sys file protector/encryptor

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Drivers
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - obtaining CPU usage Hello! Is it possible to obtain CPU usage by DDK API? Any suggestions how can I do so in driver mode? Thanks, Matt Tag: sys file protector/encryptor Tag: 85009
  - 2
    - Probelms with Vista RC1 Check Build Install I'm installing Vista RC1 checked on a dual-boot system. I've previously installed the free build of RC1 on this machine and everything went well. However, installing the checked built results in a frozen system. I've rebooted and gone back to the XP partition, formatted the Vista partition and tried to install the checked build twice now and the same thing happens. Does anyone know what is happening? Thanks! Tag: sys file protector/encryptor Tag: 84979
  - 3
    - Debugging NWF In Vista I'm running into a problem with my NWF driver under Vista RC1 (build 5600). This driver is for an 11n chipset and I see the following happen when the driver associates with an 11n AP: 1. The STA associates and gets an IP address. 2. If I start a ping to the gateway, the STA sends out an ARP request and the gateway sends back an ARP response. The driver then indicates the ARP response to NDIS, but the NBF is rejected for some reason. I don't see this behavior when the STA associates with an 802.11 b/g AP. I'm trying to install the checked build of 5600, but that's not going smoothly. All the same, is there any way to enable debug trace options in the NWF system so that I can get feedback on what may be happening? Also, has anyone else seen this kind of problem before? Thanks! Tag: sys file protector/encryptor Tag: 84978
  - 4
    - Proper notification/handling of KS format changes. Greetings, I have discovered a dangling pointer bug in my USB camera's UM proxy filter aggregated com object which has now raised in my mind a design question. The aggregated COM object (I'll call it the extension) provides an interface for setting various custom camera parameters to the associated Stream Class driver I have written. This interface is used by all property pages I provide for the camera and also by some custom applications we produce. Many of the parameters can change the format of the image stream. In order to be as friendly as possible, I have attempted to have the extension rebuild the filter graph when any of the format changing parameters is modified. The thinking here was that the extension, as the central object that sends IOCtrls to the KM driver, is in the best position to know which of the many parameters actually impact the image format and thus can reduce the number of times the graph needs to be rebuilt (and also reduce the amount of knowledge the caller must possess). The implementation was to derive my extension from IDistributorNotify in addition to my custom interface. In theory, this will let the extension know (via the NotifyGraphChange method) when the associated filter is added/removed from a graph, has its pins connected/unconnected, and when any other change to the graph happens. Thus in my NotifyGraphChange method, I call m_baseFilter->QueryFilterInfo(&fInf) on the camera's proxy filter and save the fInf.pGraph pointer (if it exists). Then when any relevant parameter is changed, say the X Dimension of the image, I can get the IGraphConfig from the graph and do a Reconnect. I am using the rather brute force method of Reconnect as it is my general understanding (and experience) that renegotiating a format after the initial pin connection is either not supported or completely broken depending on whether you are a Stream Class/AVStream driver and perhaps upon the Windows version. The trouble with this implementation seems to be that while NotifyGraphChange gets called in many of the listed instances, it does not get called when the filter is removed from the graph. Thus depending on the specifics of the graph manipulation, I sometimes end up with a call through an invalid m_graph pointer to Nowheresville with predictable results. While I am sure I can tiptoe around this issue by being a bit more clever (and correct for that matter) in my NotifyGraphChange analysis (for example I have observed that it is always called correctly on pin connect/disconnect and thus I could force my m_graph parameter to NULL then) I am wondering if I am really going about this in the right way. Perhaps the trouble is an abuse of IDistributorNotify. It occurred to me for example that there may be some completely different interface I have not stumbled across yet that sorts this. Or perhaps there is something that could be used from kernel mode that would be more robust (I thought there might be some standard EVENT that would do the trick for example). Is there a preferred technique for notifying a filter graph that the format has changed and the graph must be rebuilt? Or am I already on the right track? Best regards, Tom Udale Tag: sys file protector/encryptor Tag: 84977
