作者ohnotme (来点造型)
看板C_Sharp
标题[问题] DeviceIoControl 如何连续写入?
时间Wed Apr 3 15:23:45 2019
大家好
小弟目前正在维护/开发一只程式，他可以对physical drive做write和read，想要透过这
支程式去模拟另一支程式的行为，想要去模拟的那支程式透过Bushound可以看到以下的行
为(简称A行为)
27 CMD 2a 00 00 89 30 00 00 04 00 00 WRITE
27 CMD 2a 00 00 89 34 00 00 04 00 00 WRITE
27 CMD 2a 00 00 89 38 00 00 04 00 00 WRITE
27 CMD 2a 00 00 89 3c 00 00 04 00 00 WRITE
27 OUT 03 30 89 00 03 00 00 00 04 30 89 00 03 00 00 00 05 30 89 00
.
.
.
一整段1KB的资料
27 OUT 03 30 89 00 03 00 00 00 04 30 89 00 03 00 00 00 05 30 89 00
.
.
.
一整段1KB的资料
27 OUT 03 30 89 00 03 00 00 00 04 30 89 00 03 00 00 00 05 30 89 00
.
.
.
一整段1KB的资料
27 OUT 03 30 89 00 03 00 00 00 04 30 89 00 03 00 00 00 05 30 89 00
.
.
.
一整段1KB的资料
看起来像是有4个动作
1. LBA 0x00893000写0x400个sector的资料
2. LBA 0x00893400写0x400个sector的资料
3. LBA 0x00893800写0x400个sector的资料
4. LBA 0x00893C00写0x400个sector的资料
可是实际去录下到device的行为却是只有一个动作
1. LBA 0x00893000写0x1000个sector的资料
目前我只能一次写64KB的资料，连续写4次的Bushound看起来像是这样(简称B行为)
13 CMD 2a 00 00 00 00 00 00 00 80 00 WRITE
13 OUT 7d 3b ef 84 7d 3b ef 84 7d 3b ef 84 7d 3b ef 84 7d 3b ef 84 7d 3b ef
.
.
.
一整段1KB的资料
13 CMD 2a 00 00 00 00 00 80 00 80 00 WRITE
13 OUT 7d 3b ef 84 7d 3b ef 84 7d 3b ef 84 7d 3b ef 84 7d 3b ef 84 7d 3b ef
.
.
.
一整段1KB的资料
13 CMD 2a 00 00 00 00 01 00 00 80 00 WRITE
13 OUT 7d 3b ef 84 7d 3b ef 84 7d 3b ef 84 7d 3b ef 84 7d 3b ef 84 7d 3b ef
.
.
.
一整段1KB的资料
13 CMD 2a 00 00 00 00 01 80 00 80 00 WRITE
13 OUT 7d 3b ef 84 7d 3b ef 84 7d 3b ef 84 7d 3b ef 84 7d 3b ef 84 7d 3b ef
.
.
.
一整段1KB的资料
没办法做到行为A的动作，就算真的连续下4次，device端录到的行为
也真的是分成4段长度为0x400 sector的写入动作
请问该如何做才能达到A行为的效果? 或是从哪里有参考资料可供学习，感激不尽!!
以下是小弟目前使用的程式码
[DllImport("kernel32.dll", CharSet = CharSet.Auto, CallingConvention =
CallingConvention.StdCall, SetLastError = true)]
public static extern bool DeviceIoControl(
SafeFileHandle hDevice,
int dwIoControlCode,
IntPtr lpInBuffer,
int nInBufferSize,
IntPtr lpOutBuffer,
int utBufferSize,
ref int lpBytesReturned,
IntPtr lpOverlapped
);
private Boolean SendCMD(byte OPCode, ref byte[] buf, long len, long addr, ref
int errorCode)
{
bool result = false;
SCSI_PASS_THROUGH_DIRECT_WITH_BUFFER sptwb = null;
sptwb = new SCSI_PASS_THROUGH_DIRECT_WITH_BUFFER((UInt32)(len * 512));
sptwb.sptd.Cdb[1] = 0x00;
sptwb.sptd.Cdb[2] = (byte)((addr >> 24) & 0xFF); // MSB of lba
sptwb.sptd.Cdb[3] = (byte)((addr >> 16) & 0xFF);
sptwb.sptd.Cdb[4] = (byte)((addr >> 8) & 0xFF);
sptwb.sptd.Cdb[5] = (byte)((addr) & 0xFF); // LSB of lba
sptwb.sptd.Cdb[6] = 0x00;
sptwb.sptd.Cdb[7] = (byte)((len >> 8) & 0xFF); // MSB of num blocks
sptwb.sptd.Cdb[8] = (byte)((len) & 0xFF); // LSB of num blocks
sptwb.sptd.Cdb[9] = 0x00;
sptwb.sptd.DataIn = SCSI_IOCTL_DATA_OUT;
Marshal.Copy(buf, 0, ptrBuf, (int)(len * 512));
sptwb.sptd.CdbLength = 10;
sptwb.sptd.Cdb[0] = OPCode;
sptwb.sptd.DataBuffer = ptrBuf;
int outByte = 0;
int inputSize =
Marshal.SizeOf(typeof(SCSI_PASS_THROUGH_DIRECT_WITH_BUFFER));
IntPtr input = Marshal.AllocHGlobal(inputSize);
Marshal.StructureToPtr(sptwb, input, true);
result = DeviceIoControl(m_hDrive, IOCTL_SCSI_PASS_THROUGH_DIRECT, input,
inputSize, input, inputSize, ref outByte, System.IntPtr.Zero);
return result;
}
--
※ 发信站: 批踢踢实业坊(ptt.cc), 来自: 211.20.115.247
※ 文章网址: https://webptt.com/cn.aspx?n=bbs/C_Sharp/M.1554276229.A.058.html
※ 编辑: ohnotme (211.20.115.247), 04/03/2019 15:26:45
※ 编辑: ohnotme (211.20.115.247), 04/03/2019 15:27:44