How do I get the disk drive serial number in filter driver?

Question

I write a driver in windows, and I need disk drive serial number, for user mode I found this ansver. My question is it possible to translate the above code to kernel mode, and how? Is WMI query available in filter driver? Sample code can greatly help.

EDIT:

I found here this code, but how I rewrite him for get serial number?

void GetSmbios()
{

    NTSTATUS status;
    GUID smbiosGUID = SMBIOS_DATA_GUID; // defined in wmiguid.h
    PVOID wmiObject = NULL;
    PWNODE_ALL_DATA dataBuffer;

    ULONG bufferSize;
    int TAG_SMBIOS = 'smbi';
    //
    // Get a WMI block handle to the SMBIOS_DATA_GUID
    //
    status = IoWMIOpenBlock((GUID *)&smbiosGUID, WMIGUID_QUERY,
        &wmiObject);
    if (!NT_SUCCESS(status)) 
    {
        return status;
    }

    //
    // Determine how much space is required for the data
    //
    status = IoWMIQueryAllData(wmiObject, &bufferSize, NULL);
    if (status != STATUS_BUFFER_TOO_SMALL) 
    {
        ObDereferenceObject(wmiObject);
        return status;
    }

    //
    // Allocate the necessary storage. This space must come out of NP-pool
    //
    dataBuffer = ExAllocatePoolWithTag(
        NonPagedPool,
        bufferSize,
        TAG_SMBIOS);

    if (dataBuffer == NULL) 
    {
        ObDereferenceObject(wmiObject);
        return STATUS_INSUFFICIENT_RESOURCES;
    }

}

score 1 · Answer 1 · answered Oct 13 '16 at 20:05

1

FILE_FS_VOLUME_INFORMATION contains field VolumeSerialNumber. This data structure might be retrieved with ZwQueryVolumeInformationFile(... FileFsVolumeInformation).

That requires a handle to the volume or a file/directory in the volume. If that's not feasible, but you have a DEVICE_OBJECT, you might try building your own IRP with IRP_MJ_QUERY_VOLUME_INFORMATION and sending it with IoCallDriver(), though I don't know if that's sanctioned -- the docs say such a "request is sent by the I/O Manager."

answered Oct 13 '16 at 20:05

asynchronos

583
2
14

I need **disk drive** serial number not **Volume** Serial Number. – codeDom Oct 13 '16 at 20:32
Sorry! Thought you were being imprecise. – asynchronos Oct 14 '16 at 05:40
This really saved the day for me! – Mecanik Apr 07 '20 at 13:00

score 1 · Accepted Answer · edited Mar 20 '17 at 10:18

After allocating memory, I believe you need to call IoWMIQueryAllData() again, this time passing dataBuffer.

SMBIOS doesn't seem related to disk drives, so you'll want a different GUID to pass to IoWMIOpenBlock(). Perhaps this one ({BF253431-1E4D-4F57-00E7-64B2CACC801E}), since your user-mode example and others query Win32_PhysicalMedia to get SerialNumber.

However, this references a (presumably user-mode) DLL that is the provider for Win32_PhysicalMedia. So this may not be accessible in kernel-mode.

But it also gives a hint how to get the information from kernel-mode: IOCTLs. It mentions IOCTL_SMART_GET_VERSION, which should be just SMART_GET_VERSION, and here's an example: (in user-mode, but you should be able to do similar from kernel-mode using ZwDeviceIoControlFile()). Note it follows up with another ioctl command, SMART_RCV_DRIVE_DATA, to get the serial number.

Another ioctl that sounds promising (and more general) is IOCTL_STORAGE_QUERY_PROPERTY, with the input STORAGE_PROPERTY_QUERY.PropertyId set to StorageDeviceProperty, so the output will be a STORAGE_DEVICE_DESCRIPTOR structure, which has field SerialNumberOffset:

Specifies the byte offset from the beginning of the structure to a null-terminated ASCII string that contains the device's serial number. If the device has no serial number, this member is zero.

Which worked for you: WMI, SMART_RCV_DRIVE_DATA, IOCTL_STORAGE_QUERY_PROPERTY or something else? — asynchronos, Oct 17 '16 at 19:44

How do I get the disk drive serial number in filter driver?

2 Answers2