I use the following code to fetch PSTORAGE_HOTPLUG_INFO capabilities from disks via IOCTL in a minifilter driver, but the returning hotplugInfo structure has all the fields set to random nonzero values on subsequent executions.
What am I doing wrong?
RESULT:
00000014 0.00046322 IOCTL Volume Media Removable, 64
00000015 0.00046451 IOCTL Volume Media Hotplug 154
00000016 0.00046562 IOCTL Volume Device Hotplug 244
00000054 1020.44311523 IOCTL Volume Media Removable, 240
00000055 1020.44311523 IOCTL Volume Media Hotplug 102
00000056 1020.44311523 IOCTL Volume Device Hotplug 244
Sample code:
//int SomeFunction(PFLT_VOLUME pFLTVolume)
STORAGE_HOTPLUG_INFO storageHotplugInfo;
KEVENT event;
IO_STATUS_BLOCK ioStatus;
PIRP pirp;
PDEVICE_OBJECT deviceObject;
PSTORAGE_HOTPLUG_INFO hotplugInfo;
ASSERT(KeGetCurrentIrql() <= DISPATCH_LEVEL);
status = FltGetDiskDeviceObject(pFLTVolume, &deviceObject);
if(!NT_SUCCESS(status)){
DbgPrint("No Device for Volume\n");
return 0;
}
KeInitializeEvent(&event, NotificationEvent, FALSE);
ASSERT(KeGetCurrentIrql() <= APC_LEVEL);
pirp = IoBuildDeviceIoControlRequest(
IOCTL_STORAGE_GET_HOTPLUG_INFO,
deviceObject,
NULL,
0,
&storageHotplugInfo,
sizeof(STORAGE_HOTPLUG_INFO),
FALSE,
&event,
&ioStatus
);
if(!pirp){
return 0;
}
ASSERT(KeGetCurrentIrql() <= DISPATCH_LEVEL);
status = IoCallDriver(deviceObject, pirp);
if (status == STATUS_PENDING) {
status = KeWaitForSingleObject(
&event,
Executive,
KernelMode,
FALSE,
NULL);
} else {
ioStatus.Status = status;
}
status = ioStatus.Status;
hotplugInfo = (PSTORAGE_HOTPLUG_INFO) &pirp->AssociatedIrp.SystemBuffer;
if(hotplugInfo->MediaRemovable){
DbgPrint("IOCTL Volume Media Removable, %d\n",
hotplugInfo->MediaRemovable);
}
if(hotplugInfo->MediaHotplug){
DbgPrint("IOCTL Volume Media Hotplug %d\n",
hotplugInfo->MediaHotplug);
}
if(hotplugInfo->DeviceHotplug){
DbgPrint("IOCTL Volume Device Hotplug %d\n",
hotplugInfo->DeviceHotplug);
}
ObDereferenceObject(deviceObject);
