In application we call the creafile as follows
where pVolumeInfo->Extents[0].DiskNumber is the value obtained from
IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS ioctl.
swprintf(pathBuff, L"\\\\.\\PHYSICALDRIVE%d",
pVolumeInfo->Extents[0].DiskNumber);
hDevice = CreateFile(
pathBuff,
GENERIC_READ|GENERIC_WRITE,
FILE_SHARE_READ|FILE_SHARE_WRITE,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL);
If we open the device like this the IOCTL doesnt pass thru our filter driver
whereas if we open it using "\\\\.\\%c:" in place of
"\\\\.\\PHYSICALDRIVE%d"as the input parameter then the IOCTL passes thru our
filter driver.
If I use "\\\\.\\%c:" the ioctls path is something like below(I havent
mentioned all the drivers in the path below)
1.NTFS
2.our filter driver
3.volsnap
4.partmgr
But if I use "\\\\.\\PHYSICALDRIVE%d" the ioctl path it shows is
1.\Device\Harddisk2\DR3
I dont see any other driver in the path.
can any one explain me the difference between the two calls.I thought that
both are opening the same object.
I checked the IOCTLs path using IRP Tracker.
Thanks in advance