Click here to Skip to main content
Click here to Skip to main content

Reading and Writing to Raw Disk Sectors

, 2 Aug 2008 GPL3
Rate this:
Please Sign up or sign in to vote.
Bypasses upper filter of class disk driver for reading and writing to disk

Introduction

This is a tool to read and write raw disk sectors on Windows systems (NT5.0, 5.1 kernels)
Inspiration to write this tool came to me when I had my laptop infected with some malware which was sitting on top of disk class driver as an upper filter and not allowing me to write to disk sectors using user mode disk editing tools like WinHex.

After a few days, I thought I should write a utility to read and write raw disk sectors by directly
communicating with disk class driver.

Background

To understand this article, one should have knowledge of C Programming and Windows Driver Programming.

We will go through the following topics to understand the utility in a better way:

  1. Device stack for storage drivers
  2. Enumerating device objects representing disks and partitions
  3. How to read/write to sectors

1. Device Stack for Storage Drivers

Microsoft provides generic storage drivers for managing the storage on a logical level and thus abstracting hardware details from upper level file system and other file drivers. This is called disk class driver (a driver to handle disk class of hardware, i.e. "disk.sys").

Similarly to handle SCSI, IDE hardware devices, Microsoft provides generic port interface drivers to which drivers supplied by specific vendors for their disk devices can be dynamically linked.

E.g. scsiport.sys (old interface) storport.sys (new interface) is used as an interface to SCSI port while Pciidex.sys is used as an interface to IDE port.

2. Enumerating Device Objects Representing Disks and Partitions

There is a question which needs to be answered first.

How does the OS come to know that a harddisk has been attached to the system?

Whenever a new disk device is attached to the system, SCSI and IDE port drivers create device object (although PCI driver is the first one which comes into the picture) to represent a SCSI/IDE device and inform I/O manager about it. I/O manager in turn queries the devices to know their device id and vendor id. Depending on dev id and vendor id, I/O manager decides (through registry or INF file mechanism) which driver is suitable to handle this device (driver supplied by vendor) and loads the hardware device driver which creates device objects representing the Functions device objects for the device and attaches itself to lower devices created by respective port drivers.

I/O manager informs disk class driver (disk.sys) of new disks added into the system. Disk class driver then creates the device objects representing the raw disks.

If a valid partition is present on the system, then it creates device objects for the respective partitions too.

E.g. Device objects created by disk class driver are as follows:

  • \Device\Harddisk0\DR(0) --> Represents Raw Harddisk 0
  • \Device\Harddisk0\DP(1)0x7e000-0x7ff50c00+2 --> Represents partition 2 of disk 0

The first hexadecimal digit shows the start and thsecond shows the length of partition.

That means all the device objects representing disks and partitions are chained in driver object of disk class driver (i.e. disk.sys).

Now to enumerate the device objects created, you first need to have access to the driver object of disk class driver.

The solution is to use undocumented Object management kernel function "ObReferenceObjectByName" prototype:

NTSTATUS ObReferenceObjectByName(
        PUNICODE_STRING, 
        DWORD, 
        PACCESS_STATE, 
        ACCESS_MASK,
        POBJECT_TYPE,
        KPROCESSOR_MODE,
        PVOID,
        PVOID *Object); 

The first argument is a Unicode string, i.e. "\Driver\disk", object receives the pointer to the DRIVER_OBJECT of disk.sys.

From DRIVER_OBJECT, you can enumerate all the device objects created by disk class driver and store pointer to device objects responsible for raw disks and partitions. The following snippet will clear the things:

PDEVICE_OBJECT pDeviceObject;
  ..... 
// DeviceType 7 corresponds to FILE_DISK_DEVICE Type Device Object and

 // It should have name too that's why Flags checks for 0x40 (DO_DEVICE_HAS_NAME )

                if (pDeviceObject->DeviceType == 7
                        && (pDeviceObjectTemp->Flags & 0x40))

3. How to Read/Write to Sectors

Once you have pointers to device objects for raw disks and partitions, reading and writing to those raw disks/partitions is not a difficult thing. You only have to do a IoCallDriver on the respective device object with IRP_MJ_READ/IRP_MJ_WRITE function codes initialized in the IRPs.

The following code will make things clear:

LARGET_INTEGER lDiskOffset; 

PDEVICE_OBJECT pDevObj; //Device object representing disk/partition

KEVENT Event; 

// Trying to read some arbitrary sector number 1169944 and 
// by default assuming sector size 

// 512 

..........

