error"),MB_OK); return FALSE; } } return TRUE; } I have tried many variations of the above but could not get anything to work yet. I tried both with WZC running or stopped, same results. The CreateFile() function returns no error, but DeviceIOControl() returns with error code 1 (ERROR_INVALID_FUNCTION) Thanks in advance. Bruce Tag: Firewall driver with WDK Tag: 98351
  - 17
    - BDA - using of KS custom method Hi guys, I wrote BDA driver. Everything works just fine. But now I need to comunicate with it from user-level. I think that KS custom method mechanism will be suitable for my needs because I just need to transfer data buffer from my user-side application to this BDA driver. So I do following in the app: { IKsControl* pIKsControl; hr = CoCreateInstance( CLSID_Proxy, NULL, CLSCTX_SERVER, __uuidof(pIKsControl), (LPVOID*)&pIKsControl); // // here hr is S_OK and pIKsControl is not NULL // KSMETHOD ksMethod = { KSMETHODSETID_SetGuid, KSMETHOD_ITEM_Id, KSMETHOD_TYPE_SEND }; ULONG BytesReturned = 0; hr = pIKsControl->KsMethod( &ksMethod, sizeof(ksMethod), buffer, //buffer pointer buffer_length, //buffer size &BytesReturned); // // here hr is E_HANDLE; so some handle that is not valid // } Of course, I implemented MethodSet in KSAUTOMATION_TABLE in the BDA driver. Please help to understand me where is the problem. With best regards --- Bye, Sasha Bublyk Tag: Firewall driver with WDK Tag: 98347
  - 18
    - More Symbol Issues... I apologize if this question has been asked 60,000 times but it's hard to stay on top of the exchanges in here the way I'd like to ... this is very simple so I'm sure anybody can answer. I'm running XP SP2. I downloaded and installed the very latest symbol package for XP 2 days ago. Still, I have to wade through 9,000 lines of debugger output (KD) screaming about "you don't have the right symbols, symbols are wrong, the sky is falling!" If the XP symbols are wrong for XP, which ones are right? Tag: Firewall driver with WDK Tag: 98340
  - 19
    - VSS revert/restore & Hardware VSS Provider Hi, I am working on hardware VSS provider. During the snapshot creation, the hardware provider creates PIT snapshots in hardware. My question is, how is the data (now stored on a VSS copy) supposed to be restored to original volume? >From what I saw there is no interaction between the VSS services and the provider during the restore(Only requestors and writers talk). Any help will be highly appriciated. Thanks Tag: Firewall driver with WDK Tag: 98337
  - 20
    - how to remove "Continue Anyway" during setup virtual webcam Hi all, I try to write a virtual webcam by WDM. While installing on XP , the Installing Hardware dialog appear and forge user must be press "Continue anyway" so that go next step of installing. But , on Vista without this problem. Can you help me how to ignore "Continue Anyway" option during setup my Virtual webcam? Thank for your help Tag: Firewall driver with WDK Tag: 98336
  - 21
    - How to know if I/O range is reserved? And by whom? Hi, I have a PCMCIA device that uses a list of possible I/O to work, for example 1B8-1BF. This range does not appear on the device manager view by type in "Input/outpout (IO)" section but the device cannot start (code 12 : Windows cannot find enough resource) and the 1B8-1BF range is marked as not available. What could use this range ? BIOS ? Is there a way to list the I/O ranges that are occupied by Windows or/ and BIOS ? Thanks, Roger Tag: Firewall driver with WDK Tag: 98335
  - 22
    - workaround for flawed PCIe device hi, I now have a flawed PCIe card, which has its BAR in PCI configuration space write-only( what a stupid mistake ) while other parts function well. The new one will only be ready months away. And I have to live with the bug sometimes. The bug causes windows fail to configure and allocate resources for the device. So I want to resume the configuration and allocate the resources in my WDM function driver. Is it OK to respond IRP_MN_QUERY_RESOURCE_REQUIREMENTS or use the legacy IoAssignResource? Since this is for demo usage, and we can tolerate most unstable, buggy or any other noises. Any wild ideas? woodhead Tag: Firewall driver with WDK Tag: 98332
