title: How to interface with the NT mount manager to assign a driveletter?
body: <p>I'm attempting to replace some legacy <code>DefineDosDevice</code> userspace code (which doesn't work on Vista with Administrator users due to the fact that the elevated and normal session are represented by different DosDevice stores, therefore creating the rather strange scenario that the drive is visible if created from unelevated processes, but invisible if created from an elevated process).</p>
  
  <p>The replacement for this, as I've found out through examining the <a href="http://www.truecrypt.org/" rel="nofollow">Truecrypt source</a> and this <a href="http://code.msdn.microsoft.com/VirtualVolume-83334efd" rel="nofollow">WDM sample</a> is to issue <code>IOCTL_MOUNTMGR_VOLUME_ARRIVAL_NOTIFICATION</code> messages to mountmgr.sys and then <code>IOCTL_MOUNTMGR_CREATE_POINT</code> / <code>IOCTL_MOUNTMGR_DELETE_POINT</code>.</p>
  
  <p>So this is what I'm doing - my code looks like this:</p>
  
  <p>Firstly, various locals:</p>
  
  <pre><code>NTSTATUS ntStatus;
  PDEVICE_EXTENSION device_extension;
  UNICODE_STRING uVolumeName;
  
  ULONG mntNameLen = 0;
  ULONG mntPointLen = 0;
  PMOUNTMGR_TARGET_NAME mntName = NULL;
  PMOUNTMGR_CREATE_POINT_INPUT mntPoint =  NULL;
  </code></pre>
  
  <p>Then, I construct and make my two requests. The first fails with the above status code. The second fails with a different status code (but isn't expected to work if the first fails).</p>
  
  <pre><code>mntNameLen = sizeof(MOUNTMGR_TARGET_NAME) + device_extension-&gt;sDevName.Length;
  mntName = ExAllocatePool(PagedPool, mntNameLen);
  
  mntName-&gt;DeviceNameLength = device_extension-&gt;sDevName.Length;
  RtlCopyMemory(mntName-&gt;DeviceName, device_extension-&gt;sDevName.Buffer, 
                mntName-&gt;DeviceNameLength);
  
  ntStatus = MakeDeviceIoRequest (MOUNTMGR_DEVICE_NAME, 
      IOCTL_MOUNTMGR_VOLUME_ARRIVAL_NOTIFICATION,
      mntName, mntNameLen, 0, 0);
  
  mntPointLen = sizeof(PMOUNTMGR_CREATE_POINT_INPUT) + 
      device_extension-&gt;sDevName.Length + uVolumeName.Length;
  mntPoint = ExAllocatePool(PagedPool, mntPointLen);
  
  mntPoint-&gt;SymbolicLinkNameOffset = sizeof (MOUNTMGR_CREATE_POINT_INPUT);
  RtlCopyMemory(&amp;mntPoint+mntPoint-&gt;SymbolicLinkNameOffset, 
      uVolumeName.Buffer, uVolumeName.Length * sizeof(WCHAR));
  mntPoint-&gt;SymbolicLinkNameLength = uVolumeName.Length;
  
  mntPoint-&gt;DeviceNameOffset = mntPoint-&gt;SymbolicLinkNameOffset + 
      mntPoint-&gt;SymbolicLinkNameLength;
  RtlCopyMemory(&amp;mntPoint+mntPoint-&gt;DeviceNameOffset, 
      device_extension-&gt;sDevName.Buffer, device_extension-&gt;sDevName.Length);
  mntPoint-&gt;DeviceNameLength = device_extension-&gt;sDevName.Length;
  
  ntStatus = MakeDeviceIoRequest(MOUNTMGR_DEVICE_NAME, 
      IOCTL_MOUNTMGR_CREATE_POINT, mntPoint,
  mntPointLen, 0, 0);
  </code></pre>
  
  <p>Then I create the symbolic link \GLOBAL??\L: -> \Device\DeviceName</p>
  
  <pre><code>ntStatus = IoCreateSymbolicLink(&amp;uVolumeName, &amp;(device_extension-&gt;sDevName));
  DbgPrint("Mapped %wZ -&gt; %wZ\n", &amp;uVolumeName, &amp;(device_extension-&gt;sDevName));
  RtlFreeUnicodeString(&amp;uVolumeName);
  if ( mntName != NULL )
  {
      ExFreePool(mntName);
  }
  if ( mntPoint != NULL)
  {
      ExFreePool(mntPoint);
  }
  </code></pre>
  
  <p>However, the <code>ntStatus</code> response from the mount manager is <code>0xC0000010</code> <code>STATUS_INVALID_DEVICE_REQUEST</code>; my device string is of the form <code>\Device\DevName</code> and responds to each of:</p>
  
  <ul>
  <li>IOCTL_VOLUME_ONLINE</li>
  <li>IOCTL_MOUNTDEV_QUERY_SUGGESTED_LINK_NAME</li>
  <li>IOCTL_MOUNTDEV_QUERY_UNIQUE_ID</li>
  <li>IOCTL_MOUNTDEV_QUERY_DEVICE_NAME</li>
  </ul>
  
  <p>and a list of other IOCTLs expected for a storage device. However, I have breakpoints set on all these routines and none of them are reached.</p>
  
  <p>My Device is created via this little snippet:</p>
  
  <pre><code>// Security descriptor
  RtlInitUnicodeString(&amp;sddl,
       _T("D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;GA;;;BU)(A;;GA;;;WD)"));
  
  // named device
  status = IoCreateDeviceSecure(
      DriverObject, 
      sizeof(DEVICE_EXTENSION),
      &amp;device_name,     // \Device\DeviceName
      DeviceType,       // valid devicetype.
      0,
      FALSE,
      &amp;sddl,            // security descriptor
      NULL,             // no idea what this does.
      &amp;device_object    // output device object.
  );
  </code></pre>
  
  <p>So, then, down to some questions:</p>
  
  <ol>
  <li>Am I creating the messages for the mount manager correctly? The call MakeDeviceIoRequest basically wraps <code>IoCallDriver</code> and I'm reasonably confident that is not the problem.</li>
  <li>Is anything I'm doing with <code>CreateDevice</code> a problem? I ask because I read <a href="https://blogs.msdn.com/b/doronh/archive/2007/04/18/having-two-names-is-not-necessarily-better-than-one.aspx?Redirected=true" rel="nofollow">this blog post</a> which implies something about device names, FDOs and PDOs that I honestly don't quite understand.</li>
  <li>If I appear to be in way too deep, any chance of a clarification on my understanding of how this all works?</li>
  </ol>
  
  <p><em>Notes</em>: I have some restrictions. The code I am building on top of is fairly legacy, so I'm including <code>ntddk.h and wdmsec.h</code>; I can't change these to <code>wdm.h</code> or <code>ntifs.h</code> at this stage.</p>