  - 5
    - any sample code for kernel file map ? I would like to use ZwCreateSecion() to map a large file in kernel, and access it as a mapped file. Anyone has sample code to demonstrate the process and parameters in each call ? Thanks -Gary Tag: sys file protector/encryptor Tag: 84975
  - 6
    - SATA 1.0a? We have a legacy SATA tape drive that only supports SATA 1.0a. We heard there might be issues with Longhorn server if controller supports AHCI. Will Standard IDE mode (supports SATA 1.0a) still be supported for these controllers? Tag: sys file protector/encryptor Tag: 84972
  - 7
    - srbExtension and PTE depletion Hi All, I'm chasing a driver bug and though you might be able to help me out. I have an LSI SCSI driver which allocates enough memory in the srbExtension to fit a whole filesystem cluster. With WinXPSP2 (SP1 doesn't do this), if I drag a folder with many (100,000) 128KB files onto a volume managed by this driver, the kernel loses Page Table Entries as the copy progresses. I can track this loss in perfmon by watching the Memory->Free System Page Table Entries counter. Lost PTEs are never recovered, and when the kernel gets down to about 4000, it's game over, and the OS throws an "Insufficient Resources Exist to Complete the Requested Service" dialog. I have a similar Adaptec driver which only allocates 4 bytes in the srbExtension, and it does not trigger PTE loss. Large NTFS cluster sizes exacerbate the behavior. I recently tested a Core 2 Duo laptop, and its internal SATA driver, as well as an eSATA ExpressCard both exhibit this behaviour, so it appears that drivers provoking this bug are becoming more widespread. Has anyone developing SCSI drivers seen this issue, or has anyone at MS filed a bug? If so, when can I hope for a fix? Thanks, David Tag: sys file protector/encryptor Tag: 84953
  - 8
    - USB suspend issues I'm using the microchip custom firmware with my USB device and I'm having problems with the the computer constantly trying to suspend the device. It makes the device respond slowly and sporadically. When I uncheck the box "Allow the computer to turn this device off to save power" in the Power Management tab of the device in the device manager, the device works much better. Is there any way in the device descriptor or inf file to tell the computer it shouldn't be trying to shut this device down constantly? Or do I need to make a WMI call as part of the driver install to uncheck that check box? Any help is appreciated. Thanks, Clint Tag: sys file protector/encryptor Tag: 84951
  - 9
    - PNP stop/remove and the current IRP When a device is either stopped or removed, shouldn't the current IRP for which there was I/O in progress be completed before finishing the stop/remove PNP request? When I look at the WDM book examples, I see the device's IRP queue being either stalled or aborted, but I'm unsure about the way the I/O in progress is handled. Both stop and remove look like they either wait for the current I/O to finish or cause the device hardware to abort it, but shouldn't they also complete the IRP associated with that I/O? (either with success in the stop/wait case or error in the remove/abort case) Tag: sys file protector/encryptor Tag: 84950
  - 10
    - NdisQueryBufferSafe returns zero buffer length when NdisQueryPacket says there is more data MiniportSendPacket()... NdisQueryPacket says the total length is 142 say and the packet has 3 buffers. Buffer 1 is 14 length Buffer 2 is 20 length Buffer 3 is 0 length So the Ethernet and IP header are there, the payload is missing. The Packet type is ESP. A Nortel VPN client on the PC. If DNE is run on the PC, the third buffer has the correct length of 108. Any ideas on this? Tag: sys file protector/encryptor Tag: 84939
  - 11
    - microsoft CCID & extended APDU I am currently writing firmware for a smartcard reader that should conform to the CCID USB protocol. The idea is that it should work with the Microsoft generic CCID driver usbccid.sys. Everything work as it should when sending & receiving short APDU's (256 bytes + 10 bytes CCID header). Sending extended APDUs to the reader (pc_to_rdr_xfr block) also works with sizes up to 0xffff (as specified in ISO7816). However when attempting to receive extended APDUs from the reader I get the following error: TransferFlags OUT, SHORT_TRANSFER_OK TransferBufferLength 269 bytes status: URB Status USBD_STATUS_BUFFER_OVERRUN TransferFlags IN, SHORT_TRANSFER_OK TransferBufferLength 256 bytes As far as I can see the driver doesn't allocate enough size in the receive buffer and the reader attempts to send more data than 256. Does anyone know the status of the Microsoft CCID driver and / or what can be done in order to use the extended APDU's in rdr_to_pc_xfr blocks ? The current CCID descriptor that we are using and the card ATR is as follows: static CCID_Desc CCID_desc[1] = { 0x36, 0x21, // Length, Type=CCID 0x01, 0x10, // CCID spec release number 0, // Max slot index 0x01, // 3V, 5V supported 