..........

        lDiskOffset.QuadPart = 1169944*512;
        sBuf = ExAllocatePool(NonPagedPool, size);
        
        if (!sBuf) {
            ObDereferenceObject(pFileObj);
            return STATUS_INSUFFICIENT_RESOURCES;
        }
        KeInitializeEvent(&Event, NotificationEvent, FALSE);
        memset(sBuf, '0x00', size);
        pIrp = IoBuildSynchronousFsdRequest(IRP_MJ_WRITE/*IRP_MJ_READ*/, 
			pDevObj, sBuf, size, &lDiskOffset, &Event, &ioStatus);
        
        
        if (!pIrp) {
            ExFreePool(sBuf);
            return STATUS_INSUFFICIENT_RESOURCES;
        }
        
        status = IoCallDriver(pDevObj, pIrp);

        if (status == STATUS_PENDING) {
            KeWaitForSingleObject(&Event, Executive, KernelMode, FALSE,    NULL);
            status = ioStatus.Status;
        }
        ExFreePool(sBuf);

.......... 

Given above is just a sample code for sending a write operation to sector number 1169944.

Points of Interest

While writing the code, I was just doing a READ operation for verifying my results. I didn't take care while passing data buffer for write operations in the design (Please see driver code for more explanations). So I implemented an ugly hack for passing user mode buffer for write operations. I will improve it in future releases.

History

  • 2nd August, 2008: Initial post

License

This article, along with any associated source code and files, is licensed under The GNU General Public License (GPLv3)

Share

About the Author

dkg0414
Software Developer
India India
No Biography provided

Comments and Discussions

 
QuestionRead Muliple Sectors PinmemberAlistair Budd24-Mar-13 15:54 
AnswerRe: Read Muliple Sectors PinmemberMember 106914641-Apr-14 22:31 
QuestionC# Pinmembermr_rastegari4-Dec-12 6:46 
AnswerRe: C# Pinmembermr_rastegari3-Aug-13 1:06 
QuestionQuestion PinmemberRomTibi27-Jan-12 22:55 
QuestionWindows 7 x64 Pinmembercmleevt17-Nov-11 9:57 
GeneralHello If I want to read and write F: how to write the contents of disk! Pinmemberajmajm16-May-11 0:23 
GeneralLook at it from the other angle PinmemberWill228-Apr-11 2:15 
GeneralRead/Write 1-2 Bytes in MBR only PinmemberBrianPeterson19-Nov-09 19:44 
GeneralRe: Read/Write 1-2 Bytes in MBR only Pinmemberdkg041419-Nov-09 20:04 
QuestionRe: Read/Write 1-2 Bytes in MBR only [modified] PinmemberBrianPeterson25-Mar-10 15:10 
AnswerRe: Read/Write 1-2 Bytes in MBR only Pinmemberdkg041426-Mar-10 9:20 
GeneralRe: Read/Write 1-2 Bytes in MBR only PinmemberBrianPeterson26-Mar-10 11:05 
GeneralRe: Read/Write 1-2 Bytes in MBR only PinmemberBrianPeterson26-Mar-10 16:11 
Ok, I've am doing something wrong but not sure what. Confused | :confused: I've written this quick and simple 'hello world' driver Driver Entry routine to demonstrate my dillema.
 
Using the methods you suggested previously, I define the first disk device, then try to open it with ZwOpenFile (I figured ZwCreateFile will make one if it doesn't exist, not something we want to have happen, so I only want to open an existing device.) This is where the driver fails... status from the ZwOpenFile operation is '-1073741788' and file_status->status is '-2141904312', so obviously the operation didn't work. But I don't understand why, and more importantly how to fix it! Likewise it never gets to the ZwReadFile operation so that I can at least in WinDbg look at the MBR in the array to ensure it is correctly read, specifically looking quickly at the '55 AA' at the end.
 
#include "ntddk.h"
#include "ntddk.h"
#include "ntdddisk.h"
#include "stdarg.h"
#include "stdio.h"
#include <ntddvol.h>
#include <mountdev.h>
#include "ntstrsafe.h"
 
typedef unsigned char	BYTE, *PBYTE, *LPBYTE;
typedef int		BOOL, *PBOOL, *LPBOOL;
typedef BYTE		BOOLEAN, *PBOOLEAN;
typedef unsigned long	DWORD, *PDWORD, *LPDWORD;
typedef unsigned long	ULONG, *PULONG;
typedef unsigned short	WORD, *PWORD, *LPWORD;
typedef char		TCHAR;
typedef void		*PVOID;
typedef unsigned short	UINT2;
typedef unsigned int	UINT4;
 
// Driver Unload routine
VOID OnUnload( IN PDRIVER_OBJECT DriverObject)
{
	DbgPrint("OnUnload called!\n");
}
 
