Windows Filesystem filter driver

参考：http://www.codeproject.com/Articles/43586/File-System-Filter-Driver-Tutorial

关键点：

To perform attaching, we create a new device object with the device extension (call IoCreateDevice) and the propagate device object flags from the device object we are trying to attach to (DO_BUFFERED_IO, DO_DIRECT_IO,FILE_DEVICE_SECURE_OPEN). Then, we call IoAttachDeviceToDeviceStackSafe in a loop with a delay in the case of failure. It is possible for this attachment request to fail because the device object has not finished initialization. This situation can occur if we try to mount the filter that was loaded as the volume only. When attaching is finished, we save the “attached to” device object to the device extension and clear the DO_DEVICE_INITIALIZING flag. The device extension is shown below:

首先创建一个hookDevice，指定我们正在操作的driver为它服务；

然后使用IoAttachDeviceByPointer或者IoAttachDeviceToDeviceStack，将hookDevice放到targetDevice所在Dev Stack的顶部，这样，当有IRP过来时，会先经过hookDevice，即先调用我们的Driver进行处理，再传给下一层driver进行处理。

The IoAttachDeviceToDeviceStack routine attaches the caller's device object to the highest device object in the chain and returns a pointer to the previously highest device object. 

　　

下面以例子说明

kd> !drvobj atapi
Driver object (867ce610) is for:
 Driveratapi
Driver Extension List: (id , addr)
(f744e8d8 867d2430)  
Device Object list:
86758b00  8675ab00  86790b00  86786030
86787030 

　　

kd> dt _DRIVER_OBJECT 0x867ce610
ntdll!_DRIVER_OBJECT
   +0x000 Type             : 0n4
   +0x002 Size             : 0n168
   +0x004 DeviceObject     : 0x86758b00 _DEVICE_OBJECT
   +0x008 Flags            : 0x12
   +0x00c DriverStart      : 0xf743a000 Void
   +0x010 DriverSize       : 0x17480
   +0x014 DriverSection    : 0x867ebbc0 Void
   +0x018 DriverExtension  : 0x867ce6b8 _DRIVER_EXTENSION
   +0x01c DriverName       : _UNICODE_STRING "Driveratapi"
   +0x024 HardwareDatabase : 0x80670260 _UNICODE_STRING "REGISTRYMACHINEHARDWAREDESCRIPTIONSYSTEM"
   +0x028 FastIoDispatch   : (null) 
   +0x02c DriverInit       : 0xf744f5f7     long  atapi!GsDriverEntry+0
   +0x030 DriverStartIo    : 0xf74417c6     void  atapi!IdePortStartIo+0
   +0x034 DriverUnload     : 0xf744b204     void  atapi!IdePortUnload+0
   +0x038 MajorFunction    : [28] 0xf7444572     long  atapi!IdePortAlwaysStatusSuccessIrp+0

　　

表明，驱动名称为apapi，它一共为5个device提供服务，我们来看一下其中第一个device object

kd> dt _DEVICE_OBJECT 0x86758b00
ntdll!_DEVICE_OBJECT
   +0x000 Type             : 0n3
   +0x002 Size             : 0x234
   +0x004 ReferenceCount   : 0n0
   +0x008 DriverObject     : 0x867ce610 _DRIVER_OBJECT
   +0x00c NextDevice       : 0x8675ab00 _DEVICE_OBJECT
   +0x010 AttachedDevice   : 0x8678f030 _DEVICE_OBJECT
   +0x014 CurrentIrp       : (null) 
   +0x018 Timer            : (null) 
   +0x01c Flags            : 0x5050
   +0x020 Characteristics  : 0x101
   +0x024 Vpb              : (null) 
   +0x028 DeviceExtension  : 0x86758bb8 Void
   +0x02c DeviceType       : 2
   +0x030 StackSize        : 1 ''
   +0x034 Queue            : __unnamed
   +0x05c AlignmentRequirement : 1
   +0x060 DeviceQueue      : _KDEVICE_QUEUE
   +0x074 Dpc              : _KDPC
   +0x094 ActiveThreadCount : 0
   +0x098 SecurityDescriptor : 0xe100cf70 Void
   +0x09c DeviceLock       : _KEVENT
   +0x0ac SectorSize       : 0
   +0x0ae Spare1           : 1
   +0x0b0 DeviceObjectExtension : 0x86758d38 _DEVOBJ_EXTENSION
   +0x0b4 Reserved         : (null) 

　　

+0x008 DriverObject : 0x867ce610 _DRIVER_OBJECT　　【指向为其服务的driver，即atapi】
+0x00c NextDevice : 0x8675ab00 _DEVICE_OBJECT　　【指向atapi中的device list中的下一项，在!drvobj atapi的结果中得到了验证】
+0x010 AttachedDevice 　: 0x8678f030 _DEVICE_OBJECT　　【指向该device object所在的device stack中的下一项，或者说更加靠近顶层的一项】

我们沿着device stack一直向下遍历：

kd> dt _DEVICE_OBJECT 0x8678f030 
ntdll!_DEVICE_OBJECT
   +0x000 Type             : 0n3
   +0x002 Size             : 0x47c
   +0x004 ReferenceCount   : 0n0
   +0x008 DriverObject     : 0x867d0970 _DRIVER_OBJECT
   +0x00c NextDevice       : (null) 
   +0x010 AttachedDevice   : (null) 
   +0x014 CurrentIrp       : (null) 
   +0x018 Timer            : 0x8679a548 _IO_TIMER
   +0x01c Flags            : 0x2050
   +0x020 Characteristics  : 0x101
   +0x024 Vpb              : 0x867bebe0 _VPB
   +0x028 DeviceExtension  : 0x8678f0e8 Void
   +0x02c DeviceType       : 2
   +0x030 StackSize        : 3 ''
   +0x034 Queue            : __unnamed
   +0x05c AlignmentRequirement : 1
   +0x060 DeviceQueue      : _KDEVICE_QUEUE
   +0x074 Dpc              : _KDPC
   +0x094 ActiveThreadCount : 0
   +0x098 SecurityDescriptor : 0xe100cf70 Void
   +0x09c DeviceLock       : _KEVENT
   +0x0ac SectorSize       : 0
   +0x0ae Spare1           : 0
   +0x0b0 DeviceObjectExtension : 0x8678f4b0 _DEVOBJ_EXTENSION
   +0x0b4 Reserved         : (null) 

kd> !devstack 0x8678f030 
  !DevObj   !DrvObj            !DevExt   ObjectName
> 8678f030  DriverCdrom      8678f0e8  CdRom0
  86758b00  Driveratapi      86758bb8  IdeDeviceP1T0L0-17
!DevNode 8678f9b8 :
  DeviceInst is "IDECdRomVBOX_CD-ROM_____________________________1.0_____42562d3231303037333036372020202020202020"
  ServiceName is "cdrom"

　　

可见，device stack其实就是通过_DEVICE_OBJECT中的AttachedDevice指针串联起来的一个单链表，当调用IoAttachDeviceToDeviceStack时，会在该device stack的最顶端添加我们自己的device object。

然后，当一个IRP过来时，不论它是以这个device object中的哪一个device object作为参数，它都会传递到栈的最顶端的device所对应的driver中去处理。

因此，这就是为什么IoAttachDeviceToDeviceStack能够创建file system filter driver的原因。

　　

Device Stack决定了Driver被执行的顺序，或者说driver是没有层次结构的，只有device有层次结构。