[p30arena]

i tried
DbgPrint("%ws", DeviceObject->Vpb->VolumeLabel);
...................vpb->VolumeLabel
...................realobj->Vpb->VolumeLabel

but none of them print the Volume Label! ...
maybe i'm looking the wrong place for the answer!

[p30arena]

ok i took another approach

Code: Select all

IoGetDeviceProperty(realobj, DevicePropertyClassGuid, sizeof(devInfo), (PVOID)devInfo, &rlen);
DbgPrint("%ws\n", devInfo);

using this code, i'm gonna print the class guid of, Vpb->RealObject of my Current Irp Stack in IRP_MJ_FILE_SYSTEM_CONTROL under IRP_MN_MOUNT_VOLUME
i tested a TDK USB, the GUID that is printed in the debugger is not present in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB
whats happening exactly?!!!

[R00tKit]

what was in this reg is device that are enumerated with USB BUS that are not related to volume device object or File System device object

[p30arena]

yes of course, thats my problem! :)) USB :))
would u please help me here, i think thats the solution to whole these crap :mrgreen: :
http://www.kernelmode.info/forum/viewto ... =14&t=1843

[R00tKit]

No

http://www.kernelmode.info/forum/viewto ... =14&t=1843 is not related to your problem anyway :) ها ها ها :lol: :lol: :mrgreen: ;)

[p30arena]

no thats the approach to solve this problem, i always face problems, cause microsoft dares to well Document its kernel api :lol:
but my approach is full of problems too :lol:
whats your opinion ?!
think, that i just want to write a file to usb! and the usb is mounted just right now! how should i do that? :D :(

[R00tKit]

detect USB (mass strorage ) and write file to it it sound malware activity :)
it is so simple find bus type of device i write it one year ago ;)

for NDA reason i cant share code with you :mrgreen:

[p30arena]

i didn't ask for code, i asked for help ;)

[R00tKit]

i asked for help

...

find bus type

[p30arena]

Problem Solved,
IoGetDeviceProperty
didn't work for me, dont know the reason :D
i used an alternative way, IOCTL_blab_blab...
:D