hooking COM interfaces and methods

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Drivers
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - where to find a sample RNDIS driver code Is there any sample source code for RNDIS driver available either free or for purchase ? Tag: hooking COM interfaces and methods Tag: 69631
  - 2
    - list of kbs installed This is bit offtopic:- " How can I list the KBs installed on the system?" I am posting here hoping someone would help me fast. Thanks Vipin Tag: hooking COM interfaces and methods Tag: 69629
  - 3
    - A Driver Unload Question I have a user mode application that keeps an IRP pending until a condition is satisfied or the device is removed. The driver's remove device routine completes the IRP with STATUS_CANCELLED. The user mode app then closes the handle. My expectation was that the driver unload routine would be invoked at this point, but I'm not seeing that happen. Is this expected behavior or do I have a bug? Mike Tag: hooking COM interfaces and methods Tag: 69625
  - 4
    - GetVolumeNameForVolumeMountPoint I am getting a compile error c2065. I have included the define for _WIN32_WINNT 0x0501 I have even tried including winbase.h but still get the error. What else could be the problem? Tag: hooking COM interfaces and methods Tag: 69619
  - 5
    - DDK 3790 and WDK 5112 difference for Windows 2K/XP 1) My driver code compiles without error in DDK 3790 version of DDK. I got new version of WDK 5112. Now I cannot compile the code for Windows 2000 and windows XP environment of WDK 5112. Can someone help me with what I can do. 2) For Windows 2000 and Windows XP environment(not Longhorn), will WDK 5112 be very different from DDK 3790. Can I find any resources that help me understand the changes made and how my driver will be different. Compilation/linker errors in WDK 5112: ====================================== driver\1394diag\1394diag.obj : error LNK2019: unresolved external symbol __imp_@ InterlockedPopEntrySList@4 referenced in function _ExAllocateFromNPagedLookaside List@4 driver\1394diag\sfbdrv.obj : error LNK2001: unresolved external symbol __imp_@In terlockedPopEntrySList@4 driver\1394diag\1394diag.obj : error LNK2019: unresolved external symbol __imp_@ InterlockedPushEntrySList@8 referenced in function _ExFreeToNPagedLookasideList@ 8 driver\1394diag\sfbdrv.obj : error LNK2001: unresolved external symbol __imp_@In terlockedPushEntrySList@8 Thanks for the help, Raj Tag: hooking COM interfaces and methods Tag: 69617
  - 6
    - What kind of driver? I am beginning the development of a device driver for a virtual network device. The driver will 'translate' apps I/O for the device into IP packets and viceversa. The driver must be able to do the following: 1) be alerted every time an IP address becomes active in the system 2) peek at incoming IP packets and process those related to the device What type of driver is needed to to the above? My idea is a lower TCPIP filter. Any advice? Thanks in advance Tag: hooking COM interfaces and methods Tag: 69616
  - 7
    - Unable to install printer Hi I am going to Upgrage One of the NT printer driver in to XP, I manage to build all dll's for the OS windows XP using windows xp ddk. but when I try to add it in to the Printers , it gave this message "Unable to install printer. Opertation could not be completed" nothing hapens. when i see the setupapi.log, the following lines appeared [SetupAPI Log] OS Version = 5.1.2600 Service Pack 2 Platform ID = 2 (NT) Service Pack = 2.0 Suite = 0x0100 Product Type = 1 Architecture = x86 [2005/09/07 12:48:08 1956.5033 Driver Install] #-198 Command line processed: C:\Windows\Explorer.EXE #I060 Set selected driver. Any helps are appreciated. Thanks & Regards Niro Tag: hooking COM interfaces and methods Tag: 69615
  - 8
    - ndisprot, ndisuio, packet - Help plz? Hi, For the last 5-6 months I have tried the "ndisprot like" examples from the 3 versions of the DDKs (packet, ndisuio, ndisprot) and practically I have learned a few things through trial and error. I have been working on an application that needs to move from layer 3 of the Network stack to as close as possible to the layer 2. I thought to take (initially) ndisuio example and use it. The problem is that I am actually trying to create a network bridge between two NIC interfaces but to do so I need a good throughput which basically comes down to asynchronous operation. I am familiar with the implications of that (dublicate frames, forwarded frame unless broadcast needs to have the dest MAC of the neighbour device etc.). I have solutions for these. The problem is the bridging! I am really desperate for a solution... I 've figured out that I can't open 2 handles per interface (or am i wrong here?) so that leaves me with overlapped operation. Now i tried that but it all seems to fail. Does any of this DDK examples really supports overlapped operation? Either on opening a device or on the createfile? And when using overlapped operation is it better (faster) to use createfile with readfile/writefile and getoverlappedresult or a callback function? And okay, we are not supposed to use the same overlapped structure but assuming that we have 100 frames per second am i supposed to initialise 100 frame structs containing 100 different overlapped structs? Isn't there another way?? Is there anyone out there who has achieved proper overlapped operation using any of these three DDK examples? Can that someone kindly provide me with some advice? Please? ps: At some point I have tried 4 different versions of the same driver (2 per interface, one for reading one for writing) in an attempt tto overcome the "only one handle per interface" rule, but the throughput of the bridge has been pathetic (8-10Kb/s on a FTP transfer on a 10/100Mbps bridging). Any idea why that can be? Are multiple ndisuio drivers not supposed to be loaded together? Kind regards, dimitris de4rag@hotmail.com Tag: hooking COM interfaces and methods Tag: 69612
  - 9
    - noob queston If I am making a device FILE_DEVICE_FILE what will I get in IRP_MJ_READ , IRP_MJ_WRITE functions I mean what will the Irp structure hold. (the read buffer for IRP_MJ_READ and the write buffer for the IRP_MJ_WRITE) and how can I stop these operations from happening the read write close or open functions without hooking? Tag: hooking COM interfaces and methods Tag: 69610
  - 10
    - DefineDosDevice() for kernel-space wanted Hello all, I'm currently writing a disk driver. I have successfully created a mount point on, say, drive H:, using the Mount Manager. Now I need to notify Explorer somehow so it "sees" the newly created drive letter. In user-space this can be easily done through the DefineDosDevice() function or simply through the Windows messaging API. The quiestion is: how do I do the same in the kernel-space? It seems I can't find the corresponding kernel API function... Any ideas will be highly appreciated. -- Andrey. -- Andrey Subbotin ICQ UIN: 114087545 LiveJournal: http://www.livejournal.com/users/e_ploko/ Tag: hooking COM interfaces and methods Tag: 69605
  - 11
    - Why ExAllocatePool fail ? When I use ExAllocatePool( ) to allocate nonpaged pool, sometime will fail. And I use XPDDK's DriverVerify(on XP) to check the nonpaged pool peak bytes, it's only 64 bytes. Could anyone tell me why ExAllocatePool( ) return NULL and how to avoid it happen ? Thanks. Tag: hooking COM interfaces and methods Tag: 69604
  - 12
    - Why doesn't the drvier call DrvTextOut? Hi, I am tracking msplot sample in the DDK. I found out the DrvTextOut have never been called by the driver.Then I modified the DEVINFO's flGraphicsCaps and GDIINFO's flTextCaps use follow codes: pDevInfo->flGraphicsCaps = GCAPS_ALTERNATEFILL | GCAPS_HORIZSTRIKE | GCAPS_VERTSTRIKE | GCAPS_VECTORFONT | GCAPS_ARBRUSHOPAQUE | GCAPS_ARBRUSHTEXT | GCAPS_BEZIERS | GCAPS_FORCEDITHER | GCAPS_GEOMETRICWIDE | GCAPS_HIGHRESTEXT | GCAPS_GRAY16 | GCAPS_OPAQUERECT | GCAPS_WINDINGFILL; ......... pGDIInfo->flTextCaps = TC_OP_CHARACTER | TC_OP_STROKE | TC_CP_STROKE | TC_CR_90 | TC_CR_ANY | TC_SF_X_YINDEP | TC_SA_DOUBLE | TC_SA_INTEGER |TC_SA_CONTIN | TC_EA_DOUBLE | TC_IA_ABLE | TC_UA_ABLE | TC_SO_ABLE | TC_RA_ABLE | TC_VA_ABLE | TC_SCROLLBLT; Then I tracked it again,Unfortunate,the driver still don't call DrvTextOut.The driver also need to be modified? Where? Welcome to every suggestion. -- Conan Wu Email:aqua_aqua@21cn.com Tag: hooking COM interfaces and methods Tag: 69595