  - 23
    - Native WlanAPI: how to ignore the profile mismatch? I am developing a utility to manage the wireless connection. I found that Vista will prevent user to connect to an AP with a mismatch profile, e.g. if user create a profile with OPEN+WEP and want to use this profile to connect to a WPA AP, the 'connect' button will be disabled. So does my utility. When my application made a OPEN+WEP profile and use WlanConnect() to connect to the WPA AP, there is no authentication and association request packet being sent out. Is there anyway to avoid this limitation? Any comment is appreaciated. Tag: Firewall driver with WDK Tag: 98331
  - 24
    - Load Filter synchronous question I want to use Loadfilter to load a minifilter from user space. I want to configure the filter before it begins operation (i.e. before FltStartFiltering) I plan to use the FltCreateCommunicationPort and FilterConnectCommunicationPort and FilterSendMessage to pass in the config info. My question (s) * When I return from DriverEntry without calling FltStartFiltering but instead call IoRegisterDriverReinitialization then return an OK status from DriverEntry, when does the reinit-routine get called? And if I finally get all that working: * Can I issue the FltStartFiltering call from a CommPort Message callback ??? Gak - Finecats Tag: Firewall driver with WDK Tag: 98324
  - 25
    - reading ndis data through WMI Hi , Does anybody know how to get the "Interrupt Moderation" of the network adapter using WMI method. DDK doc says that , user can use GUID_NDIS_GEN_INTERRUPT_MODERATION method to obtain the information. Is any sample code , how to do it ? Thanks Tag: Firewall driver with WDK Tag: 98318
- Next
  - 1
    - Windows XP (SP 2) and USB 2 problem Hello I have just installed a 4 port USB 2 card in my computer. The problem is that when I connected my digital camera, there was a message telling me that the connection would be faster if I had USB 2 Another telltale sign that sth is wrong is that films played on my external drive block (presumably cos the info can't arrive quicly enough) So why doesn't XP recognise a USB 2 card? Anyway, I tried to download a USB 2 driver for Windows and found the Intel Desktop Driver for XP However, on a manual install, XP refuses saying that a more suitable driver is already installed. In system, this drivers seems to be a Microsoft Driver version 5. 1 2600 released 01 June 2002 Is this a USB 2 driver? Hope sm out there can help me. Thanks in advance Dave Neve Tag: Firewall driver with WDK Tag: 98308
  - 2
    - IWiaItemExtras::Escape and VendorReadData? Greetings, I am trying to work with WIA, and I have found the IWiaItemExtras::Escape function. Which can be used to interact with vendor specific commands. But while I use the command I can get the 1st letter specified from the command, but how do I get the acutal data from VendorReadData? It always has 1 byte of data, and I am not sure where to get the output buffer. For example: PTP_VENDOR_DATA_OUT* pDataOut; HRESULT hr = spExtraProps->Escape(ESCAPE_PTP_VENDOR_COMMAND, (BYTE *) pDataIn, dwDataInSize, (BYTE *) pDataOut, dwDataOutSize, &dwActualDataOutSize); When I access the "pData->VendorReadData" it is always the byte[1] size, so I am not sure how to get the actual data. Thanks for any suggestions! Tag: Firewall driver with WDK Tag: 98306
  - 3
    - Get PID/VID from symbolic name? Hello, I would like to retrieve the PID and VID of a mass storage device from its symbolic name. Symbolic name comes from the IoRegisterPlugPlayNotification API indicating the GUID of a disk interface. I guess that there is som eway to find this, but I did not find one. Thanks, Roger Tag: Firewall driver with WDK Tag: 98302
  - 4