0x02, 0x00, 0x00, 0x00, // dwProtocols = T=1 0xa0, 0x0f, 0x00, 0x00, // default clock frequency = 4000 kHz 0x4c, 0x1d, 0x00, 0x00, // max clock frequency = 7500 kHz 0x00, // no manual clock selection 0x01, 0x2a, 0x00, 0x00, // default data rate = 10.75 kbps 0x10, 0xb1, 0x03, 0x00, // max data rate = 241.9 kbps 0x00, // no manual speed setting 0xfe, 0x00, 0x00, 0x00, // max IFSD 0x00, 0x00, 0x00, 0x00, // dwSynchProtocols, not supported 0x00, 0x00, 0x00, 0x00, // dwMechanical, no special characteristics 0xba, 0x00, 0x04, 0x00, // dwFeautures - APDU level, automatic TA & freq settings 9a, 0x12, // dwMaxCCIDMessageLength 0x00, // 0x01, // 0x00, // 0x00, 0x00, // bClassGetResponse, bClassEnvelope 0x00, 0x00, // wLcdLayout = no LCD 0x00, // bPinSupport = No PIN 0x01, // bMaxCCIDBusySlots = 1 }; Card ATR uchar fakeATR[] = { 0x3b, // TS 0xb5, // T0 0x11, // TA1 0x00, // TB1 0x81, // TD1 0x31, // TD2 0x46, // TA3 0x15, // TB3 0x56, 0x20, 0x31, 0x2e, 0x30, //T1-T5 = "V 1.0" 0x1e}; // TCK Tag: sys file protector/encryptor Tag: 84925
  - 12
    - Shared Memory Creation Hi all, I am trying to create shared memory from the driver Using ZwCreateSection(), but in my XP DDK used for compilation, its giving undeclared identifier. Why is this not included in ntddk.h? and how to create 8 kb of memory betn Appln and kernel and synchronise. Please suggest, Thanks, Chin Tag: sys file protector/encryptor Tag: 84919
  - 13
    - How to send URB and IRP to user mode application? Hello All I am trying to capture URB for USB devices, I have written some code for that, Now my goal is to transfer all those URB's to user mode application for further processing, I am not getting how to send URB's and IRP's to user mode application, Could anyone tell me how to send URB to user mode application, user mode application would access this data for further processing. It would be great if some one explains me using some code. -AJay Tag: sys file protector/encryptor Tag: 84917
  - 14
    - Disk spin down Hi All, I have a question on how the disk spin down is affected for a SATA hard drive. Would the windows storage stack send a START STOP UNIT command to stop the disk? regards vs Tag: sys file protector/encryptor Tag: 84916
  - 15
    - Stall flag vs. remove lock I've been looking at the WDM book queueing example and it seems there are two similar methods for making sure driver activity has ceased before removing a device: stallcount/WaitForCurrentIrp() and: IoAcquireRemoveLock()/IoReleaseRemoveLock()/IoReleaseRemoveLockAndWait() The idea behind the first method is to prevent any new device I/O from being initiated and wait for the current I/O to finish. The idea behind the second method is to prevent any new IRPs from being forwarded to a lower driver and wait for the current IRPs forwarded to a lower driver to complete (so that the driver can't finish the next IRP_MN_REMOVE_DEVICE it might receive until those IRPs are completed). The ideas are very similar. They both center around whether some operation is in progress, whether the device is "busy". It seems like with some code changes, a single method would work, one that simply controls whether the device is currently busy and/or in the process of removal and can wait until the device is no longer busy. Tag: sys file protector/encryptor Tag: 84897
  - 16
    - __readmsr and __writemsr usage HI, Has anyone used "__readmsr and __writemsr" while writing device drivers for windows. These are intrinsic functions in VC++. Not sure how to use it to read MSR values. A sample code demonstrating these command will be helpful. When I try to use them I get a bunch of Linking errors. Thanks NM Tag: sys file protector/encryptor Tag: 84893
  - 17
    - [KMDF USB] My DeviceAdd is being called twice for one device! Yeah, it's me again. This time, I have a composite device here that is configured like the below. Interface 0: - bulk IN endpoint - bulk OUT endpoint - interrupt IN endpoint Interface 1: - bulk IN endpoint - bulk OUT endpoint I load the generic parent driver (usbhub, I'm on Win2k) for this device which then enumerates two child devices. So far, so good. I am using the same function driver binary for both interfaces (PDOs) -- although it is set up with a different service name and different binary name in the other INF file. If the interrupt endpoint is not seen, the driver just removes some functionality on the fly. If it matters, the first interface is "modem" class and the second is "ports" class. I call WdfDeviceCreateDeviceInterface conditionally, either passing GUID_DEVINTERFACE_MODEM or GUID_DEVINTERFACE_COMPORT. I can load my function driver successfully on the first interface without any trouble. When it loads on the second, I am getting *two* calls into my AddDevice routine, and *two* calls into my PrepareHardware. Inside PrepareHardware, I can see that the two WDFDEVICE handles that I'm given are different (say, 0x7CAD0FF8 versus 0x7CA97FF8). Naturally, when I go to call WdfUsbTargetDeviceCreate() inside PrepareHardware, the second call fails out. I can't even fathom a guess as to why this happens. Any ideas? Tag: sys file protector/encryptor Tag: 84892