  - 13
    - How application get the indication generated by ndis driver? Hi all, For the purpose of monitor the status in driver by application, it seems uneffiency to poll the status ocassionally. If the driver indicates its status change by NdisMIndicateStatus(), how can the application capture the notification? Thanks! -Liang Tag: hooking COM interfaces and methods Tag: 69594
  - 14
    - Video Class Hi, I am fairly new to Device Drivers and not sure where to start. We have an imaging board connected to a FX2 board that streams vidoe and we can capture images. The CYUSB driver shipped with this board is a USB Generic driver for the board, so we are unable to use it with Direct X to handle the video streaming. From what i can see to ensure that our device to stream video with DirectX, we have to implement the Video Class and an Upper and Lower Filter. I am not sure were to start implementing this Video Class. Is the Video class available for download? Are there any upper and lower filter class available? Many Thanks, Bruce Philp -- Bruce Philp Software Engineer Astron Clinica Ltd Tag: hooking COM interfaces and methods Tag: 69591
  - 15
    - Steps for an application to query a driver's version Hi: I'm new to driver development, just wonder what should be the steps to implement this: On WinXP, a Windows application needs to query the version of a running driver (a network device driver). What are the steps to implement in the drver side (IOCTL?) and what needs to be done in the application side? Just roughly steps should be good enough for me to start. Thanks in Advance ! Polaris Tag: hooking COM interfaces and methods Tag: 69585
  - 16
    - Why Can't I Load a Device Driver? Hi All, I've written a bus enumerator driver and a "USB Stack" simulation driver. My bus enumerator returns the appropriate device IDs in response to IRP_MN_QUERY_ID PnP calls, and the system brings up the wizard (first time) to load my USB stack driver. This works great. However, when my USB stack driver discovers an actual USB device and does an IoInvalidateDeviceRelations, I get the usual PnP queries about the PDOs I've created for the USB devices, and I return a Hardware ID like "USB\Vid_03f0&Pid_1217" and "USB\Vid_03f0&Pid_1217&Rev_0100" (these are for an HP printer), but the system ignores these names. No wizard, no device driver accessed. Nothing. Here's the code for the bus enumerator (which succesfully loads my USB host controller driver emulator): NTSTATUS Bus_FDO_Query_Bus_Relations ( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp, IN PIO_STACK_LOCATION IrpStack, IN PFDO_DEVICE_DATA FdoData ) {/*_begin( Bus_FDO_Query_Bus_Relations )*/ NTSTATUS status; ULONG length; ULONG prevcount; ULONG numPdosPresent; PDEVICE_RELATIONS relations; PDEVICE_RELATIONS oldRelations; PLIST_ENTRY entry; PLIST_ENTRY listHead; PLIST_ENTRY nextEntry; PPDO_DEVICE_DATA pdoData; debugf (( "TBE/Bus_FDO_Query_Bus_Relations: Entry\n" )); // Tell the plug and play system about all the PDOs. // // There might also be device relations below and above this FDO, // so, be sure to propagate the relations from the upper drivers. // // No Completion routine is needed so long as the status is preset // to success. (PDOs complete plug and play irps with the current // IoStatus.Status and IoStatus.Information as the default.) ExAcquireFastMutex (&FdoData->Mutex); oldRelations = (PDEVICE_RELATIONS) Irp->IoStatus.Information; if (oldRelations) { prevcount = oldRelations->Count; if (!FdoData->NumPDOs) { // There is a device relations struct already present and we have // nothing to add to it, so just call IoSkip and IoCall ExReleaseFastMutex (&FdoData->Mutex); return STATUS_SUCCESS; } } else { prevcount = 0; } debugf (( "TBE/Bus_FDO_Query_Bus_Relations: prevcount = %d\n", prevcount )); // Calculate the number of PDOs actually present on the bus numPdosPresent = 0; for ( entry = FdoData->ListOfPDOs.Flink; entry != &FdoData->ListOfPDOs; entry = entry->Flink ) { pdoData = CONTAINING_RECORD (entry, PDO_DEVICE_DATA, Link); if(pdoData->Present) { numPdosPresent++; } #if DBG debugf (( "TBE/Bus_FDO_Query_Bus_Relations:\n" "\tFound PDO for '%ws' in list\n", _ifx( pdoData->HardwareIDs, pdoData->HardwareIDs, L"" ) )); #endif } debugf (( "TBE/Bus_FDO_Query_Bus_Relations: numPdosPresent = %d\n", numPdosPresent )); // Need to allocate a new relations structure and add our // PDOs to it. // // ??? Why was the "-1" in the expression below? length = sizeof(DEVICE_RELATIONS) + ((numPdosPresent + prevcount /* - 1 */) * sizeof (PDEVICE_OBJECT)) ; relations = (PDEVICE_RELATIONS) ExAllocatePoolWithTag ( PagedPool, length, x('TBEE') ); if (NULL == relations) { // Fail the IRP ExReleaseFastMutex (&FdoData->Mutex); Irp->IoStatus.Status = status = STATUS_INSUFFICIENT_RESOURCES; IoCompleteRequest (Irp, IO_NO_INCREMENT); Bus_DecIoCount (FdoData); return status; } // Copy in the device objects so far if (prevcount) { RtlCopyMemory ( relations->Objects, oldRelations->Objects, prevcount * sizeof (PDEVICE_OBJECT) ); } relations->Count = prevcount + numPdosPresent; // For each PDO present on this bus add a pointer to the // device relations buffer, being sure to take out a // reference to that object. The Plug & Play system will // dereference the object when it is done with it and free // the device relations buffer. for ( entry = FdoData->ListOfPDOs.Flink; entry != &FdoData->ListOfPDOs; entry = entry->Flink ) { pdoData = CONTAINING_RECORD (entry, PDO_DEVICE_DATA, Link); if(pdoData->Present) { relations->Objects[prevcount] = pdoData->Self; ObReferenceObject (pdoData->Self); prevcount++; debugf (( "TBE/Bus_FDO_Query_Bus_Relations:\n" "\tDevice Relation PDO for '%ws'\n", _ifx( pdoData->HardwareIDs, pdoData->HardwareIDs, L"" ) )); } else { pdoData->ReportedMissing = TRUE; debugf (( "TBE/Bus_FDO_Query_Bus_Relations:\n" "\tPDO for '%ws' is not present\n", _ifx( pdoData->HardwareIDs, pdoData->HardwareIDs, L"" ) )); } } debugf (( "TBE/Bus_FDO_Query_Bus_Relations:\n" "\t#PDOS present = %d\n" "\t#PDOs reported = %d\n", FdoData->NumPDOs, relations->Count )); // Replace the relations structure in the IRP with the new // one. if (oldRelations) { ExFreePool (oldRelations); } Irp->IoStatus.Information = (ULONG_PTR) relations; ExReleaseFastMutex (&FdoData->Mutex); return STATUS_SUCCESS; }/*_end( Bus_FDO_Query_Bus_Relations )*/ And here is the code in the USB stack driver which, as best I can tell, does exactly the same thing: case IRP_MN_QUERY_DEVICE_RELATIONS: debugf ( ( "TUSB/FDO_PnP: QueryDeviceRelations Type: %s\n", DbgDeviceRelationString ( IrpStack->Parameters.QueryDeviceRelations.Type ) ) ); // We don't support any other Device Relations if ( BusRelations != IrpStack->Parameters.QueryDeviceRelations.Type ) break; // Tell the plug and play system about all the PDOs. // // There might also be device relations below and above this FDO, // so, be sure to propagate the relations from the upper drivers. // // No Completion routine is needed so long as the status is preset // to success. (PDOs complete plug and play irps with the current // IoStatus.Status and IoStatus.Information as the default.) ExAcquireFastMutex (&fdoData->Mutex); oldRelations = (PDEVICE_RELATIONS) Irp->IoStatus.Information; if( oldRelations != NULL ) { prevcount = oldRelations->Count; if (!fdoData->NumPDOs) { // There is a device relations struct already present // and we have nothing to add to it, so just call // IoSkip and IoCall ExReleaseFastMutex (&fdoData->Mutex); break; } } else { prevcount = 0; } // Calculate the number of PDOs actually present on the TROYUSB numPdosPresent = 0; for ( entry = fdoData->ListOfPDOs.Flink; entry != &fdoData->ListOfPDOs; entry = entry->Flink ) { pdoData = CONTAINING_RECORD (entry, PDO_DEVICE_DATA, Link); if(pdoData->Present) { numPdosPresent++; } } // Need to allocate a new relations structure and add our // PDOs to it. // // ??? Why was the "-1" in the expression below? length = sizeof(DEVICE_RELATIONS) + ( (numPdosPresent + prevcount) * sizeof (PDEVICE_OBJECT) ) /* - 1 */; relations = (PDEVICE_RELATIONS) ExAllocatePoolWithTag ( PagedPool, length, x('USB0') ); if (NULL == relations) { // Fail the IRP ExReleaseFastMutex (&fdoData->Mutex); Irp->IoStatus.Status = status = STATUS_INSUFFICIENT_RESOURCES; IoCompleteRequest (Irp, IO_NO_INCREMENT); TROYUSB_DecIoCount (fdoData); return( status ); } // Copy in the device objects so far if( prevcount ) { RtlCopyMemory ( relations->Objects, oldRelations->Objects, prevcount * sizeof (PDEVICE_OBJECT) ); } relations->Count = prevcount + numPdosPresent; // For each PDO present on this TROYUSB add a pointer to the // device relations buffer, being sure to take out a // reference to that object. The Plug & Play system will // dereference the object when it is done with it and free // the device relations buffer. for ( entry = fdoData->ListOfPDOs.Flink; entry != &fdoData->ListOfPDOs; entry = entry->Flink ) { pdoData = CONTAINING_RECORD (entry, PDO_DEVICE_DATA, Link); if(pdoData->Present) { debugf (( "TUSB/FDO_PnP: QueryDeviceRelations, " "Adding PDO 0x%x, data:0x%x\n" " ID:'%ws'\n", pdoData->Self, pdoData, pdoData->HardwareIDs )); relations->Objects[prevcount] = pdoData->Self; ObReferenceObject (pdoData->Self); prevcount++; } else { pdoData->ReportedMissing = TRUE; } } debugf ( ( "TUSB/FDO_PnP: #PDOS present = %d #PDOs reported = %d\n", fdoData->NumPDOs, relations->Count ) ); // Replace the relations structure in the IRP with the new // one. if( oldRelations != NULL ) { ExFreePool (oldRelations); } Irp->IoStatus.Information = (ULONG_PTR) relations; ExReleaseFastMutex (&fdoData->Mutex); // Set up and pass the IRP further down the stack Irp->IoStatus.Status = STATUS_SUCCESS; break; // In the default case we merely call the next driver. // We must not modify Irp->IoStatus.Status or complete the IRP. } IoSkipCurrentIrpStackLocation (Irp); status = IoCallDriver (fdoData->NextLowerDriver, Irp); TROYUSB_DecIoCount (fdoData); debugf(( "TUSB/FDO_PnP: Exit, status=%x\n", status )); return( status ); }/*_end( TROYUSB_FDO_PnP )*/ Any suggestions? Thanks, Randy Hyde Tag: hooking COM interfaces and methods Tag: 69569
  - 17
    - Hardware Serial number from usb flash drive. I am unable to get the serial number on usb flash drives. It always returns 0 indicating it is not there. I am using DeviceIoControl with IOCTL_GET_DEVICE_DESCRIPTOR to get the venderID, productID, and ProductRevision, but the SerialNumber is always 0. Has anyone run into a similar problem? Tag: hooking COM interfaces and methods Tag: 69567
  - 18
    - Ndis Intermediate over WAN on XP SP2 I'm struggling with a problem that seems to have become apparent in XP SP2. Under SP1 everything worked fine. I have an Ndis Intermediate driver based on Passthru. The driver polices TCPIP traffic by pending some outgoing connections while sanction for their release is obtained. With LANs this works fine, as it did on WANs pre-SP2. I now see that when I pend an outgoing packet in MpSendPackets, no further packets are sent to the IM driver. This is a severe problem because the sanction process may involve obtaining a Go/NoGo decision by means of TCP communication with another system. On a WAN-only machine, I can't get the request out. All ideas welcome. -- Stan Bell Device Drivers & Communications www.systemsoft.co.uk Tag: hooking COM interfaces and methods Tag: 69565
  - 19
    - Ndis Miniport Driver with WPP Hi, I am trying to get WPP Trace functionality added to a NDIS miniport driver written for Windows 2000 in C++? Does any one have any samples? Since my code was not compiliing I tried putting the WPP macros in a .C file. Then I called these function from the C++ code. The code compiles but I don't see any messages. I know I have the traceview configured properly. In addition, when I try to check if WPP is activated using WPP_LEVEL_ENABLED macro, it returns false. Any ideas? I call WPP_SYSCONTROL first in driver entry then WPP_INIT_TRACE in my initialize function. I use the PDEVICE_OBJECT returned from NdisMRegisterDevice function. Shreyash Tag: hooking COM interfaces and methods Tag: 69564
  - 20
    - Reading the Configuration Space of ICH4 in a WDM Driver Hi, I have n newbie question. I want to write a WDM device driver witch reads the configuration space of the ICH4 Southbridge from Intel. Iâ??ve tried these Code samples from Microsoft: First with IRP_MN_QUERY_INTERFACE http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q253232 and then with IRP_MN_READ_CONFIG http://msdn.microsoft.com/library/default.asp?url=/library/en-us/kmarch/hh/kmarch/IputOput_1526c9e1-7391-4746-818b-8d4f384bd572.xml.asp None of these worked. In both samples the IoCallDriver() Function failed. Iâ??ve written the vendor and device ID in the INF File: [Manufacturer] %MfgName% = Device [Device] %FeatureDevice%=Feature_DDI, PCI\VEN_8086&DEV_24C0&SUBSYS_00000000&REV_02 I canâ??t see the error Iâ??ve made. Could some of you give me some hints? Tag: hooking COM interfaces and methods Tag: 69563
  - 21
    - Function Driver was not specified for this device instance Hi , I written a win2k plug n play driver for PCMCIA 16 bit PC card.I written the code up to the device detection. While installing the drivers I given the path of our device inf file and it has asked the path of driver file (.sys file). I given the path of driver file also.After completion of installation the following message deplays. //////////////////////////////////// "The installation failed because a function driver was not specified for this device instance" /////////////////////////////////// What could be the reason. Please guide me bye, Mahi Tag: hooking COM interfaces and methods Tag: 69561
  - 22
    - OEMUI and OEMUNI Hi Vipin Sir, I developed a Rendering plugin and it works properly as expected. But now I'm developing the UI Plugin, and from that I want to change the image size, i.e. if I give say height = 1 in and width = 1 in, then I should get the image size i.e. 1 x 1. Right now, I'm providing 3 x 3 paper size, and I'm getting the image size as 3 x 3 only. Also I've defined a customsize option in paper size. i.e. I want to develop a UI plugin so that the rendering plugin will draw a Image of that size only and not more than that. How to do so, plese tell me. Actually I'm having the plugin i.e. UI plugin, which does the same thing what I wanted but I don't have source code for that. so can you please guide me, i.e. please tell me in which function I shoul make these changes? Thanks Adi -- adibhapse ------------------------------------------------------------------------ Posted via http://www.codecomments.com ------------------------------------------------------------------------ Tag: hooking COM interfaces and methods Tag: 69560
  - 23
    - PCL5e and PCL6 Hello, anybodies knows what is the difference between PCL5 and PCL6? Thanks Keshav Tag: hooking COM interfaces and methods Tag: 69550
  - 24
    - newbie linking IoXxx routines problem While writing a small test driver (mainly for experience purposes) from scratch, the following problem arised: linker cannot find IoCreateSymbolicLink within ntoskrnl.lib. I am using MSVC .net and w2k DDK, running on a wxp pro machine and was unable to generate an executable with 'build' and dirs/sources/makefile files, so I created a makefile project with Visual Studio and wrote a very simple makefile and invoked it with "BuildCommand Line: NMake test.mak" in project properties: -- test.mak LINK_OPTS = /driver:WDM /out:test.sys /entry:testmain LINK_LIBS = hal.lib ntoskrnl.lib ntdll.lib wdm.lib .obj.sys: link $(LINK_OPTS) $(LINK_LIBS) $*.obj test.sys : test.obj test.obj : test.cpp -- END testdrv.mak Everything was compiling and linking fine until I tried to use one of the IoXxx functions in test.cpp. The linker refuses to find the functions in any .lib provided with w2k DDK (as far as I can tell, IoCreateSymbolicLink is both in wdm.lib and ntoskrnl.lib). The following 'link test' code compiles fine and linker gives the following error: test.obj : error LNK2019: unresolved external symbol __imp__IoWriteErrorLogEntry referenced in function _testmain while it compiles and links perfectly if the call to IoWriteErrorLogEntry is removed from the code. --test.cpp #define _X86_ extern "C" { #include <ntddk.h> } extern "C" NTSTATUS DriverMain (PDRIVER_OBJECT DrvObj, PUNICODE_STRING RegPath) { KeInitializeSpinLock (NULL); RtlCopyUnicodeString (NULL, NULL); IoCreateSymbolicLink (NULL, NULL); return STATUS_SUCCESS; } -- END test.cpp The linker (and compiler) used are the one shipped with Visual Studio, but the problem remains exactly the same if using compiler and linker of w2k DDK. I have tried everything I could think trying to solve the problem, but now I am stuck. Any hint on how to solve it? Thanks in advance Tag: hooking COM interfaces and methods Tag: 69539
  - 25