    - HID mini port over i8042prt PS2 stack? I'd like to report my PS2 interface device to system as a HID class device. That means I'd like to ask i8042prt to be my port driver, I know there is a moufilter sample in the DDK, well it report itself as a mouse class instead of HID class, and it is a upper filter for the i8042prt. Is it possible to create a HID driver which talked to i8042prt and report itself as a HID class device? Any hint would be apprecited. -chueh888 Tag: Firewall driver with WDK Tag: 98293
  - 5
    - How to hide system error messages. Hi, I am writing a file system minifilter driver. When I fail the create file operation from preoperation callback routine, a windows error message pops up saying "file is not a valid win32 application". and it restricts file from opening successfully. But I want that no popup should be displayed on successfully blocking a file. How can I hide this system popup? Can anybody help me? Thanks in advance. - Vikas sangani Tag: Firewall driver with WDK Tag: 98286
  - 6
    - Sharing handles between user and kernel mode in X64 I found a lot of problems working with handle. I am trying to duplicate a thread handle from user mode that is created in kernel mode. It is not working. Where do I get information about this? -- Sincerely, Maruf Maniruzzaman, Software Engineer, KAZ Software Limited, Dhaka, Bangladesh. http://www.kaz.com.bd http://www.kuashaonline.com Tag: Firewall driver with WDK Tag: 98285
  - 7
    - Why and how is the module name of ntoskrnl.exe displayed as "nt" rather than "ntoskrnl"? Hi experts, I find a weird problem with the WinDBG command 'lm n t': kd> lm n t start end module name 7c920000 7c9b4000 ntdll ntdll.dll Tue Aug 17 07:38:36 2004 (4121457C) 804d8000 806ec600 nt ntoskrnl.exe Wed Aug 04 14:19:48 2004 (41108004) 806ed000 80700d80 hal halacpi.dll Wed Aug 04 13:59:04 2004 (41107B28) bf800000 bf9c0200 win32k win32k.sys Wed Aug 04 14:17:30 2004 (41107F7A) bf9c1000 bf9d2580 dxg dxg.sys Wed Aug 04 14:00:51 2004 (41107B93) ..... All of the module names except 'nt' are their image name without extention. Why? I also wonder how the debugger determines the module name of a given kernel module? Any help will be highly appreciated. Thanks in advance. Tag: Firewall driver with WDK Tag: 98282
  - 8
    - binplace doesn't seem to instantiate post build I have enabled binplace from setenv and specified a location as directed in the documentation. However, it does not seem to work. can someone confirm the steps needed to make this fire correctly? paul. Tag: Firewall driver with WDK Tag: 98279
  - 9
    - another bda question Hi, I have implemented KSPROPSETID_BdaTableSection property set on both nodes of my tuner filter, but the handlers are never get called. Under what conditions this property is set? Thanks, Anatoly. Tag: Firewall driver with WDK Tag: 98275
  - 10
    - Is AttachedDevice an incorrect paramenter name in the function prototype of IoAttachDevice? Hi all, The function prototype of IoAttachDevice is declared as follows in the DDK documentation. /*********************************/ NTSTATUS IoAttachDevice( IN PDEVICE_OBJECT SourceDevice, IN PUNICODE_STRING TargetDevice, OUT PDEVICE_OBJECT *AttachedDevice ); Parameters SourceDevice Pointer to the caller-created device object. TargetDevice Pointer to a buffer containing the name of the device object to which the specified SourceDevice is to be attached. AttachedDevice Pointer to caller-allocated storage for a pointer. On return, contains a pointer to the target device object if the attachment succeeds. /*********************************/ According to the statement above, AttachedDevice should point to a lower device, i.e the target device. However, in English, if an upper device is attached to a lower device, then the upper device, rather than the lower device, should be called "attached device". So, the last paramenter should be named DeviceAttachedTo or something like this. I'm not a native English speaker. I eagerly hope those who speak English can give me some tips. Tag: Firewall driver with WDK Tag: 98274
  - 11