  - 18
    - Query remove and usage concurrence In the example from the WDM book, IRP_MN_QUERY_REMOVE_DEVICE and IRP_MN_QUERY_STOP_DEVICE determine whether it's okay to remove/stop the device by checking some counters (hibernation, paging, dump) that are incremented/decremented in IRP_MN_DEVICE_USAGE_NOTIFICATION to indicate the types of things the device is used for, but it doesn't look like there's any guard to prevent the counters from being incremented during or after a remove is in progress. Isn't IRP_MN_DEVICE_USAGE_NOTIFICATION one of the PNP IRPs that could happen concurrently with the other PNP IRPs and cause one of these usage counters to successfully increment even after it's been determined the device can be removed? Tag: sys file protector/encryptor Tag: 84886
  - 19
    - WIA Microdriver Default Paper Source I'm writing a WIA microdriver and I would like the default paper source to be the document feeder, rather than the flatbed. I'm kind of hoping that, as there is for the supported resolutions, there might be an INF entry that I could set that would make the default paper source be the ADF. Does anyone know if such an INF entry (or anything else that would accomplish this goal) exists? Tag: sys file protector/encryptor Tag: 84885
  - 20
    - Develop Filter drivers to hide files Hello, I am trying to learn about the magic of file system drivers and I thought that an interesting project would be to develop a filter driver that would hide specific files. I am guessing that it would be something as simple as ignoring some requests to seek some files. would anyone be willing to post some resources that could lead me on my way? I checked through the Windows DDK and was unable to locate anything that would be of interested. Thank you for your time. Tag: sys file protector/encryptor Tag: 84880
  - 21
    - how to get driver letter from DevicePath? Hi everyone, Anyone knows how to get the Cd-Rom's driver letter (e.g. c:\, d:\...) 1. from DevicePath which is returned by SetupDiGetDeviceInterfaceDetail? (e.g. \\?\usbstor#cdrom&ven_storage&prod_photo_guardian&rev_2.00#00000a544861&1#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}) 2. or from DiskNumber (e.g. CD-ROM 1, CD-ROM 2)? Thanks for your help and have a good day. Yours, Michael, zhang Tag: sys file protector/encryptor Tag: 84872
  - 22
    - driver installation problem I have taken a sample driver from the WDK and added some test code in an attempt to test drive the ista driver scene. Although the driver can be built and installed on other platforms, when I try to install it on Vista I get the following error after using Have Disk to locate the inf file: "The folder you specified doesn't contain a compatible software driver for your device. If the folder contains a driver, make sure it is designed to work with Windows for 32-bit systems." The driver was built from the sample with only cosmetic changes to the INF. Any ideas what generates this error message? I have tried to debug it with the setupapi logs but the log data doesn't differ between a successful install of the sample vs. my driver. any suggestions? Tag: sys file protector/encryptor Tag: 84871
  - 23
    - 32 bit coinstaller in x64 I have a 32-bit coinstaller. Can I install this on an x64 machine. The driver itself is 64 bit. Please tell me if I should move the coinstaller to 64-bit. Any links to msdn where this is discussed would help. Thanks Tag: sys file protector/encryptor Tag: 84868
  - 24
    - WinXP resource outage Hi, a bus driver that I test does not have enough resources to load. Its power state is D3, with XP SP2 installed. The device status as taken from the Device Properties page shows this message: This device cannot find enough free resources that it can use. (Code 12) If you want to use this device, you will need to disable one of the other devices on this system. Click Troubleshoot to start the troubleshooter for this device. And the resources pane shows the same thing. I have read that this error can occur mostly due to shared intterupt lines, but there are no reported conflicts. I also used DeviceTree tool from OSR without finding anything new. Memory usage for this PC has this status: Physical Memory Available - 127 M Kernel Memory Total - 23 M Kernel Memory Paged - 17 M Kernel Memory NonPaged - 6 M I would appreciate your suggestions, Calin Tag: sys file protector/encryptor Tag: 84861
  - 25