    - Link error using KsDispatchSpecificProperty How can I use the KsDispatchSpecificProperty: when I use this function, I got link error: mydriver.obj : error LNK2019: unresolved external symbol __imp__KsDispatchSpecificProperty@8 referenced in function _MyIoCtrlCompleteRoutine@12 I have add the ks.lib in the source file: TARGETLIB=$(BASEDIR)\lib\*\$(DDKBUILDENV)\KS.lib Tag: hooking COM interfaces and methods Tag: 69537
- Next
  - 1
    - (mike han)(When removal a usb device from pc, what does the windows send to usbdevice? Dear Sir: I have a problem, I developed a usb disk, but I don't know when user safely remove the usb disk from PC, What command the windows will send to the usb device? I study the common UFI command, But I don't find a command related with it, Please help me, thank you very much. Best Regards Mike Han Tag: hooking COM interfaces and methods Tag: 69525
  - 2
    - Who is watching the store! After loading my MSI file on a bunch of computers, my systems and drivers were all working just fine except for one computer - drat. I hooked up windbg to that computer and discovered that it was doing some strange stuff, and when I thought I had identified a possilbe problem I blew away the driver and replaced it only to discover that I'd made an error in this analysis. So 1st I loaded in a copy of the original driver by hand and things came alive! Then I reloaded from my msi file and things were still alive! Conclusion: during the installation of the msi file, there was some corruption of my file. HERE IS WHERE IT GET's INTERESTING: Experiment: Take an driver from c:\windows\system32\drivers and randomly edit the file with a binary editor and do not update any checksums along the way!. Then try to load it. In my case, I edited some text strings in the file, and I did not change the file length. It loads just fine. Did I hallucinate this? I thought a checksum would be calculated over the entire file. Surely the system would be sensitive to corruption from bad drivers as such. What about Security implications? -- Gak - Finecats Tag: hooking COM interfaces and methods Tag: 69515
  - 3
    - RtlRetrieveUshort - bug? Here's a good interview question... Find a bug in RtlRetrieveUshort/Ulong macros in ntddk.h (DDK 3790.1830 / wnet) For x86 RtlRetrieveUshort, RtlRetrieveUlong are defined as: #define RtlRetrieveUshort(DEST_ADDRESS,SRC_ADDRESS) \ if ((ULONG_PTR)SRC_ADDRESS & SHORT_MASK) { \ ((PUCHAR) DEST_ADDRESS)[0] = ((PUCHAR) SRC_ADDRESS)[0]; \ ((PUCHAR) DEST_ADDRESS)[1] = ((PUCHAR) SRC_ADDRESS)[1]; \ } \ else { \ *((PUSHORT) DEST_ADDRESS) = *((PUSHORT) SRC_ADDRESS); \ } \ Answer: SRC_ADDRESS must be enclosed in braces, or evil will happen. How to repro: #include <ntddk.h> void foo( void ) { UCHAR x[] = { 1,2,3,4,5,6,7,8,9,0 }; PUCHAR p = &x[1]; USHORT y; RtlRetrieveUshort( &y, p + 6 ); // fails RtlRetrieveUshort( &y, p + 1 ); // works } Same with RtlRetrieveUlong. Regards, --PA Tag: hooking COM interfaces and methods Tag: 69505
  - 4
    - Drive letter not visible in Explorer Hello all, I'm trying to write a pseudo-disk driver for Windows XP. All went fine until I tried to mount it. Here's the problem: No metter which way I try to assign the drive letter for my disk -- either through creating a symbolic link or by notifying the Mount Manager with the IOCTL_MOUNTMGR_VOLUME_ARRIVAL_NOTIFICATION -- the letter isn't shown in the Explorer's file tree. The link is there -- it can be seen with WinObj or any similar tool, but Explorer keeps ignoring it. Can somebody please give me or point to any ideas, hints or guidelines on how to properly add a _pseudo_ disk drive into the system? Tag: hooking COM interfaces and methods Tag: 69503
  - 5
    - Error: Digital signature did not verify I have developed an NDIS IM driver. I sign it using Authenticode tools (signtool) with a Verisign code signing ID. It has installed correctly under 2003 Server and x64 Editions (XP and Server). I recently made some changes to the driver. I used the same exact .inf's and procedure to sign the .cat file, yet when I attempt to install on an x64 Server machine I get "The digital signature of the object did not verify". The code returned from HrInstallNetComponent is 0x80096010. If I simply replace the new driver (.sys) file with the previous .sys file it installs correctly. It appears that during the installation process the digital verification of the .cat file works incorrectly for the new .sys file. Note that if I use "signtool verify /pa /v driver.sys" the signature is correct. I suspect that Authenticode is signing the driver correctly, however the driver installation is incorrectly verifying the driver. Has anyone seen this or have any ideas? Thanks. Dan Tag: hooking COM interfaces and methods Tag: 69502
  - 6
    - Is it possible to write a user-mode NDIS miniport driver Tag: hooking COM interfaces and methods Tag: 69499
  - 7
    - Making IOCTL calls between 2 avstream drivers. I want to make an IOCTL call between 2 avstream drivers that support property sets. I am using IoGetDeviceInterfaces to get the interfaces and then I do a IoGetDeviceObjectPointer to get the device object. Following that when I need to make the IOCTL, I use IoBuildDeviceIoControlRequest to set the IRP and then I am trying to use IoCallDriver but it returns back with an error. Here is how I am setting the StackLocation... What I need to send is 1>KSPROPERTY and 2>ULONG(which contains data) pIrp = IoBuildDeviceIoControlRequest( ulIoctl, pFilter->pDevObject, pData, ulpData, pcbData, ulcbData, TRUE, NULL, &IoStatusBlock); //ulpdata points to a KSPROPERTY structure...pcbdata is size of //KSPROPERTY... pcbdata points to a ULONG, ulcbdata is SIZE of ULONG. if (pIrp != NULL) { PIO_STACK_LOCATION pNextStackLocation; pNextStackLocation = IoGetNextIrpStackLocation(pIrp); if (pNextStackLocation) { pNextStackLocation->FileObject = pFilter->pFiObject; pNextStackLocation->MajorFunction = IRP_MJ_DEVICE_CONTROL; pNextStackLocation->Parameters.DeviceIoControl.IoControlCode = IOCTL_KS_PROPERTY; IoStatusBlock.Status = STATUS_SUCCESS; ntStatus = IoCallDriver( pFilter->pDevObject, pIrp); Is there anything wrong in what I am doing ? Do I need to set additional parameters in PIO_STACK_LOCATION ? as to what data needs to go through ( like size of KSPROPERTY or ULONG) ? Thanks. Tag: hooking COM interfaces and methods Tag: 69498
  - 8
    - PDO FireObject of Firefly example Hi, Greetings. In the firefly example, the Fileobject handle of PDO was acquired using ZwOpenFile() and ObReferenceObjectByHandle() for each Set Feature, and was released immediately after every Set Feature. But if I save the Fileobject handle in my device extension during the first Set Feature and use it for all subsequent Set Feature calls, after which Dereference it during my Remove Device, the mouse seems not to respond to any physical movement. The Service_CallBack() routine in Firefly is never triggered. Anyone can enlighten me is it compulsory that the FileObject handle must be released immediately after every set feature, and the reason behind it if it is true? Thanks in advance. Regards, Angela Tag: hooking COM interfaces and methods Tag: 69439
  - 9
    - SCSI Processor Device Driver We have a legacy driver for NT to communicate with a piece of custom hardware. This hardware doesn't seem to fall into any of Microsoft's existing classes (at least I don't think so, but you've probably heard that line before). It attaches via a SCSI-2 interface, and meets the minimum requirements under SCSI-2 as a 'Processor' device. It allows the computer to interface with a large amount of individual I/O points used in a full-scope control room simulator (app. 1500 analog outputs, 7500 digital outputs, 4500 digital inputs, and 300 analog inputs, all scanned at 20 Hz). Our legacy driver, (originally written for NT 3.51) has served us pretty well through the various OS upgrades. I developed a new '.inf' file a few years back to provide client-side installation on Windows 2000. The same .inf and .sys files work under Windows XP (pro & home). But they do *not* seem to work on Windows 2003 Standard edition. Why not?? The OS complains about error starting the driver yet it works under XP and 2000. Anyway, I'm trying to write a new driver using the latest DDK and WDM models (I wrote the original as well). Or should I wait for WDF? But I can't find nearly the amount of information on SCSI device drivers that I had back in the NT days. Most new things are USB & 1394 it seems. I do have the SCSI specs down pat and work quite closely with the device firmware programmer, so I have that going for me (as well as a SCSI bus analyzer etc...) But searching for a good text on the subject of SCSI drivers under WDM hasn't been successful (have "Programming the Microsoft WIndows Driver Model" and "The Windows 2000 Device Driver Book", but they barely acknowledge that SCSI exists). I've started by using a storage/class sample from the DDK. But since 'SCSI Processor' devices support a lot fewer features than either CDROM, disk drives, or tape, there's a lot of code that needs to be thrown away. And cutting out code without breaking things is a bit tricky. Anyone have a better starting point for a simple SCSI device that still fits the WDM model? Also, since this device is external, and has it's own power, can I just reply success to all the power management requests (the device doesn't have any sort of power-down mode)? Sorry for the long ramble, but this is a small outfit and I feel lost in the wilderness a bit. I get to do the low-level drivers because I'm the one that works with the hardware folks and understand bit-bashing. Mike Fochtman Tag: hooking COM interfaces and methods Tag: 69428