    - Using QueryInterface inside COM Hello I am working on a COM project in which i use Interface Inheritance. The IDL file looks like this, interface IEarthInterface : IUnknown {}; interface IOceanInterface : IEarthInterface {}; interface IPacificInterface : IOceanInterface {}; interface IAntarticInterface : IOceanInterface {}; interface IDataInterface : IUnknown {}; interface IFindInterface : IDataInterface { HRESULT GetOceanTypeInterface(IOceanInterface** pOceanInterface); }; From inside IFindInterface i need to figure out which Ocean is currently attached and then attach or typecast it was IOceanInterface and send it back to client. All i wanted to know is how to get a Interface pointer from inside another Interface. ie, can i call CoCreateInstance or QueryInterface from inside IFindInterface and get the Interface Pointer to IPacificInterface or IAntarticInterface. I been already told that CoCreateInstance will not work in this case. Any idea how to implement this? Thanks in advance. Tag: Firewall driver with WDK Tag: 98261
  - 12
    - Why self signed certificates gives error ? Hi All, While loading a driver on Vista (32 bit) error message pops up "Windows can't verify publisher of this software". Where as our driver is signed. Certification path is : Verisign Class3 Public primary CA Verisign class 3 code signing 2004 CA ABC technology I have copied the certificates from ABC Technology to Trusted Publisher and Verisign Class 3 Code Signing 200CA to Trusted Root Certification Authority under certificate manager. While Checking it under "Device Manager" it shows name of digital signer as "ABC Technology" and under "Driver Detail" tab it shows "Digital Signer : not digitally singed" . Did the verification of driver and catalog using "Signtool utility" SignTool verify /kp /c <(nameofcat).cat> <.inf/.sys> and it shows result "succeed" While checking log under Setupapi.dev.log and it shows errror "Verifying file against specific (valid) catalog failed !(0x800b0109)" "Error (0x800b0109): A certificate chain processed but terminated in root certificate which is not trusted by trust providers" File has not been modified after taking signature. Can I get pointers regarding same that where I m getting wrong ? -- Thanks, Nash Tag: Firewall driver with WDK Tag: 98259
  - 13
    - Getting data from COM Object in Driver Is it possible to reliably use com calls to get data? -- Sincerely, Maruf Maniruzzaman, Software Engineer, KAZ Software Limited, Dhaka, Bangladesh. http://www.kaz.com.bd http://www.kuashaonline.com Tag: Firewall driver with WDK Tag: 98248
  - 14
    - Windows 2000 and BusTypeiScsi Hi all, I am using iSCSI HBA on Windows 2000 SP4 (with Rollup update1). I want to use MPIO feature of iScsi Initiator services but unable to do so. I can login to target and see the Luns in the Device Manager but mpdev does not seem to claim these Luns. According to Microsoft iSCSI Software Initiator User's Guide 2.x, For an HBA to work properly with Microsoft MPIO, HKLM\SYSTEM\CurrentControlSet\Services\hbadevicedriver\Parameters\BusType key should be set to BusTypeiScsi(0x09) so that the Microsoft iSCSI DSM can claim the device. I do see this registry key set but it seems SCSIPORT driver is returning BusTypeScsi for these Luns. The knowledge base article 264203 describes IOCTL_STORAGE_QUERY_PROPERTY can be used to get the adapter and device properties. When used on my system this IOCTL returned bus type as 1(BusTypeScsi) for Adapter and Device. This is a default bustype returned by SCSIPORT. Can some one help me to get iSCSI HBA working with MPIO on Windows 2000? Thanks. Tag: Firewall driver with WDK Tag: 98242
  - 15