    - Perform Task upon print finish.(OEMUNI) Hi all, I am writing bitmap printer driver, i have modified OEMUNI sample and after lots of efforts i am able to generate the bmp files as output of print command. Now, I want to notify the completion of this job to my user-mode UI. Can I Send message to my UI from oemuni.dll--oemenddoc()? Can I do CreateProcess from oemuni.dll--oemenddoc() ? Do i Need to write Ui-plugin dll for printer driver? if so which source code of DDK,XP, i need to look up? and which functions i need to override? Which approach should be taken into account? I also want to have my bmp file to be fixed height/width based on portrait mode or landscape mode ? how to achive this? How to Set page margins (top, left, etc) to zero or some fixed values rather than rely on user? For this do i need to have ui-dll? which source code i need to look at? is it oemui or psuirep? Thanks in advance jrc Regards, jrc Tag: sys file protector/encryptor Tag: 84857
- Next
  - 1
    - Repost: Base Address for DbgHelp.dll The base address for the DbgHelp.dll that's distributed with Windows XP is 0x59A60000. The base address for the one from 8/29/2002 is 0x6D510000. Another recorded base address I have is 0x4bde0000. The base address for the one from July 2006 is 0x03000000. Why does this keep changing? It makes it *really* difficult to make sure that your program doesn't have base address conflicts when these other components keep moving around. Tag: sys file protector/encryptor Tag: 84853
  - 2
    - 4 Full speed isochronous->1 High speed isochronous = 100% CPU We are using 4 USB audio device (PCM2902, manufacturer TI) connected to the Southbridge ( 82801 GB/GR, Manufacturer Intel, a.k.a. ICH7) of a motherboard through a Multi-TT high speed USB Hub (2507, manufacturer SMSC). It means that there are four periodical isochronous full-speed streams that are converted to one High-speed USB stream by the Hub, before being sent to EHCI controller of the Southbridge. Software configuration is Windows XP (Professional) SP2 with auto-update activated. (Kernel Version 5.1.2600.2180) In this configuration, there is a high increase of CPU load (peak to 100%) when audio channels are all activated in both direction (Wave In, Wave Out). It induced lost of many audio frame and lost of audio stream. Another interesting test has been done connecting directly the four USB audio devices directly to Southbridge UHCI controller (i.e. using 4 full-speed USB stream). In this case, it operates correctly (less than 20% CPU load without lost of audio frame), what validated our software. Is it a way to use the USB Hub in High speed mode without having the CPU reaching 100%? Thanks Blaise Tag: sys file protector/encryptor Tag: 84852
  - 3
    - FAT32 File system I need help on the FAT32 file system implementation. Please clarify this doubts. - How does the OS find the size of the new device when the device is formatted? In floppy where the size of the floppy is stored.? - How much space we need to allocate for FAT table in FAT32 file system? Thanks! Tag: sys file protector/encryptor Tag: 84851
  - 4
    - strange behaviour of tagged pool Hi, I have an NDIS 5.1 miniport. In order to test some mechanism I built I inserted some calls to NdisAllocateMemoryWithTag in the checkforhang callback. This means that every few seconds I allocated a chunk of memory, I did not free it or even read or wrote to it - just allocated it. I used both Poolmon.exe and also !poolusage from WinDbg to monitor pools status and in both cases I got the same results: When the allocated size was 4081 and higher both Poolmon and !poolusage show me that the tagged pool allocations are indeed increased i.e. I saw an evidence to the allocations. But when the allocation size was 4080 or lower neither poolmon or !poolusage showed me any indication to the allocation from the tagged pool. The pool's statistics were unchanged and (I made sure through the debugger that NdisAllocateMemoryWithTag is indeed called). Any idea what is the reason for that? Thanks Miki Tag: sys file protector/encryptor Tag: 84850
  - 5
    - Sharing interruot between two drivers for the same interface Hi, Can the interrupt be shared between -two drivers on PCI interface, one of the driver being Ndis miniport for that particular interface ? -two drivers on PCMCIA interface, one of the driver being Ndis miniport for that particular interface ? - two driver on USM interface, one of the driver being Ndis miniport for that particular interface ? If so, is status = IoConnectInterrupt( &DeviceExtension->InterruptObject, BcmIrqServiceRoutine, (PVOID) DeviceExtension, NULL, Vector, Irql, Irql, Mode, Shared, Affinity, FALSE ); is the function used in all the non-ndis driver with shared attib and in Ndis the called used is Status = NdisMRegisterInterrupt(&Adapter->Interrupt, AdapterHandle, AiVector, // bus-relative vector number used by the NIC. AiInterrupt, // bus-relative DIRQL for the interrupt TRUE, // MiniportISR function should be called each time the NIC interrupts TRUE, // Other devices on the I/O bus can use this interrupt line InterruptMode); // using LevelSensitive Inerrupts ... even in non-ndis and ndis on USB interface also call the same function to share the interrupts ? Regards Esha Tag: sys file protector/encryptor Tag: 84848
  - 6
