[Vijender]

I should have explained this point….
Generally filter drivers dont buffer data. If data is not accepted by upper driver, the filter driver also rejects the data.
In my case I buffer the data till my buffer is full. After that I start rejecting the data from TCP. Because of buffering I have to do lot of bookkeeping and handle various situation that might occur related to data-reception using TDI_RECEIVE irp and ClientEventReceive.

Hope I make it clear.

Regards
Vijender

[Vijender]

Hi,

I am concerned only about Devicetcp.

And my query is on direct handlers.

Just to clarify my query:

---

A TDI client can get pointer to tcpip’s direct send handler using ioctl IOCTL_TDI_QUERY_DIRECT_SEND_HANDLER.
Using this function pointer it can directly pass data to tcpip, bypassing all filter drivers.
I have captured this ioctl from TDI clients and hooked the tcpip direct handler.

I want to know if there are more such IOCTLS for Devicetcp, that I need to capture such that no data is bypassed my filter driver.

[Vijender]

Hi,

I have successfully tracked IOCTL_TDI_QUERY_DIRECT_SEND_HANDLER and able to hook TCPSendData.

But is there any more undocumented ioctl which needs to be handled?
For e.g. is there any ioctls for receive also: IOCTL_TDI_QUERY_DIRECT_RECEIVE_HANDLER.

Waiting for reply.

[Vijender]

Hi Rvd,

I am very busy these days. So can’t spend much time on the code.
But I’ll suggest you a solution for now.

First check it is not possible to call your routine at dispatch level. Check in DDK . Because if it can call your routine at DISPATCH_LEVEL there is problem.
Now when your function is called by I/O manager, enqueue a work item adn you wait here till your worker thread has read the data for you. For that you will have to create a work item and enqueue it in system queue. A system thread will than carry out all of your work at PASSIVE_LEVEL.

[Vijender]

Hi Rvd,

The statetement that you are refering to, at which your driver is crashing, indicates that you are running at higher irql than PASSIVE_LEVEL.
There could be many reasons for that:
1. Your function is called at high irql by I/O system.
2. You have raised your irql by say acquireing some lock but forgot to release.

Your driver will crash at that statement if IRQL > PASSIVE_LEVEL no matter it is called first time or any time.

[Vijender]

Hello Rvd,

Your problem is not clear to me. Not much idea about virtual disk drivers. Please elaborate, what does your driver do and what you want to do now.

[Vijender]

Hi,

I’ll forward you some of the code that I wrote for a kernel socket library. But please note that the code will be for learning purpose only.

But I am not able to find any options here to send attachments. So fwd me your mail-id, I’ll mail the files directly to you.

and remember “TDI is not so bad”. 😀

[Author]

Posts