    - WPD driver error 10 after reboot Hi all, I am working on a device driver which is based on the WpdWudfSampleDriver (DDK, 6000). Everything is great (driver works as expected and installs/uninstalls, WMP11 recognizes it, etc) until I reboot the PC. After reboot, the driver appears with a yellow exclamation mark icon in the device manager. Properties dialog indicates that "Device cannot start" with error 10. This happens on both Vista 32bit and XP+SP2+WMP11. I tried to compile in different build environments (XP or Vista), also tried the tweaks from WPD team blog about co-installers, nothing helped so far. In addition to that, I realized that even simplest WPD driver example from the DDK (WpdHelloWorldDriver) also works same way (also shows error 10 after PC reboots). Can it be related to the fact that the driver is actually a root-enumerated device (like original WpdWudfSampleDriver) and is not assigned to any USB VID/PID? Or a missing .cat file? missing signature, maybe? I have checked last 10 pages of the newsgroup and did a search, but could not find anything relevant. Did anyone experience same problem? Please, give me some advice on what else I could try/check. Or please, let me know where else I could post this question... thanks and best regards, Sergey Tag: Firewall driver with WDK Tag: 98240
  - 16
    - Driver signing question Hey All, Quick question about driver signing. I hope this is the correct forum for my question. I have a device driver for an external PNP device. I am currently signing it and will be shipping it out in my next software release targeting windows vista. I understand that signatures do expire. I'm uncertain if the signature on my signed drivers expire (they do expire, don't they? Where can I find the expiration date?). Furthermore, what will happen when the drivers expire? The drivers, I assume, will still work with the device after the drivers expire, correct? What happens when a user tries to install my device drivers after they expire? Do they just get a notice that the drivers have expired? Thanks in advance, Matt Tag: Firewall driver with WDK Tag: 98238
  - 17
    - NMI: Parity check / Memory parity error during debugging Hello everyone, I am a newbie to driver development. Currently, I am working on a PCI driver on Windows XP platform. I have a target that runs my driver and a host on which Windbg runs. The problem I have is as follows: I want to make sure that the operations that are carried out by my ISR routine are correct. Thus, I set a breakpoint in the ISR. The routine is called normally and the breakpoint is reached. However, when I want to access fields of one of my volatile structs in the watch window, the target machine bugchecks giving out the "NMI: Parity check / Memory parity error" error. When the breakpoint is removed, the ISR runs normally. I searched the group posts and the web for possible reasons but could not come across anything like this. Many sites say that ISR should not be debugged "the usual way" like I try to do.Am I doing something wrong regarding this issue? What could be other possible reason for this behaviour? Many thanks in advance! Tag: Firewall driver with WDK Tag: 98223
  - 18
    - GeneralAttributes & RegistrationAttributes for IrDA Miniport Driver. Hi, In the Due course of Developement of Miniport IrDA Driver the Registration and General Attributues used are given as follows, can anyone comment on this, if it is correct or not ??? RegistrationAttributes.AttributeFlags = NDIS_MINIPORT_ATTRIBUTES_NDIS_WDM; RegistrationAttributes.InterfaceType = NdisInterfaceInternal; GeneralAttributes.MediaType = NdisMediumIrda; GeneralAttributes.MediaConnectState = MediaConnectStateConnected; GeneralAttributes.MediaDuplexState = MediaDuplexStateHalf; GeneralAttributes.MacOptions = NDIS_MAC_OPTION_COPY_LOOKAHEAD_DATA | NDIS_MAC_OPTION_TRANSFERS_NOT_PEND | NDIS_MAC_OPTION_NO_LOOPBACK; GeneralAttributes.PhysicalMediumType = NdisPhysicalMediumIrda; GeneralAttributes.RecvScaleCapabilities = NULL; GeneralAttributes.AccessType = NET_IF_ACCESS_POINT_TO_POINT; GeneralAttributes.DirectionType = NET_IF_DIRECTION_SENDRECEIVE; GeneralAttributes.ConnectionType = NET_IF_CONNECTION_DEDICATED; GeneralAttributes.IfType = IF_TYPE_OTHER; GeneralAttributes.IfConnectorPresent = TRUE; GeneralAttributes.SupportedStatistics = NDIS_STATISTICS_XMIT_OK_SUPPORTED | NDIS_STATISTICS_RCV_OK_SUPPORTED | NDIS_STATISTICS_XMIT_ERROR_SUPPORTED | NDIS_STATISTICS_RCV_ERROR_SUPPORTED | NDIS_STATISTICS_RCV_CRC_ERROR_SUPPORTED | NDIS_STATISTICS_RCV_NO_BUFFER_SUPPORTED | NDIS_STATISTICS_TRANSMIT_QUEUE_LENGTH_SUPPORTED; Thanks and Regards, Neo Tag: Firewall driver with WDK Tag: 98217
