0

I am developing mini-filter. I use IoGetDeviceInterfaces() to get device interface instances.

  1. When I check the status of this routine, It is success

  2. When I check SymbolicLinkList parameter, It is NOT NULL

  3. But when I print value of SymbolicLinkList to log, It does not show any thing.

How can I get value of SymbolicLinkList parameter from this routine?

This is my code:

status = IoGetDeviceInterfaces(&deviceGuid, NULL, 0, &symbolicLinkList);
if (NT_SUCCESS(status)) {
     if (symbolicLinkList == NULL)
        DbgPrint("IoGetDeviceInterfaces symbolicLinkList is NULL\n");
     else 
     {
         DbgPrint("IoGetDeviceInterfaces: %ws\n", symbolicLinkList);
         DbgPrint("IoGetDeviceInterfaces: %wZ\n", symbolicLinkList);
         DbgPrint("IoGetDeviceInterfaces: %s\n", symbolicLinkList);
         DbgPrint("IoGetDeviceInterfaces: %ws\n", symbolicLinkList);
         DbgPrint("IoGetDeviceInterfaces: %p\n", symbolicLinkList);
     }
} else {
    DbgPrint("IoGetDeviceInterfaces is failed\n");
}

The log is like this:

enter image description here

GSP
  • 574
  • 3
  • 7
  • 34
  • Are you at IRQL = PASSIVE_LEVEL ? – Harry Johnston Jan 20 '15 at 02:27
  • "If no device interface instances match the search criteria, this routine returns STATUS_SUCCESS and the string contains a single NULL character." In other words, an empty string, which is consistent with the debug output. – Harry Johnston Jan 20 '15 at 02:28
  • How to check **`IRQL = PASSIVE_LEVEL`**? I just want to know the value, struct and format of SymbolicLinkList. My purpose is get the unique name of drive from GUID (vendor id, product id, ..), so I try to do this. – GSP Jan 20 '15 at 02:32
  • What type do you have for `symbolicLinkList` now? [MSDN says what the expected format of that out parameter should be](http://msdn.microsoft.com/en-us/library/windows/hardware/ff549186%28v=vs.85%29.aspx): it writes out a pointer to some strings. Therefore, `symbolicLinkList` should be a `WCHAR *` and you pass a pointer to *that* to `IoGetDeviceInterfaces()`. However, you should check the other comments here as well. – andlabs Jan 20 '15 at 03:59
  • @andlabs I use **`PWSTR symbolicLinkList;`**. In MSDN, `SymbolicLinkList` of `IoGetDeviceInterfaces()` is said that: `A pointer to a wide character pointer to which the routine, if successful, writes the base address of a buffer that contains a list of Unicode strings.` How can I get each Unicode string from this list? – GSP Jan 20 '15 at 04:20
  • You should really know what IRQL you are running at, but you can verify it by calling KeGetCurrentIrql. But I think the function is probably just returning an empty list, so you need to check whether `*symbolicLinkList == L'\0'` – Harry Johnston Jan 20 '15 at 04:21
  • @HarryJohnston `*symbolicLinkList == L'\0'` is TRUE. It is empty list. Thanks all. – GSP Jan 20 '15 at 04:27
  • @HarryJohnston I always get `*symbolicLinkList == L'\0'` for all drives although the status is success. Is there anything wrong? – GSP Jan 20 '15 at 04:41
  • I'm not very familiar with that technology ... but the documentation for IoGetDeviceInterfaces says that the GUID has to be a class GUID which doesn't seem to be the case in your code. – Harry Johnston Jan 20 '15 at 04:46

0 Answers0