    - multipath on Longhorn Hi Everybody, I'd like to do the FC multipath test on Longhorn. http://www.microsoft.com/WindowsServer2003/technologies/storage/mpio/faq.mspx > Q. Are there any plans to release an "Industry Standard" Device Specific > Module (DSM) for Fibre Channel? > A. Yes. The Microsoft industry-standard DSM for Fibre Channel is planned for > inclusion in Microsoft Windows Server code-named Longhorn. I read this news, and I tried to configure FC multipath, but I could't configure the multipath. Please teach the procedure how to configure multipath by using "Industry Standard" DSM for FC which is included in Longhorn. (or has not been included yet?) Longhorn : beta2 Enterprise Edition 32bit HBA : LP9802 * 2 Thanks Tag: sys file protector/encryptor Tag: 84846
  - 7
    - KMDF & USB isochronous Hello, I'm currently evaluating KMDF for an USB Driver. Our device is based on Cypress FX2 chip. We stream video trough EP2 configured as IN Isochronous (High Bandwith device - 2*724 bytes per =B5frame). When looking in the documentation (Version 1.1 of the framework), I see that WdfUsbTargetPipeFormatRequestForRead method must be used with a Bulk or Interrupt Pipe. So I assume that an Isochronous Pipe is not a valid pipe for this method. I also saw that the framework has a continuous reader. But my understanding of this reader is that it's purpose is only for intrinsically asynchronous events (like a change in a device state). As this continous reader doesn't have a limitation on which kind of pipe it use, can I use it for my application ? So my question : What is the right method to use a High Bandwidth Isochronous streaming device with KMDF ? Should I create URB's instead ? I must add that while our device streams video. It's not recognized as a steraming device under windows, that is we do not use directshow or other AVStream interface. So the fact that is video that is currently streamed has little importance. Thanks, Fred. Tag: sys file protector/encryptor Tag: 84840
  - 8
    - About calling User mode functions. Respected Sir, I have a kernel-mode dll, through which I want to call User-Mode Functions. I would like to know asto how can I do so in correct manner ? regards, Sudhanshu Tag: sys file protector/encryptor Tag: 84830
  - 9
    - accessing ttl field from windows filtering platform? I have an odd but simple requirement that I need to see the ttl field and check its value from incoming IP packets. Currently we do this using a simple .sys filter driver (TDI area). This is not really going to work too well for Vista platforms. I would like to use the Windows Filtering Platform to do this task. Is it even possible to check the TTL field of incoming IP packets using WFP? How would I do this? I have not been able to figure this out from the msdn documentation/library I have found. Thanks for the help. Jay Tag: sys file protector/encryptor Tag: 84812
  - 10
    - WinXPSP2, Intel Core2Duo, Kernel drivers Hello, I write experimental drivers, and have never worked on SMP systems yet. I need to upgrade to an IBM T60 but I am worried about the dual-core Intel processor engine. I have the following questions: - It seems the dual-core provides 2 pipelines and 2 caches to 2 cores on a single die. This sounds like a SMP system. Will my drivers have to worry about SMP stuff? - Can I configured Windows XP SP2/BIOS to completely disable/ignore one of the cores when I write my drivers? Will there be a major performance impact if I did this? I read that Windows installs a different HAL when it sees an SMP... so it sounds like I cant do this at boot time each time.. it has to be a one-time decision during installation? Basically, I want to know if I can write non-SMP aware drivers in someway on a IBM T60 that has a core2duo processor engine. Thanks! Tag: sys file protector/encryptor Tag: 84810
  - 11
    - SetupDiCallClassInstaller on Vista I have been using SetupDiCallClassInstaller with DIF_REMOVE to uninstall PCI devices on W2K and XP. This does not appear to work properly on Vista CTP (5472). There is no error returned, i.e, the call to SetupDiCallClassInstaller succeeds, but the device is still installed. Is this a known problem with Vista, or did something change in regards to using the SetupDiXXX API? Thanks, Harry Tag: sys file protector/encryptor Tag: 84805
  - 12