  - 19
    - Personal: Wdm driver ioCalling Wdf driver looking for STATUS_SUCCE if the WDF driver [callee] does WDFCompleteWithInfo(SUCCESS, . .) why does WDM driver [caller] get STATUS_PENDING ? ? ? tom Tag: Firewall driver with WDK Tag: 98204
  - 20
    - Fast I/O Functions not being called I'm developing a file system filter driver - same base functionality as FileSpy, but without all the useless bloat, complication, inefficiency and fluff. I have set up my fast I/O table in Driver Entry ... allocated it, checked and double checked every last field (including size ... it's 0x70), assigned it by DriverObject->FastIoDispatch = fastIoDispatch; I broke into KD and double checked every address. No crashes are occurring, no bugs are occurring. DriverObject exits with its FastIoDispatch field assigned to my very valid table. But no fast I/O functions ever get called. When I open non-Microsoft programs, all the disk I/O passes through my filter driver. The very first line of every fast I/O dispatch is a DbgPrint statement. I even tried DbgBreakPoint and a straight inline assembler _asm int 3. They're never called. The standard dispatch routines are being called just fine. Any program I run that comes from Microsoft leaves my driver dead in the water. There is no activity. All other programs run all disk I/O through my driver - when the disk is hit. I understand the difference; when fast I/O is used and why, but I don't understand why such a simple process is not working. Assuming nothing is wrong with my code, it must be something I'm leaving out (although this process is not difficult; how many things are there to leave out?). So I must be doing something stupid to disable these calls. Conceptually, are there any ideas? Tag: Firewall driver with WDK Tag: 98201
  - 21
    - Enable/Disable iSCSI HBA on Windows 2000 Hi, I have a issue with enable/disable of the iSCSI HBA we are developing. Our HBA is a mass storage adapter and the SCSIPort miniport driver loads during boot. After the OS comes up, we can perform all operations using Microsoft iSCSI Initiator and everything's fine. The problem occurs when I disable the adapter and enable it again from DeviceManager. After this operation, though the driver successfully unloads and reloads, our HBA fails to get listed under iSCSI WMI. iscsicli listinitiators does not report our HBA. Enabling the debugprints for WMI discovery module, I see errors - iscsidsc: Interface \\?\PCI#VEN_xxxx&DEV_xxxx&SUBSYS_xxxxxxxx&REV_00#4&3b9abcb&0&0008#{2accfe60-c130-11d2-b082-00a0c91efb8b} has arrived or remove failed iscsidsc: ArrivalTimer 30 for 00080C58 \\?\PCI#VEN_xxxx&DEV_xxxx&SUBSYS_xxxxxxxx&REV_00#4&3b9abcb&0&0008#{2accfe60-c130-11d2-b082-00a0c91efb8b} Flags 0x0 iscsidsc: Getting InstanceName for Interface \\?\PCI#VEN_xxxx&DEV_xxxx&SUBSYS_xxxxxxxx&REV_00#4&3b9abcb&0&0008#{2accfe60-c130-11d2-b082-00a0c91efb8b} iscsidsc: Error 4201 finding instance name for \\?\PCI#VEN_xxxx&DEV_xxxx&SUBSYS_xxxxxxxx&REV_00#4&3b9abcb&0&0008#{2accfe60-c130-11d2-b082-00a0c91efb8b} iscsidsc: Error 4201, try 0 Didn't get InstanceName for Interface \\?\PCI#VEN_xxxx&DEV_xxxx&SUBSYS_xxxxxxxx&REV_00#4&3b9abcb&0&0008#{2accfe60-c130-11d2-b082-00a0c91efb8b} This continues until the ArrivaTimer counts down upto 0 and the device never gets added. The same binary which shows this problem on Windows 2000 works fine on Windows 2003. iscsidsc: Interface \\?\PCI#VEN_xxxx&DEV_xxxx&SUBSYS_xxxxxxxx&REV_00#4&3b9abcb&0&0008#{2accfe60-c130-11d2-b082-00a0c91efb8b} has arrived or remove failed iscsidsc: ArrivalTimer 30 for 0008DE40 \\?\PCI#VEN_xxxx&DEV_xxxx&SUBSYS_xxxxxxxx&REV_00#4&3b9abcb&0&0008#{2accfe60-c130-11d2-b082-00a0c91efb8b} Flags 0x0 iscsidsc: Getting InstanceName for Interface \\?\PCI#VEN_xxxx&DEV_xxxx&SUBSYS_xxxxxxxx&REV_00#4&3b9abcb&0&0008#{2accfe60-c130-11d2-b082-00a0c91efb8b} iscsidsc: Error 4201 finding instance name for \\?\PCI#VEN_xxxx&DEV_xxxx&SUBSYS_xxxxxxxx&REV_00#4&3b9abcb&0&0008#{2accfe60-c130-11d2-b082-00a0c91efb8b} iscsidsc: Error 4201, try 0 Didn't get InstanceName for Interface \\?