  - 10
    - Network bindings -> MoveBefore - error Hello, I look for a way to change the network binding programmaticaly- my problem seems to be the same, as jim2005's in the thread: "How to programmatically set binding order of NDIS miniport adapter on install?". So, I took a look at BindView example in WinDDK and what I do is: I acquire a write lock using INetCfgLock->AcquireWriteLock I enumarate all the components INetCfgClass->EnumComponents, and I search for the component I want to put on the top of the list. Then I enumarate all the binding paths for the component using: INetCfgComponentBindings->EnumBindingPaths For each of the binding path I try to call INetCfgComponentBindings->MoveBefore with the second argument = NULL. However, it gives me an error: -2147180508 And this is where I stuck :-( As I'm not very experienced with C++ programming (I come from the .NET world) I have no clue where I should go next. Can anyone give me any suggestion what may be the cause for the error? Has anyone ever manage to make a good use of MoveBefore (or MoveAfter) and would share a snippet of code? I'll be very grateful - thanks in advance. Marcin Pytel -- Tag: hooking COM interfaces and methods Tag: 69425
  - 11
    - Bidirectional communication to USB printer Hi there, I'm trying to receive status information of an Epson printer (connected by USB) on Windows XP, which is not supplied by some Windows APIs. According to the Epson programming guide it is possible to query the information via ESC sequences. Sending these ESC sequences seem to work by using the "WritePrinter" function. Unfortunately the corresponding "ReadPrinter" function does not return any useful data. Neither the "ExtEscape" function with the PASSTHROUGH option nor the COM object "IBidiRequest" worked. Any suggestions how to establish a bidirectional connection to the printer using Windows XP to send ESC sequences and receive the responses from the printer? Something like ReadFile() and WriteFile() would be fine, but I don't know how to get a handle fot them. Thanks for help. Markus Tag: hooking COM interfaces and methods Tag: 69422
  - 12
    - Porting Win9x driver to right-to-left Windows problem I have been writing monolithic printer driver for Windows9x for our specific fax device. The driver should support right-to-left (RTL) languages. The driver is was properly debugged and tested under left-to-right (LTR) Windows, but there are some problems when itâ??s running under Windows 9x RTL. Problem 1: When driver is installed using itâ??s inf-file, the warning message appears: â??The printer driver you are using doesnâ??t print in your local language. By installing this printer driver you may cause Windows to fail. Contact the printer manufacturer for the proper printer driver.â?? Problem 2 If some document, containing both LTR and RTL strings is printed, the LTR text only appears in the printer output. The printer driver simply redirects all the calls to DIBENG.DLL and when each page is completed, it stories the image of the page to file. Using UNIDRV is not possible. What should be done for the printer driver to support RTL? Thank you for your help, Alexey. Tag: hooking COM interfaces and methods Tag: 69421
  - 13
    - Compiler version not supported by Windows DDK Hi When i compile my program, using the ndis.h and ntddk.h on VC6, i get the error message "Compiler version not supported by Windows DDK". I'm not writing a driver, but a program that use a driver (therfore, i think, compiling with the build program of the DDK is not the right solution). Is there another solution to that situation? Thanks, D Tag: hooking COM interfaces and methods Tag: 69418
  - 14
    - StartDocPort and DOC_INFO_1 Hi I'm writing a port monitor. It's a kind of a redirector port and I have to tell him where to redirect the data to. This is done using a GUID. So I have to give him a GUID. I thought about doing this in the pOutputFile of the DOC_INFO_1/2 struct. Since this is a "caller supplied pointer", it should work. But the MSDN also says: pOutputFile: ... To print to a printer, set this to NULL. ... now, I want to print to a "printer", but I still don't want to set this to NULL... does someone know if this is OK, or should I try to find an other solution? Does Windows redirect the job to somewhere else, if I don't pass NULL in this parameter? thanks MR Tag: hooking COM interfaces and methods Tag: 69417
  - 15
    - NdisMIndicateReceivePacket from ProtocolReceive problem I'm extending the passthru example to create an IM-driver that redirects sent/received packets. Everything works well when using NDIS 5.1 and the ProtocolReceivePacket but I run into problems using NDIS 4.0 and ProtocolReceive. In the ProtocolReceive I get the original packet with NdisGetReceivedPacket which works (for now I ignore drivers that don't support this call but will later on take care of the LookAheadBuffer etc). Once I get the packet I do the same thing as when using ProtocolReceivePacket - allocate a packet, allocate a buffer, copy data between packets with NdisCopyFromPacketToPacket (NdisCopyFromPacketToPacketSafe when doing NDIS 5.1), change the destinationport and update the checksum, NDIS_SET_ORIGINAL_PACKET, NDIS_SET_PACKET_HEADER_SIZE, set flags, set status and then indicate the packet up with NdisMIndicateReceivePacket. The problem is that the packet never gets to the upper layer when ProtocolReceive is used, but everything is working great when ProtocolReceivePacket is used. I've read something about that you need to supply a buffer that is atleast the lookahead length but I guess this doesn't apply when using NdisMIndicateReceivePacket with a complete NDIS_PACKET where the NDIS_BUFFER holds the entire packet? Any suggestions of why I get this behaviour? Do you think it would work better if I used the NdisMEthIndicateReceive instead of the NdisMIndicateReceivePacket? It would be nice to be able to use the same code for both PtReceive and PtReceivePacket - that is using the NdisMIndicateReceivePacket. I would really appreciate your help. Magnus Hedbeck (my email is not valid, reply in newsgroup) Tag: hooking COM interfaces and methods Tag: 69416
  - 16
    - Configuring Win2K USB Mass Storage Driver for "Quick Removal" Hello Experts, I have created a USB Mass Storage device with a PDIUSBD12 target controller. I have successfully written the target side driver and am able to do all kinds of disk operation on it. I now have a requirement of selectively preventing disk operations as below: a) Prevent users from creating any directories on the disk b) Prevent users from formatting the disk c) Prevent users from storing any file on the disk whose name is NOT "MyFile.bin" I have been able to do all the above successfully in Windows XP because when ever the user performs a disk operation, XP first writes data to the "root directory" sectors and then to the rest of them. So, whenever I get a request for any disk operation that needs to write to the "root directory" sectors, I first do a validation on the root directory related data and if it does not meet the above constraints, I stall the operation and return a "Write Protect" status in the the following request sense command. All this works perfectly well in XP. However in Windows 2000, the sequence of disk operation is different. The root directory is NOT written to first. Due to this reason, I am not able to do such a validation on the same. This difference in behaviour in Win 2K is because the mass storage driver is configured for "Better performance" than "Quick Removal". In Win 2K there is no option to change this seeting (unlike Win XP). Is there a registry tweak to change this setting? Thanks. Tag: hooking COM interfaces and methods Tag: 69415