    - WdfIoTargetStop calls FxUsbPipe::WaitForSentIoToComplete even with WdfIoTargetLeaveSentIoPending? I've set up a completion routine for a bulk endpoint continuous reader using KMDF which reads data into a buffer. If my buffer is about to overflow, I want to stop the reader until the buffer is emptied by my application. I'm at DISPATCH_LEVEL inside the completion routine, so I call WdfIoTargetStop() with argument WdfIoTargetLeaveSentIoPending. According to the docs, this is the only way it's acceptable to call WdfIoTargetStop at IRQL <= DISPATCH_LEVEL. However, this still blue screens for me. When I look at the stack backtrace, it looks like WDF is still trying to wait for some sort of cleanup, which causes the blue screen. You can also see from the trace that I passed 0x00000003 to WdfIoTargetStop() which is the enumerated value for leave-sent-IO-pending. Any ideas? 8047166c f38d1aef 8365e748 8364e690 00000000 Wdf01000!FxUsbPipeContinuousReader::CancelRepeaters+0x31 8047167c f38ca634 8364e690 00000000 00000000 Wdf01000!FxUsbPipe::WaitForSentIoToComplete+0x109 80471694 f38c613d 00000003 83b940d0 8364e690 Wdf01000!FxIoTarget::Stop+0x41 804716b0 f396d61a 8365e800 7c9b1968 00000003 Wdf01000!imp_WdfIoTargetStop+0xba 804716c4 f39713d2 7c9b1968 00000003 54434163 xxx!WdfIoTargetStop+0x1a [...kmdf10\inc\wdfiotarget.h @ 375] 80471700 f38d2272 7c9b1968 7c9c3ff0 00000003 xxx!xxxEvtBulkInCompletion+0xe2 [c:\xxx\readwrit.c @ 326] 80471730 f38f270d 7c97a1c8 7c9b1968 83653b14 Wdf01000!FxUsbPipeContinuousReader::_FxUsbPipeRequestComplete+0x3e 80471758 f38cb1dc ae08bff8 8364e690 00000000 Wdf01000!FxRequestBase::CompleteSubmitted+0x89 80471774 f38cb296 01685e30 ae08bf00 804717cc Wdf01000!FxIoTarget::RequestCompletionRoutine+0x195 80471784 80528ee6 00000000 ae08bf00 83685e30 Wdf01000!FxIoTarget::_RequestCompletionRoutine+0x35 804717cc f742e8ae ae08bf00 83679568 85e39028 nt!IovSpecialIrpCompleteRequest+0x18c 80471820 f742e5a1 46616d64 43707269 00000000 USBPORT!USBPORT_CompleteTransfer+0x306 80471850 f742fdcd 546e6f02 80464224 83651708 USBPORT!USBPORT_DoneTransfer+0x135 8047187c f74324c8 85e39028 80464224 85e391f0 USBPORT!USBPORT_FlushDoneTransferList+0x15f 804718ac f74401a1 85e39028 80464224 85e39028 USBPORT!USBPORT_DpcWorker+0x2d2 804718f4 f7440309 85e39028 00000001 8046d6f0 USBPORT!USBPORT_IsrDpcWorker+0x36f 80471910 804644c7 85e39608 6b755044 00000000 USBPORT!USBPORT_IsrDpc+0x15b 80471924 80464462 0000000e 00000000 00000000 nt!KiRetireDpcList+0x30 ffdff800 85e3962c 00000001 80471928 0006e721 nt!KiIdleLoop+0x26 WARNING: Frame IP not in any known module. Following frames may be wrong. ffdff804 00000000 80471928 0006e721 0006e718 0x85e3962c Tag: sys file protector/encryptor Tag: 84796
  - 13
    - Some basic Unicode String questions Hello, I have some questions about Unicode Strings. I looked over MSDN and I couldn't find anything. My last choice was to go through the source code, but I would find it better to ask someone here. 1) Does RtlInitUnicodeString allocate a buffer for me to use? So if I do: UNICODE_STRING myUnicodeString; RtlInitUnicodeString( myUnicodeString, L"hello"); does this allocate room for my unicodeString? 2) I have been initializing my UNICODE_STRING manually, but it seems to get a bit tedious. The way I have been initializing them is like: UNICODE_STRING myString; WCHAR buf[255]; RtlZeroMemory( buf, 255); myString.Buffer = buf; myString.MaximumLength = 255; myString.Length = myString.MaximumLength but this seems long, isn't there a better way? 3) Also, what is the difference between doing this: UNICODE_STRING myUnicodeString; RtlInitUnicodeString( myUnicodeString, L"hello"); and... UNICODE_STRING myUnicodeString; CCHAR ntNameFile[12] = "hello"; STRING ntNameString; RtlInitAnsiString( &ntNameString, ntNameFile); RtlAnsiStringToUnicodeString(&myUnicodeString, &ntNameString, TRUE ); Thanks, any help would be appreciated.. Tag: sys file protector/encryptor Tag: 84794
  - 14
    - USB hub reduces transfer speed? Hi, I am developing a USB driver for a device that reads continous data from the ftdi 245 chip. I am requesting 131072 bytes of data per UsbBuildInterruptOrBulkTransferRequest. This works nice when i am running with the device inserted in on of the laptop computer USB ports, but as soon as i use any 2.0 or 1.1 or 1.0 USB hub, the amount of data returned from every transfer varies from 200 - 50000 bytes, never the amount i requested. Why is it so, that when i use a USB hub, my data transfer slows down alot? Running XP sp2, fully updated. Same thing happens on similar computers, though on my stationary computer with XP sp2, everything works just fine. Any ides or suggestions are very welcome. Regards Wilhelm Tag: sys file protector/encryptor Tag: 84792
  - 15
    - Memory ordering and flag/state variables If a flag (in a device extension for instance) is set in some driver routine and checked in another, shouldn't the first routine technically perform some sort of memory barrier (KeMemoryBarrier() or an InterlockedExchange()) to make sure the new value of the flag would be seen by all CPUs before the function returns? This isn't the same as a test-and-set. One thread only sets the flag and the other only tests the flag, but when the test succeeds the results of any other operations indicated by the flag should be finished. I found out about memory ordering a little while ago, and I've heard the theories about how out-of-order loads and stores can cause problems, but when I look at a lot of code I don't see as many barriers as I'd expect and I wonder why it works. I often just see plain old C assignment statements, and I wonder if it happens to work either because current CPUs order their memory operations or because there are already so many implicit barriers from other intervening operations. Tag: sys file protector/encryptor Tag: 84790
