Search code examples
windowsdriverwindows-kernelirp

Can i find out symbolic link of opened device, when process IRP_MJ_READ?

I have driver, that construct and return some data on IRP_MJ_READ request. I use some symbolic link to open and read device, associated with driver. The symbolic link is something like \\DosDevice\\Name1.

I want to use same device to get another data from same driver.

How can driver determine, which type of data it would return?

I think, if this is some way to use another symbolic link (for example: \\DosDevice\\Name2) to the same device for split requests for first type of data and requests for second type? Else if this another way, to pass some identifying information together with thre IRP_MJ_READ?

Solution

  • no, you can not determinate which symbolic links used and are it used at all for open file on your device. and you not need try do this at all. this is wrong way.

    when user open file on your device it specify some file name. and you can and must use this name - based on it - return different content on IRP_MJ_READ.

    say your device named as \Device\MyDevice. user can open file, for example, with next names : "\Device\MyDevice", "\Device\MyDevice\" "\Device\MyDevice\Name1", "\Device\MyDevice\Name2". as result you, in your IRP_MJ_CREATE will be view next FileObject names : "", "\","\Name1","\Name2" and you, base on file name, can associate different context with file object and then use this context in IRP_MJ_READ and another points. also user can pass additional information on create by using Extended Attributes (EA) and AllocationSize

    and as general note - for what use symbolic links to device at all ? why not open it direct by name ? and use IRP_MJ_READ exist sense only if you can handle this request asynchronous or pass IRP to lower driver. in case, if you always synchronous complete request - much more better use FastIoRead handler

    also instead on handle read request based on file name, you can use parameters: are you using ByteOffset now ? if not you can use it for distinguish. if you use ByteOffset now, are Key parameter in use ? almost sure that no. in this case you can for Key==0 return some data, for Key==1, some another data, and so on. for use Key you need use NtReadFile instead of ReadFile in user mode.

    also you can use IOCTL instead read file for return data, etc. without more knowledge about your driver and it communication with user mode hard say which is better. but formal answer - you can and need use FileName for distinguish which data need return on read