// Driver Entry routine
NTSTATUS DriverEntry( IN PDRIVER_OBJECT theDriverObject,
		      IN PUNICODE_STRING theRegistryPath )
{
	UNICODE_STRING		PhysicalDeviceName;
        WCHAR			PhysicalDeviceNameBuffer[64];
	ULONG			DiskNumber;
	HANDLE			MBR;
	IO_STATUS_BLOCK		ioStatus;
	NTSTATUS                status;
	IO_STATUS_BLOCK		file_status;
	OBJECT_ATTRIBUTES	obj_attrib;
	DWORD			disk_MBR[512] = {0x0};
 
	DbgPrint("I loaded!\n");
	// Initialize the pointer to the unload function
	// in the DriverObject
	theDriverObject->DriverUnload = OnUnload;
 
	DiskNumber = 0;//Hard coded for disk 0
        MBR = NULL;
 
	RtlStringCbPrintfW(PhysicalDeviceNameBuffer,
			sizeof(PhysicalDeviceNameBuffer),
			L"\\Device\\Harddisk%d", DiskNumber);
 
	RtlInitUnicodeString(&PhysicalDeviceName,
                             &PhysicalDeviceNameBuffer[0]);
	DbgPrint("Disk name %ws\n", PhysicalDeviceNameBuffer);
 
	InitializeObjectAttributes(&obj_attrib, 
                                   &PhysicalDeviceName,
				   OBJ_CASE_INSENSITIVE,
				   NULL,
				   NULL);
	status = ZwOpenFile(&MBR,
			GENERIC_READ | GENERIC_WRITE,
			&obj_attrib,
			&file_status,
			0,
			FILE_NON_DIRECTORY_FILE); 
/*The file is not a directory. The file object to open can represent 
 *a data file; a logical, virtual, or physical device; or a volume.*/
 
	if (status != STATUS_SUCCESS){
		DbgPrint("Failed to open the disk!\n");
		DbgPrint("Disk Status = %x\n", file_status);
	}
	else {
		DbgPrint("Successfully opened the disk.\n");
		DbgPrint("Disk Handle = %x\n", MBR);
	}
 
	// Read the MBR from raw disk 
	if (MBR != NULL){
		status = ZwReadFile(MBR,
				NULL,
				NULL,
				NULL,
				&ioStatus,
				disk_MBR,
				512,
				NULL,
				NULL);
		if (NT_SUCCESS(status)){
		     DbgPrint("Disk %d MBR read successfully.\n", DiskNumber);
		}
		else
		{
		     DbgPrint("Disk %d MBR read failed!\n", DiskNumber);
		}
	}
	return STATUS_SUCCESS;
}
 
Now I decided to see if it was just the "\\Device\Harddisk0" that had caused the failure, so I modified the driver to look at "\\Device\Harddisk0\DR0", and the device was successfully opened.
 
RtlStringCbPrintfW(PhysicalDeviceNameBuffer,
					sizeof(PhysicalDeviceNameBuffer),
					L"\\Device\\Harddisk%d\\DR0", DiskNumber);
 
However, now the ZwReadFile is failing with status '-1073741811', so even if you can open the disk in this manner, you still can't read it. Unless I'm still doing something wrong.
 
grrr..... Mad | :mad:
GeneralRe: Read/Write 1-2 Bytes in MBR only Pinmemberdkg041426-Mar-10 19:37 
GeneralRe: Read/Write 1-2 Bytes in MBR only [modified] PinmemberBrianPeterson26-Mar-10 19:59 
GeneralRe: Read/Write 1-2 Bytes in MBR only PinmemberBrianPeterson26-Mar-10 22:28 
GeneralRe: Read/Write 1-2 Bytes in MBR only Pinmemberdkg041427-Mar-10 0:22 
QuestionRe: Read/Write 1-2 Bytes in MBR only PinmemberBrianPeterson27-Mar-10 9:52 
GeneralDisk/Partition Sectors Pinmembertrlacey28-Oct-09 9:23 
GeneralRe: Disk/Partition Sectors Pinmemberdkg041429-Oct-09 21:11 
GeneralRe: Disk/Partition Sectors Pinmembertrlacey30-Oct-09 8:48 
GeneralRe: Disk/Partition Sectors Pinmemberdkg041431-Oct-09 21:29 
GeneralRe: Disk/Partition Sectors Pinmembertrlacey1-Nov-09 4:58 
GeneralRe: Disk/Partition Sectors Pinmemberdkg04141-Nov-09 19:35 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Terms of Use | Mobile
Web02 | 2.8.150224.1 | Last Updated 2 Aug 2008
Article Copyright 2008 by dkg0414
Everything else Copyright © CodeProject, 1999-2015
Layout: fixed | fluid