\PCI#VEN_xxxx&DEV_xxxx&SUBSYS_xxxxxxxx&REV_00#4&3b9abcb&0&0008#{2accfe60-c130-11d2-b082-00a0c91efb8b} iscsidsc: ArrivalTimer 29 for 0008DE40 \\?\PCI#VEN_xxxx&DEV_xxxx&SUBSYS_xxxxxxxx&REV_00#4&3b9abcb&0&0008#{2accfe60-c130-11d2-b082-00a0c91efb8b} Flags 0x0 iscsidsc: Getting InstanceName for Interface \\?\PCI#VEN_xxxx&DEV_xxxx&SUBSYS_xxxxxxxx&REV_00#4&3b9abcb&0&0008#{2accfe60-c130-11d2-b082-00a0c91efb8b} iscsidsc: PnpDeviceInterface \\?\PCI#VEN_xxxx&DEV_xxxx&SUBSYS_xxxxxxxx&REV_00#4&3b9abcb&0&0008#{2accfe60-c130-11d2-b082-00a0c91efb8b} is for instance name PCI\VEN_xxxx&DEV_xxxx&SUBSYS_xxxxxxxx&REV_00\4&3b9abcb&0&0008_0 What interface name is it missing on Windows 2000?? Any help or suggestions? Regards, Prabal Tag: Firewall driver with WDK Tag: 98198
  - 22
    - macro for sources file What is the general way of setting up path for include files in SOURCES. I cannot use relative path because my workspace is in different drive than the WDK installation. My include directory is C:\winddk\6000\inc\ddk. I want some macro to define WDK directory c:\winddk\6000. I want a macro that will work even if new version come up like c:\winddk\7000. I didnot find anything like ddk-root-dir or base-directory. Tag: Firewall driver with WDK Tag: 98188
  - 23
    - NewB question regarding filter drivers Hello driver developers, I am *VERY* new to driver development. As a matter of fact, I do driver installs mostly and now am beginning to learn about developing drivers. Here is my question: We have a filter driver (class filter driver) that should be applied to all Hard Disk Controllers (HDC). The end result should be that all messages to hard disk and optical media should be intercepted by the filter driver. This used to work fine, until the hardware on the system that I am installing this driver on has changed (OS has changed to Vista as well). Now the system uses SATA with AHCI. I have no problem installing the filter on the hard disk, but the filter does not get applied to the optical media for some odd reason. Is it possible to have a filter driver written for devices connected via SATA? On the side note, I am just wondering what creates the following registry key(s) and writes values under them - is it the driver itself or the PNP manager? HKLM\SYSTEM\CurrentControlSet\Services\<DriverName>\Enum. Thank you so much, Natalia Tag: Firewall driver with WDK Tag: 98185
  - 24
    - 1394 device driver Hi, the sample provided in the \src\kmdf\1394 subfolder missed the implementation for gathering the device informations (t1394_GetConfigurationInformation in 1394api.c). Can someone explain what to do here!? The goal is to have a driver that stores the CSR_offset somewhere (in the DeviceExtension), and that I have a function to Read and Write registers of my device. Later receiving iso-chronous transfer to a file would be fine. additional some pointers fro 1394 device drivers would be fine - thank you in advance, thomas Tag: Firewall driver with WDK Tag: 98184
  - 25
    - how to get the top object in the device object's stack Hi all, device stack is as follows (from up to bottom): 1. upper filter dirver 2. usb video class driver 3. lower fitler driver 4. usbccgp driver I tried to get the top object in the device object's stack in lower fitler driver but failed and the return devExt->TopDevice = 0x00. I will appriciate if you provide some suggestions? //===================================== Below is the code in AddDevice() function. #define DEVICE_NAME L"\\Device\\lowUVCFilter" RtlInitUnicodeString(&deviceName, DEVICE_NAME ); status = IoCreateDevice(Driver, sizeof(USBCAMD_DEVICE_EXTENSION), &deviceName, FILE_DEVICE_UNKNOWN, 0, FALSE, &device ); if (!NT_SUCCESS(status)) { return (status); } RtlZeroMemory(device->DeviceExtension, sizeof(USBCAMD_DEVICE_EXTENSION)); devExt = (PDEVICE_EXTENSION) device->DeviceExtension; devExt->TopOfStack = IoAttachDeviceToDeviceStack(device, PDO); status = IoGetDeviceObjectPointer( &deviceName, FILE_ALL_ACCESS, &FileObject, &devExt->TopDevice ); Tag: Firewall driver with WDK Tag: 98183

