I am working with a WinCE device which has a radio manager driver written for it in MFC. In the code for the Radio GUI, I can see the function Deviceiocontrol with a specific IOCTL being called. However, I'm unable to trace the particular piece of code called by this function. Can someone tell me how Deviceiocontrol works?
+3
A:
DeviceIoControl calls through to the device driver by using the file handle. You have to use a kernel debugger if you want to step into the device driver itself.
The file handle represents a kernel object which consists of a DEVICE_OBJECT structure which contains a function table. In this table at the index of IRP_MJ_DEVICE_CONTROL, the driver sets its handle function. The function then gets called with the io control parameters which are packaged into an IRP.
Christopher
2010-04-21 12:35:56
Thankyou! I'm afraid I don't know how to use a kernel debugger. I can see the code for the Radio Manager and I believe the function RadioManager_IOControl(Rmgr * context,IOCTL_...,BYTE *pInBuffer, DWORD inSize,BYTE *pOutBuffer, DWORD outSize, DWORD *pOutSize) (in the radio driver) is what is called by deviceiocontrol. My problem is that deviceiocontrol has a handle to Rmgr in its argumentlist while RadioManager_IOControl of the device driver has a pointer to a Rmgr structure in its argument list. I am unable to trace how this structure is populated.
ame
2010-04-21 13:13:36
The `Rmgr*` is the device handle you pass to `DeviceIoControl`. This handle is populated when you call `CreateFile`. The exact way of its population is driver/implementation specific. It might be populated every time your driver's XXX_Open is called and it might be populated during the XXX_Init of the driver and it might be just a dummy handle that the driver returns. Driver specific.
Shaihi
2010-04-25 05:53:47
A:
Do you have the source code for the driver the IOCTL is sent to?
You pass a handle to DeviceIoControl - the handle is opened using a call to CreateFile(L"XXX#:",...) - XXX being the prefix of the driver as set in the registry. and # is the index the driver is giving at load time (also can be set in the registry).
To see the functionality that is performed, search for the IOCTL you send to DeviceIoControl in the driver's source code. You will find it in the driver's implementation of XXX_IoControl.
Shaihi
2010-04-28 13:28:08