  - 16
    - PNP reentrance Can a driver receive a PNP IRP while its in the middle of processing another PNP IRP? Tag: sys file protector/encryptor Tag: 84788
  - 17
    - How to find PortName I wanted to know how I can figure out the port name (e.g. COMx) that is assigned to a PCMCIA modem. or how I can figure out the device info from port name (e.g. COMx). Would you mind pasting a sample code? In addition, I wanted to know if I were to write the serial dirver for this modem how I can get this infromation from the kernel mode driver. How is the device assigned a COMx number? Does the driver assign the port name or is this done by the OS? Shreyash B. Patel Tag: sys file protector/encryptor Tag: 84787
  - 18
    - No waiting in IRP_MN_REMOVE_DEVICE? In the IRP_MN_REMOVE_DEVICE examples in the WDM book and the DDK, near the end the IRP is forwarded to the driver below it and immediately after this (without waiting) the upper device object is detached and deleted. What made me curious is why there's no need to wait for the lower driver to complete the IRP. Does the I/O manager never have a need to touch the device object again even as the IRP moves back up the stack during completion, or does this happen to work because IRP_MN_REMOVE_DEVICE will complete immediately and never be pended? Tag: sys file protector/encryptor Tag: 84782
  - 19
    - Using WPP in kernel mode drivers that are build using VS/VS2005 Hello, I have a kernel mode driver project and use VS2005 to build this driver. I want to generate logs from this driver and want to use WPP for that reason. I am having diffuclty in defining RUN_WPP preprocessor within VS2005 build settings. If anyone has done similar from VS2005, please part your knoweldge with me. Thanks Brijesh Tag: sys file protector/encryptor Tag: 84778
  - 20
    - WttLogger with DTM Hi, I am new in here and I'm currently configuring my tests to run with DTM. Unfortunatly, I cannot access the windows.beta.wdk.dtm newsgroup due to access problem :( My question is: Where can I find the WTTLogger.h and .lib ? I need them to use the CWTTLogger class within my tests. Anyone started using DTM yet ? Thank you Sylvain Tag: sys file protector/encryptor Tag: 84777
  - 21
    - Whats with red x's in DDK Build 1830? I needed to update my DDK to 1830 and notice all of the red x's which mean that these marked features are not available. No audio stuff, most samples are not available, win xp headers, etc.. What am I missing here? I dont recall my 3790 doing this at all. Thanks, Mike Tag: sys file protector/encryptor Tag: 84776
  - 22
    - 1394B S800 Dear sir, When will the Microsoft Software driver support S800 in 1394B PCI card ? Where can I find the S800 driver for 1394B PCI card ? best regards, David Tang Tag: sys file protector/encryptor Tag: 84763
  - 23
    - 1394 DDI document Dear sir, (1) where can I find the "1394 DDI document" ? (2) How to enable BOOT UP with "1394 diag mode" ? (I do not want to use UI to start the "1394 diag mode") Best regards, Please, help me!! Thanks, David Tang Tag: sys file protector/encryptor Tag: 84762
  - 24
    - Newbie Question : PnP & PS2 ? AFAIK there is no PnP support for PS2 interface in Windows kernel , this is because of PS2 hw or not ? Tag: sys file protector/encryptor Tag: 84754
  - 25
    - File System - large file random access Hi, Is it possible to insert data in the middle of a file without affecting other data? I need this to improve system performance. Assume a large database file (100MB). Now I am inserting 10 bytes in the middle of the file(50MB). What the actions will be taken by the file system? I am assume one of the following action will be taken 1) Insert the new 10 bytes at the 50MB offset and move the bottom half of the 50MB data 10 byte below and allocating a new disk block in the end if required. 2) Allocating new disk block in the middle for the 10 byte and just doing the re-linking. Method 2 will be faster because it requires less number of disk accesses for large files. Is there any file system supporting this kind of functionality TIA, Samuel Tag: sys file protector/encryptor Tag: 84752

PE encryptors are well known. Each driver can be easily reversed using
for instnace IDA. Are there any windows driver file protectors?

Matt

Top

Re: sys file protector/encryptor by Doron

Doron
Mon Sep 11 01:02:35 CDT 2006

what's the point really? attach a kernel debugger and you can see the
decrypted results...

d

--
Please do not send e-mail directly to this alias. this alias is for
newsgroup purposes only.
This posting is provided "AS IS" with no warranties, and confers no rights.

"Mateusz Rutkowski" <matrut@gmail.com> wrote in message
news:1157881915.308502.278730@e3g2000cwe.googlegroups.com...
> PE encryptors are well known. Each driver can be easily reversed using
> for instnace IDA. Are there any windows driver file protectors?
>
> Matt
>

Top