A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #30037  by EP_X0FF
 Sat Feb 25, 2017 7:26 am
There is the field in IRP describing power action

Irp->Parameters.Power.ShutdownType

you can try check it if it works in this callback.

According to msdn IRP_MJ_POWER -> IRP_MN_SET_POWER -> Irp->Parameters.Power.ShutdownType
 #30043  by vs2099
 Mon Feb 27, 2017 1:14 am
EP_X0FF wrote:There is the field in IRP describing power action

Irp->Parameters.Power.ShutdownType

you can try check it if it works in this callback.

According to msdn IRP_MJ_POWER -> IRP_MN_SET_POWER -> Irp->Parameters.Power.ShutdownType
Not useful.
 #30044  by vs2099
 Mon Feb 27, 2017 1:16 am
EP_X0FF wrote:There is the field in IRP describing power action

Irp->Parameters.Power.ShutdownType

you can try check it if it works in this callback.

According to msdn IRP_MJ_POWER -> IRP_MN_SET_POWER -> Irp->Parameters.Power.ShutdownType

I fill DriverObject->MajorFunction[IRP_MJ_POWER] to my dispatch function, But I can't get the call, could you tell me why.
 #30048  by vs2099
 Tue Feb 28, 2017 5:11 am
Brock wrote:vs2099,

You have to register with a call to IoRegisterShutdownNotification(), are you doing this?
YES, i have already register shutdown notification.
I can get DispatchShudown call, but not DispatchPower call.
 #30077  by feryno
 Wed Mar 08, 2017 7:25 am
vs2099 wrote:I fill DriverObject->MajorFunction[IRP_MJ_POWER] to my dispatch function, But I can't get the call, could you tell me why.
I had the same problem according IRP_MJ_POWER few years ago. This may be helpful:
https://www.winvistatips.com/threads/ma ... ed.182097/
I was unable to made MJ_POWER to work in my driver at the end (maybe I did not try hard enough), so I had to do an alternative approach, but that seems not be useful to you according the name of this thread (it was enough to me, because distinguishing shutdown/reboot did not play any role in my project)
http://blogs.msdn.com/b/doronh/archive/ ... 30493.aspx
If you succeed in MJ_POWER please report it. Otherwise you could still try an alternative way.
 #30080  by Vrtule
 Wed Mar 08, 2017 5:55 pm
You definitely can create a PnP device (https://msdn.microsoft.com/en-us/librar ... s.85).aspx) but it may need to handle some extra PnP/Power requests.

EDIT
Perhaps, PoSetPowerState on your control device object may do the job. But I did not test it, I have some experience with power IRPs only from the PnP world.