  - 17
    - USB Imaging Device Driver Hi, We are using an OmniVision imaging board, that uses the 3620 chip, which is bridged by a Cypress board. I am fairly new to device drivers and not sure what i need to do to implement a device driver that will treat this board as an imaging board. I need to be able to use DirectX to stream video and capture images off the USB device, which the supplied Cpress device drivers do not support. From what i understand at the moment, the driver is made of a collection of system drivers and a custom driver. The firware for the USB device does not fully implement the Imaging specification, so i suspect that the cutom device driver will mimic that the board is an imaging device. I have implemented the inf file, which includes and uses the DirectX support: [CyUsb.NT] Include=ks.inf, kscaptur.inf, ksfilter.inf Needs=KS.Registration,KSCAPTUR.Registration.NT Any help would be most appreciated. Many Thanks, -- Bruce Philp Software Engineer Astron Clinica Ltd Tag: hooking COM interfaces and methods Tag: 69413
  - 18
    - A sniffer, fast and dirty... I need to count certain packets sent thru a netcard during usual network activity (internet, mail...). The counting can be done in kernel mode, no need to pass data to usermode. The card can be any usual 10/100 ethernet, connected either to LAN or DSL modem (PPPoE). What of the following is less intrusive to the system and easier to do? a. IM filter based on Passthru b. Protocol driver & set the packet filter to ALL_LOCAL Ah and this will be just a fast and dirty internal tool - not for production :) Thanks for any advice, --PA Tag: hooking COM interfaces and methods Tag: 69406
  - 19
    - ISO Busters I have been trying to convert an ISO file downloaded from microsoft (VS2005 Beta 2 Provessional version) using ISOBuster. But everytime I click on a file to extract it comes up with "Could not open file, file might be protected or in use". I definitely do not have it used anywhere else, so I'm not sure why it thinks it's protected. Has anyone else had this issue and found the cure? Thanks, Sarah Tag: hooking COM interfaces and methods Tag: 69404
  - 20
    - Bug Check In NDIS Intermediate driver. DRIVER_CORRUPTED_EXPOOL (c5) and BAD_POOL_CALLER (c2) All, Thanks a lot in advance, if someone can help me out with these bugs it would be great help. I am having really hard time tracing these two bug checks in my NDIS intermediate driver. As they are random bug checks, they happen once a while so i am not sure what is the problem. Both the bug check are coming at the same location. When i try to free the memory in my driver. Attached is the memory dump of both the bug checks. Bad_POOL_CALLER comes when my NDISReturnPacket handler is called by NDIS. When i receive back the the packet then i try to free the VM, which i have allocated while indicating the NDIS packet upward. Driver_CORRUPT_EXPOOL is coming when my NDISSendComplete is called and i am trying to free the VM which i have allocated while sending the NDIS packet. In the memory dump it shows i tried to free location 00000001. I am not sure if is memory 0000001 if valid memory, which i am suppose to free. Here is the code which i am using to free (FltCleanPacket) my packet memory and below that is the code for creating the new packet (FltCopyPacketBuffers). I am using the same code at both the locations. When i reviewd my code, then i found out i must use NdisBufferVirtualAddressSafe, instead of NdisBufferVirtualAddress functions. I am not sure if this is the problem or its something else. Thanks a lot in advance. VOID FltCleanPacket(IN PNDIS_PACKET Packet){ PNDIS_BUFFER pNDISBuffer = NULL; PUCHAR pPacketBuff = NULL; //Here we have to free all the buffer and memory.. // Packet this is my packet i have to work on Packet NdisUnchainBufferAtBack(Packet,&pNDISBuffer); ////Get the VM from the Buffer// pPacketBuff = NdisBufferVirtualAddress(pNDISBuffer); //// Call free on this VM// NdisFreeMemory(pPacketBuff,0,0); //// Free the Buffer// NdisFreeBuffer(pNDISBuffer); return;} VOID FltCopyPacketBuffers(IN PADAPT pAdapt,IN PNDIS_PACKET Packet,IN PNDIS_PACKET MyPacket) { PNDIS_BUFFER CurrentBuffer; UINT nBufferCount, TotalPacketLength; UINT BytesCopied = 0; PUCHAR pPacketBuff = NULL; NDIS_STATUS Status = 0; PNDIS_BUFFER NewBuffer; if( !Packet || !MyPacket ) return; NdisQueryPacket( (PNDIS_PACKET )Packet, (PUINT )NULL, // Physical Buffer Count (PUINT )&nBufferCount, // Buffer Count &CurrentBuffer, // First Buffer &TotalPacketLength // TotalPacketLength ); __try{ do{ ////We have the Total Packet length, we should allocate the Tagged Memory// Status = NdisAllocateMemoryWithTag(&pPacketBuff,TotalPacketLength,'piSN'); if(Status != NDIS_STATUS_SUCCESS) {break;} ////Here we shuld allocate the Buffer and chain it to the packet// NdisAllocateBuffer(&Status,&NewBuffer,pAdapt->BufferPoolHandle,pPacketBuff,TotalPacketLength ); if(Status != NDIS_STATUS_SUCCESS) __leave; // Leave __try and eventually return... ////Chain that buffer in the packet// NdisChainBufferAtFront(MyPacket,NewBuffer); }while(FALSE); ////We should use the Ndis Copy to copy the whole packet..// NdisCopyFromPacketToPacketSafe(MyPacket,0,TotalPacketLength,Packet,0,&BytesCopied,NormalPagePriority); }//__try __finally { }//__finally } begin 666 BAD_POOL_CALLER.txt M,3H@:V0^("%A;F%L>7IE("UV#0HJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ M*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ M*BHJ*BHJ*BHJ#0HJ(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @ M(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" J M#0HJ(" @(" @(" @(" @(" @(" @(" @(" @0G5G8VAE8VL@06YA;'ES:7,@ M(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" J#0HJ(" @(" @ M(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @ M(" @(" @(" @(" @(" @(" @(" @(" @(" J#0HJ*BHJ*BHJ*BHJ*BHJ*BHJ M*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ M*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ#0H-"D)!1%]03T],7T-!3$Q%4B H8S(I#0I4 M:&4@8W5R<F5N="!T:')E860@:7,@;6%K:6YG(&$@8F%D('!O;VP@<F5Q=65S M="X@(%1Y<&EC86QL>2!T:&ES(&ES(&%T(&$@8F%D($E244P@;&5V96P@;W(@ M9&]U8FQE(&9R965I;F<@=&AE('-A;64@86QL;V-A=&EO;BP@971C+@T*07)G M=6UE;G1S.@T*07)G,3H@,# P,# P,#<L($%T=&5M<'0@=&\@9G)E92!P;V]L M('=H:6-H('=A<R!A;')E861Y(&9R965D#0I!<F<R.B P,# P,3$U,RP@*')E M<V5R=F5D*0T*07)G,SH@,# P,# P,# L($UE;6]R>2!C;VYT96YT<R!O9B!T M:&4@<&]O;"!B;&]C:PT*07)G-#H@.#DX.6(P,&$L($%D9')E<W,@;V8@=&AE M(&)L;V-K(&]F('!O;VP@8F5I;F<@9&5A;&QO8V%T960-"@T*1&5B=6=G:6YG M($1E=&%I;',Z#0HM+2TM+2TM+2TM+2TM+2TM+2T-"@T*#0I"54=#2$5#2U]3 M5%(Z(" P>&,R7S<-"@T*1$5&055,5%]"54-+151?240Z("!$4DE615)?1D%5 M3%0-"@T*0U524D5.5%])4E%,.B @,@T*#0I,05-47T-/3E123TQ?5%)!3E-& M15(Z("!F<F]M(#@P-38X860P('1O(#@P-30S86,Y#0H-"E-404-+7U1%6%0Z M(" -"F(Y-#4U.6(T(#@P-38X860P(# P,# P,&,R(# P,# P,# W(# P,# Q M,34S(&YT(4ME0G5G0VAE8VM%>"LP>#$Y#0IB.30U-6$Q-"!F-S(T-F4X." X M.3@Y8C P82 P,# P,# P,"!B.30U-6$T,"!N="%%>$9R9650;V]L5VET:%1A M9RLP>#4Q- T*8CDT-35A,C0@9C<U-V-B.60@.#DX.6(P,&$@,# P,# P,# @ M,# P,# P,# @3D1)4R%.9&ES1G)E94UE;6]R>2LP>#,Y#0I705).24Y'.B!3 M=&%C:R!U;G=I;F0@:6YF;W)M871I;VX@;F]T(&%V86EL86)L92X@1F]L;&]W M:6YG(&9R86UE<R!M87D@8F4@=W)O;F<N#0IB.30U-6$T,"!F-S4W.&4Q-" X M.3<R9F8Q," X.3<S9#4V," X.3<R9F8S,"!.4TE01DQ4*S!X-6(Y9 T*8CDT M-35A-3@@9C<R-C R8C$@.#DW,S-B,C @.#DW,F9F,3 @8CDT-35C.3@@3E-) M4$9,5"LP>#%E,30-"F(Y-#4U83<T(# P-#4U8C$X(# P,# P,# P(# P,# P M,# P(&)A8C$Q-C%F($Y$25,A3F1I<U)E='5R;E!A8VME=',K,'AD80T*8CDT M-35A.3@@8F%B,3$X-CD@.#AE,V,S,3@@.#DU-C$P,C @,# P,# P,# @=V-M M*S!X-35B,3@-"C@Y.61B860P(#@Y.61A,3,P(#@Y.61D.#0X(#@Y-S,S8C(P M(# P-64P,#5C(&%F9"%!9F1&87-T0V]N;F5C=&EO;E)E8V5I=F4K,'@R9# - M"F(Y-#4U8S4X(#@P-3@U9F0T(#@X93(Y-C X(# P,# P,# Q(# Y8V)B.#(P M(#!X.#DY9&$Q,S -"F(Y-#4U9# P(#@P-3@V,3(X(# P,# P-68P(# P,# P M-65C(# P,# P,# P(&YT(4EO<%AX>$-O;G1R;VQ&:6QE*S!X,C4U#0IB.30U M-60S-" X,#1D9F0R-" P,# P,#5F," P,# P,#5E8R P,# P,# P,"!N="%. M=$1E=FEC94EO0V]N=')O;$9I;&4K,'@R. T*8CDT-35D,S0@-V9F93 S,#0@ M,# P,# U9C @,# P,# U96,@,# P,# P,# @;G0A2VE3>7-T96U397)V:6-E M*S!X9# -"C Y8V)B-V4P(#<W9C0R-F-B(#<Q8C(Q.