c - 当我们转换 Descriptor+Descriptor->SerialNumberOffset 时序列号枚举失败

Question

我有一个用于查找存储设备序列号的内核驱动程序，但该驱动程序存在问题。Descriptor->SerialNumberOffset 为 103但是 (LPCSTR)(UINT_PTR)Descriptor+(DWORD32)Descriptor->SerialNumberOffset 为 NULL

这是我的代码

NTSTATUS GetDeviceTypeAndUniqueID(IN PDEVICE_OBJECT StorageStackDeviceObject, cwDevices *lDeviceTypeArg, char *pszUidArg)
{
        DWORRD lDeviceType=0;

        STORAGE_PROPERTY_QUERY Query;
        STORAGE_DEVICE_DESCRIPTOR Buffer[4];
        NTSTATUS Status = STATUS_SUCCESS;
        ULONG uBusType=BusTypeUnknown;
        PSTORAGE_DEVICE_DESCRIPTOR Descriptor=NULL;
        PIRP NewIrp2=NULL;
        PIO_STACK_LOCATION  NextIrpStack=NULL;
        IO_STATUS_BLOCK IoStatus;
        char szSptr[2]={'_','\0'};

        Query.PropertyId = StorageDeviceProperty;// first set the query properties
        Query.QueryType = PropertyStandardQuery;

        lDeviceType=0;

        if (KeGetCurrentIrql() > PASSIVE_LEVEL)
        {
                return STATUS_SUCCESS;
        }
        if(StorageStackDeviceObject == NULL)
        {
           return STATUS_SUCCESS;
        }

        if((StorageStackDeviceObject->DeviceType != FILE_DEVICE_DISK) &&
                (StorageStackDeviceObject->DeviceType != FILE_DEVICE_CD_ROM)&&
                (StorageStackDeviceObject->DeviceType != FILE_DEVICE_DVD)&&
                (StorageStackDeviceObject->DeviceType !=FILE_DEVICE_TAPE) )
        {
                return STATUS_SUCCESS;
        }

        KeInitializeEvent(&WaitEvent_newIrp, NotificationEvent, TRUE);// initialize the waitable event

        __try
        {

                NewIrp2=IoBuildDeviceIoControlRequest(IOCTL_STORAGE_QUERY_PROPERTY, StorageStackDeviceObject,
                                                                                           (PVOID)&Query,sizeof(STORAGE_PROPERTY_QUERY),
                                                                                           (PVOID)Buffer,sizeof(STORAGE_DEVICE_DESCRIPTOR)*4,
                                                                                           FALSE,&WaitEvent_newIrp,&IoStatus);

                if(NewIrp2==NULL)
                {
                        return STATUS_SUCCESS;
                }

                Status = IoCallDriver(StorageStackDeviceObject, NewIrp2);// send this irp to the storage device

                if (Status == STATUS_PENDING)
                {
                        KeWaitForSingleObject(&WaitEvent_newIrp, Executive, KernelMode, FALSE, NULL);
                        Status =IoStatus.Status;
                }
        }
    __finally
        {
                if(NT_SUCCESS(Status))
                {
                        if (NT_SUCCESS(Status))
                        {

                                if(Buffer!=NULL)
                                {
                                        char szStart[256];
                                        Descriptor = (PSTORAGE_DEVICE_DESCRIPTOR)Buffer;
                                        uBusType = Descriptor->BusType; //Get the bus type.

                                        if(Descriptor->SerialNumberOffset!=0)//Is Valid SerialNumberOffset, returns 103
                                        {
                                                strcpy(szStart,(char*)(UINT_PTR)Descriptor+(DWORD32)Descriptor->SerialNumberOffset);
                                                //szStart is null
                                        }
                                }
                                NewIrp2 = NULL;
                        }
                }
        }
}

请分享如何解决这个问题

Answer 1

你错了 OutputBufferLength - 你为什么决定 sizeof(STORAGE_DEVICE_DESCRIPTOR)*4足够 ？为什么不5* sizeof(STORAGE_DEVICE_DESCRIPTOR)例如 ？真的是什么OutputBufferLength必须是未知的 - 您需要循环调用此查询并比较当前的 OutputBufferLength与 STORAGE_DEVICE_DESCRIPTOR.Size - 如果 OutputBufferLength < STORAGE_DEVICE_DESCRIPTOR.Size - 你必须再次发送 IOCTL_STORAGE_QUERY_PROPERTY与 OutputBufferLength = STORAGE_DEVICE_DESCRIPTOR.Size .代码可以看起来像。

        STORAGE_PROPERTY_QUERY spq = { StorageDeviceProperty, PropertyStandardQuery }; 

        union {
            PVOID buf;
            PSTR psz;
            PSTORAGE_DEVICE_DESCRIPTOR psdd;
        };

        ULONG size = sizeof(STORAGE_DEVICE_DESCRIPTOR) + 0x100;

        NTSTATUS status = STATUS_INSUFFICIENT_RESOURCES;

        do 
        {
            status = STATUS_INSUFFICIENT_RESOURCES;

            if (buf = ExAllocatePool(PagedPool, size))
            {
                switch (status = (NtDeviceIoControlFile(hFile, 0, 0, 0, &iosb, 
                    IOCTL_STORAGE_QUERY_PROPERTY, &spq, sizeof(spq), buf, size)))
                {
                case STATUS_SUCCESS:
                case STATUS_BUFFER_OVERFLOW:
                    if (psdd->Version == sizeof(STORAGE_DEVICE_DESCRIPTOR))
                    {
                        if (psdd->Size > size)
                        {
                            size = psdd->Size;
                            status = STATUS_BUFFER_OVERFLOW;
                        }
                        else
                        {
                            if (psdd->SerialNumberOffset)
                            {
                                DbgPrint("SerialNumber = %s\n", psz + psdd->SerialNumberOffset);
                            }
                        }
                    }
                    else
                    {
                        status = STATUS_INVALID_PARAMETER;
                    }
                    break;
                }

                ExFreePool(buf);
            }
        } while (status == STATUS_BUFFER_OVERFLOW);

就位NtDeviceIoControlFile我们当然可以使用 IoBuildDeviceIoControlRequest + IoCallDriver - 这没有任何变化并且与问题无关