Why does DeviceIoControl prepend 12 bytes of information to the user-provided input buffer?

Question

I hope this does not turn out to be a totally braindead question.

I am editing a template WDF Windows USB device driver to send formatted data to one of the device's bulk out pipes; the data has to be set up in a certain way to tell the device to read an internal register.

The problem is that I cannot get the data to go across the bus in the exact format necessary. I wrote a small test app to enumerate the device and call DeviceIoControl with the input buffer set to a struct I set up according to spec.

I have a copy of a USB bus trace for a working case (performed by a driver whose source I have no access to), and I captured a bus trace for what happens when I call the custom IOCTL in my driver. What I see go across the bus is the data structure I set up prefixed with twelve bytes of data; the data structure is correct, but I want to know what the initial twelve bytes of data are, and stop the driver from sending them.

The driver, I believe, has been written properly; I put some debug traces in the driver and it looks like the buffer retrieved by WdfRequestRetrieveInputMemory already has the 12 bytes prepended, so this seems like this is happening pre-driver.

If it is useful information, the IOCTL is set up as METHOD_BUFFERED with FILE_ANY_ACCESS.

The relevant portion of the test code that sets this up is very simple:

const ULONG         ulBufferSize = sizeof( CONTROL_READ_DATA );
unsigned char       pBuffer[sizeof(CONTROL_READ_DATA)];
DWORD               dwBytesReturned;
CONTROL_READ_DATA*  readData = (CONTROL_READ_DATA*)pBuffer;

readData->field1 = data;
readData->field2 = moreData;
// ... all fields filled in...

// Send IOCTLs into camera
if( !::DeviceIoControl( hDevice,
                        IOCTL_CUSTOM_000,
                        &readData,
                        ulBufferSize,
                        &readData,
                        ulBufferSize,
                        &dwBytesReturned,
                        NULL ) )
{
    dwError = ::GetLastError();
    // Clean up here
    return dwError;
}

The data I see go across the bus is: 80FD1200 CCCCCCCC CCCCCCCC + (My data).

Does anyone have any insights?

Answer 1

Wow, really ridiculous error. Notice I'm passing the address of readData to DeviceIoControl, which itself is already a pointer. I can't believe I wasted so much time on this.

Thanks all!