#$W(# P,# P-68P(# P M,# P-65C(%-H87)E9%5S97)$871A(5-Y<W1E;4-A;&Q3='5B*S!X- T*,#EC M8F(W930@-S%B,C$X,3<@,# P,# U9C @,# P,# U96,@,# P,# P,# @;G1D M;&PA3G1$979I8V5);T-O;G1R;VQ&:6QE*S!X8PT*,#EC8F(X-S0@-S%C,&9D M9C$@,# P,# U9C @,#EC8F(X86,@,# P,# P,#$@;7-W<V]C:R%74U!296-V M*S!X,6%F#0HP.6-B8CAB8R P,#8U.60R-2 P,# P,#5F," P.6-B8CDP," P M,# P,# S,"!74S)?,S(A<F5C=BLP>#@Q#0HP,# P,# P," P,# P,# P," P M,# P,# P," P,# P,# P," P,# P,# P,"!W8VTK,'@R-3ED,C4-"@T*#0I& M3TQ,3U=54%])4#H@#0I.4TE01DQ4*S5B.60-"F8W-3=C8CED(#AB-&1F8R @ M(" @(" @(" @;6]V(" @("!E8W@L6V5B<"TP>#1=#0H-"E-934)/3%]35$%# M2U])3D1%6#H@(#,-"@T*1D],3$]755!?3D%-13H@($UA8VAI;F5/=VYE<@T* M#0I364U"3TQ?3D%-13H@($Y325!&3%0K-6(Y9 T*#0I-3T153$5?3D%-13H@ M($Y325!&3%0-"@T*24U!1T5?3D%-13H@($Y325!&3%0N<WES#0H-"D1%0E5' M7T9,4E])34%'15]424U%4U1!35 Z(" T,S!A-V8V. T*#0I35$%#2U]#3TU- M04Y$.B @:V(-"@T*0E5#2T547TE$.B @,'AC,E\W7TY325!&3%0K-6(Y9 T* E#0I&;VQL;W=U<#H@36%C:&EN94]W;F5R#0HM+2TM+2TM+2T-"@`` ` end begin 666 DRIVER_CORRUPTED_EXPOOL.txt M,CH@:V0^("%A;F%L>7IE("UV#0HJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ M*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ M*BHJ*BHJ*BHJ#0HJ(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @ M(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" J M#0HJ(" @(" @(" @(" @(" @(" @(" @(" @0G5G8VAE8VL@06YA;'ES:7,@ M(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" J#0HJ(" @(" @ M(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @(" @ M(" @(" @(" @(" @(" @(" @(" @(" @(" J#0HJ*BHJ*BHJ*BHJ*BHJ*BHJ M*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ M*BHJ*BHJ*BHJ*BHJ*BHJ*BHJ#0H-"D12259%4E]#3U)255!4141?15A03T], M("AC-2D-"D%N(&%T=&5M<'0@=V%S(&UA9&4@=&\@86-C97-S(&$@<&%G96%B M;&4@*&]R(&-O;7!L971E;'D@:6YV86QI9"D@861D<F5S<R!A="!A;@T*:6YT M97)R=7!T(')E<75E<W0@;&5V96P@*$E244PI('1H870@:7,@=&]O(&AI9V@N M("!4:&ES(&ES#0IC875S960@8GD@9')I=F5R<R!T:&%T(&AA=F4@8V]R<G5P M=&5D('1H92!S>7-T96T@<&]O;"X@(%)U;B!T:&4@9')I=F5R#0IV97)I9FEE M<B!A9V%I;G-T(&%N>2!N97<@*&]R('-U<W!E8W0I(&1R:79E<G,L(&%N9"!I M9B!T:&%T(&1O97-N)W0@='5R;B!U< T*=&AE(&-U;'!R:70L('1H96X@=7-E M(&=F;&%G<R!T;R!E;F%B;&4@<W!E8VEA;"!P;V]L+@T*07)G=6UE;G1S.@T* M07)G,3H@,# P,# P,#$L(&UE;6]R>2!R969E<F5N8V5D#0I!<F<R.B P,# P M,# P,BP@25)13 T*07)G,SH@,# P,# P,# L('9A;'5E(# @/2!R96%D(&]P M97)A=&EO;BP@,2 ]('=R:71E(&]P97)A=&EO;@T*07)G-#H@.# U-C<T-&8L M(&%D9')E<W,@=VAI8V@@<F5F97)E;F-E9"!M96UO<GD-"@T*1&5B=6=G:6YG M($1E=&%I;',Z#0HM+2TM+2TM+2TM+2TM+2TM+2T-"@T*#0I$149!54Q47T)5 M0TM%5%])1#H@($12259%4E]&055,5 T*#0I"54=#2$5#2U]35%(Z(" P>$,U M#0H-"D-54E)%3E1?25)13#H@(#(-"@T*3$%35%]#3TY44D],7U1204Y31D52 M.B @9G)O;2!F-S(T-F4X."!T;R X,#4V-S0T9@T*#0I44D%07T9204U%.B @ M9C<X8C)A8C @+2T@*"YT<F%P(&9F9F9F9F9F9C<X8C)A8C I#0I%<G)#;V1E M(#T@,# P,# P,# -"F5A>#TP,# P,#$R82!E8G@].# U.#,S-S@@96-X/3 P M,# P,# P(&5D>#TP,# P,# P,"!E<VD].#AE,V,P9C@@961I/3 P,# P,# Q M#0IE:7 ].# U-C<T-&8@97-P/68W.&(R8C(T(&5B<#UF-SAB,F(V."!I;W!L M/3 @(" @(" @("!N=B!U<"!E:2!P;"!N>B!N82!P92!N8PT*8W,],# P." @ M<W,],# Q," @9',],# R,R @97,],# R,R @9G,],# S," @9W,],# P," @ M(" @(" @(" @("!E9FP],# P,3 R,#(-"FYT(45X1G)E95!O;VQ7:71H5&%G M*S!X-#-F.@T*.# U-C<T-&8@.# S9C S(" @(" @(" @("!C;7 @(" @(&)Y M=&4@<'1R(%ME9&E=+#!X,R @(" @(&1S.C P,C,Z,# P,# P,#$]/S\-"E)E M<V5T=&EN9R!D969A=6QT('-C;W!E#0H-"E-404-+7U1%6%0Z(" -"F8W.&(R M8C8X(&8W,C0V93@X(#@X93-C,3 P(# P,# P,# P(&8W.&(R8CDT(&YT(45X M1G)E95!O;VQ7:71H5&%G*S!X-#-F#0IF-SAB,F(W."!F-S4Y8V(Y9" X.&4S M8S$P," P,# P,# P," P,# P,# P,"!.1$E3(4YD:7-&<F5E365M;W)Y*S!X M,SD-"E=!4DY)3D<Z(%-T86-K('5N=VEN9"!I;F9O<FUA=&EO;B!N;W0@879A M:6QA8FQE+B!&;VQL;W=I;F<@9G)A;65S(&UA>2!B92!W<F]N9RX-"F8W.&(R M8CDT(&8W-3EA-S8V(#@X938S860X(#@X938S8C$P(#@X9&5F,#@X($Y325!& M3%0K,'@U8CED#0IF-SAB,F)B,"!F-S(V,# V92 X.3<T.#1F," X.&4V,V%D M." P,# P,# P,"!.4TE01DQ4*S!X,S<V-@T*9C<X8C)B9#0@9C<P,V,Y-V0@ M.#EA-3$Q,S @.#AE-C-A9#@@,# P,# P,# @3D1)4R%N9&ES35-E;F1#;VUP M;&5T95@K,'@V90T*9C<X8C)B9C@@9C<P,V-A,60@.#DW-&%A-3 @,# W,S<V M-3@@.#DW-&$W.3 @:6%N<W=X<"LP>#0Y-V0-"F8W.&(R8S$P(&8W,#,X9#EE M(&8W.&(R8S(X(# P,# P,# U(#@Y-S,W-C4X(&EA;G-W>' K,'@T83%D#0IF M-SAB,F,S."!F-S(V,# V92 X.3<T83 P." X.3<S-S8U." P,# P,# P,"!I M86YS=WAP*S!X9#EE#0IF-SAB,F,U8R!F-S$Q,#AD9" X.6$V,#$S," X.3<S M-S8U." P,# P,# P,"!.1$E3(6YD:7--4V5N9$-O;7!L971E6"LP>#9E#0IF M-SAB,F,W-"!F-S$Q,&5C92!F-SAB,F,Y-" X.3<S-S8U." P,# P,# P,"!E M,3 P,#,R-2LP>#AD9 T*9C<X8C)C.&,@9C<Q,35C,#(@.#EA-3-B,C@@.#DW M,S<V-3@@,# P,# P,# @93$P,# S,C4K,'AE8V4-"F8W.&(R8V(P(&8W,3$U M,S$X(#@Y.6(X,&8P(#@Y-S,W-C4X(&8W.&(R8V0T(&4Q,# P,S(U*S!X-6,P M,@T*9C<X8C)C9&,@9C<Q,3 T9C0@,# Y8C@P9C @9C<R-C4P,C4@.#EA-3-B M,C@@93$P,# S,C4K,'@U,S$X#0IF-SAB,F0U," X,#1E-C%F-R P,# P,# P M," P,# P,# P92 P,# P,# P,"!E,3 P,#,R-2LP>#1F- T*#0H-"D9/3$Q/ M5U507TE0.B -"DY325!&3%0K-6(Y9 T*9C<U.6-B.60@,# P," @(" @(" @ M(" @("!A9&0@(" @(%ME87A=+&%L#0H-"E-934)/3%]35$%#2U])3D1%6#H@ M(#(-"@T*1D],3$]755!?3D%-13H@($UA8VAI;F5/=VYE<@T*#0I364U"3TQ? M3D%-13H@($Y325!&3%0K-6(Y9 T*#0I-3T153$5?3D%-13H@($Y325!&3%0- M"@T*24U!1T5?3D%-13H@($Y325!&3%0N<WES#0H-"D1%0E5'7T9,4E])34%' M15]424U%4U1!35 Z("!F9F9F9F9F90T*#0I35$%#2U]#3TU-04Y$.B @+G1R M87 @9F9F9F9F9F9F-SAB,F%B," [(&MB#0H-"D)50TM%5%])1#H@(#!X0S5? H3E-)4$9,5"LU8CED#0H-"D9O;&QO=W5P.B!-86-H:6YE3W=N97(-"@`` ` end Tag: hooking COM interfaces and methods Tag: 69400
  - 21
    - How to programmatically set binding order of NDIS miniport adapter on install? I have an NDIS 5 miniport adapter (virtual) which is causing users some trouble because it always installs at the top of the adapter bindings order, knocking off whatever adapter was previously at the top, and wreaking havoc with previously established default bindings. Is it possible to make a change in the .inf file to tell Windows to use a lower binding position for the new adapter? I know that this can be fixed manually by going to Control Panel -> Network Connections -> Advanced -> Advanced Settings -> Adapters and Bindings, and manually changing the ordering. The problem is that this is too complicated a step to expect users to be able to do manually. Is there a way to programmatically tell Windows: "Install this adapter at the bottom of the adapter bindings list, rather than the top"? Thanks, James Tag: hooking COM interfaces and methods Tag: 69395
  - 22
    - 1394 Max Isoch packet size in Windows 2000 1) I am NOT able to send 4096 bytes isoch packet in Windows 2000. I can do it in Windows XP SP1. Is this known bug? 2) When I am receiving packet with Isoch header, does 8 bytes header size included in isoch packet size. I think to receive 4096 byte packet with header, I need to have each receive packet (4096+8) bytes Thanks, Raj Tag: hooking COM interfaces and methods Tag: 69394
  - 23
    - windbg firewire connection xp64 Anyone else having problems with the 1394 debug port on XP64 systems? This was rock solid on my 32bit test system and now it hangs consistently in the early boot load phase of OS initialization. Windbg connects and then the big stall. I'd hate to have to go back to a serial port. The test system is a brand new dell dual proc xeon. TI 1394 chip set. Plugging in an add-on 1394 card is not a problem if that is what it takes. Tag: hooking COM interfaces and methods Tag: 69388
  - 24
    - EngWritePrinter and DrvEnablePDEV please help me out with one problem in EngWritePrinter, when i was trying to call this function it returns an error with error code of 6 (ERROR_INVALID_HANDLE). As DDK says i should use a DrvEnablePDEV's last parameter (which i save in PDEV structure), but an error still remains. i am writing to you cause noone could help me. And one more problem in MS Word, when i open a print window (ctrl+p) and choose my printer, it says the i don't have enough memory. I am using WinXp sp2, and i wrote graphics dll and interface dll. I build the driver with checked version and with free version (in DDK) Tag: hooking COM interfaces and methods Tag: 69375
  - 25
    - EngWritePrinter error!!! please help me out with one problem in EngWritePrinter, when i was trying to call this function it returned an error with error code of 6 (ERROR_INVALID_HANDLE). As DDK says i should use a DrvEnablePDEV's last parameter (which i save in PDEV structure), but an error still remains. i am writing to you cause noone could help me. And one more problem in MS Word, when i open a print window (ctrl+p) and choose my printer, it says the i don't have enough memory. I am using WinXp sp2, and i wrote graphics dll and interface dll. I build the driver with checked version and with free version (in DDK) Tag: hooking COM interfaces and methods Tag: 69372