Hi,

I have a short question:

- have there been any advances in the WDK to write firewall-like
drivers?
- is it possible wo use callout-drivers to implement a packet-
inspection firewall?

As NDIS was too complex for me to work with (on a fun project), I just
want to know if things have changed, so I can have a try on this
again.

Regards,
Chris

Top

Re: Firewall driver with WDK by Chris

Chris
Thu Aug 30 02:36:12 CDT 2007

I am sorry, I forgot to mention the following:

- I have read a little about Windows Filtering Platform. Is is
possible to do deep packet inspection with this? Maybe even in user
mode?
- I want to filter (drop!) ARP traffic. Which concept (besides NDIS)
allows link layer packet inspection?

Regards,
Chris

On 30 Aug., 09:32, Chris <chrismc...@hotmail.com> wrote:
> Hi,
>
> I have a short question:
>
> - have there been any advances in the WDK to write firewall-like
> drivers?
> - is it possible wo use callout-drivers to implement a packet-
> inspection firewall?
>
> As NDIS was too complex for me to work with (on a fun project), I just
> want to know if things have changed, so I can have a try on this
> again.
>
> Regards,
> Chris

Top

Re: Firewall driver with WDK by Maxim

Maxim
Thu Aug 30 01:28:57 PDT 2007

> - I want to filter (drop!) ARP traffic. Which concept (besides NDIS)
> allows link layer packet inspection?

NDIS only.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

Top

Re: Firewall driver with WDK by Chris

Chris
Fri Aug 31 10:32:56 PDT 2007

> > - I want to filter (drop!) ARP traffic. Which concept (besides NDIS)
> > allows link layer packet inspection?
>
> NDIS only.

Thanks a lot for your answer, Maxim.

Regards,
Chris

Top

Re: Firewall driver with WDK by Stephan

Stephan
Wed Sep 05 05:17:57 PDT 2007

On Aug 30, 10:28 am, "Maxim S. Shatskih" <ma...@storagecraft.com>
wrote:
> > - I want to filter (drop!) ARP traffic. Which concept (besidesNDIS)
> > allows link layer packet inspection?
>
> NDIS only.

In fact, you would need to implement an NDIS Filter intermediate (IM)
driver.

Stephan

Top