I use the excellent COM tracer (Spying on COM Objects by Dmitri Leman) which
I use for hooking COM interfaces and methods. Problem is that I can't trace
all the methods that I need (especially regarding DirectShow interfaces).

Can someone advise please?

Thanks in advance

Mandi

Top

RE: hooking COM interfaces and methods by Nadav

Nadav
Sun Sep 11 10:16:02 CDT 2005

Well, If you know the specific interfaces you can hook then your-self, just
get their vtables and replace the functions with your detours ( keep in mind
that you have to call the original methods when your detour exits ).
--
Nadav
http://www.sophin.com

"Greg" wrote:

> I use the excellent COM tracer (Spying on COM Objects by Dmitri Leman) which
> I use for hooking COM interfaces and methods. Problem is that I can't trace
> all the methods that I need (especially regarding DirectShow interfaces).
>
> Can someone advise please?
>
> Thanks in advance
>
> Mandi
>
>
>

Top

Re: hooking COM interfaces and methods by Greg

Greg
Sun Sep 11 15:30:33 CDT 2005

Thanks Nadav,

What you describe is the principal of COM hooking but the algorithm of
Dmitri Leman already implements it for all interfaces - you just have to add
them to the configuration file. Do you know this software?

Regards

Greg

"Nadav" <Nadav@discussions.microsoft.com> wrote in message
news:EBBDEB65-873F-48B0-B12D-97A8704D2A89@microsoft.com...
> Well, If you know the specific interfaces you can hook then your-self,
just
> get their vtables and replace the functions with your detours ( keep in
mind
> that you have to call the original methods when your detour exits ).
> --
> Nadav
> http://www.sophin.com
>
>
> "Greg" wrote:
>
> > I use the excellent COM tracer (Spying on COM Objects by Dmitri Leman)
which
> > I use for hooking COM interfaces and methods. Problem is that I can't
trace
> > all the methods that I need (especially regarding DirectShow
interfaces).
> >
> > Can someone advise please?
> >
> > Thanks in advance
> >
> > Mandi
> >
> >
> >

Top