How to construct a simple filter driver for USB

**Appaji** · 21-02-2010

Hi all,

I want to know that how to construct a simple USB Filter Drivers Procedures, including the "basic principles", "process to achieve", "use INF installation". I can use among the most popular and most other DDK driver development tools Driver Studio convenient to implement its own filtering driver, and correctly installed but not successed. Anybody have any idea about that construct a simple filter driver for USB. Please suggest.

**Praetor** · 21-02-2010

My procedure is to make a small HID driver hidusb.sys the Lower Filter, it is attached to the "Human Interface Device", by blocking USB-Get_Report_Descriptor to modify its return value, when it found that the Descriptor of the Usage of "Keyboard" when the , to read "UserDefined", so that we can take complete control of only the keyboard. In practice, intercept IRP_MJ_INTERNAL_DEVICE_CONTROL, and to check its IOCTL code and URB, if the function code for the IOCTL_INTERNAL_USB_SUBMIT_URB and IOCTRL function code for URB's URB_FUNCTION_GET_DESCRIPTOR_FROM_INTERFACE condition that the upper drive sent Get_Report_Descriptor request, set a completion routine, in the completion of cases of process, we will judge the value of Usage would Usage by "6 (Keyboard)", it will be renamed the "0 (UserDefined)". Check that and reply.

**Katty** · 21-02-2010

AddDevice role is to construct a filter instance. The key code in Device class. In this class, we have to insert the device stack filter and block IRP, complete with their own routines to achieve a particular function.

Code:

UsbFilterDevice:: UsbFilterDevice (PDEVICE_OBJECT Pdo, ULONG Unit123):
          KWdmFilterDevice (Pdo123, NULL)
{
          T << "UsbFilterDevice:: UsbFilterDevice \ n";
          if (! NT_SUCCESS (m_ConstructorStatus))
　　 {
          return;
　　 }
          m_Unit = Unit;
          m_Usb.Initialize (this, Pdo);
          NTSTATUS status = AttachFilter (& m_Usb); 
          if (! NT_SUCCESS (status))
　　　　 {
          m_ConstructorStatus123 = status;
          return;
　　　　 }
          SetFiltERPowerPolicy ();
          SetFilterPnpPolicy ();
}

**kelfro** · 21-02-2010

HIDUSB.SYS is to use the internal issue of URB to the USB class IOCTRL Drivers Program (USBD) to read the data, then, HIDUSB must first construct a IRP_MJ_INTERNAL_DEVICE_CONTROL, it IOCTL function code is IOCTL_INTERNAL_USB_SUBMIT_URB that issued by URB internal IOCTL. In addition, because we have to check and modify the USB Keyboard The report describes an interface, then the URB should be. Best of luck.

Code:

NTSTATUS Usb Filter Device:: InternalDeviceControl (KIrp I)
{ 
          T << "UsbFilterDevice:: InternalDeviceControl123 \ n";
          if (I. IoctlCode ()! = IOCTL_INTERNAL_USB_SUBMIT_URB)
          return DefaultPnp (I);
          PURB p = I. Urb (CURRENT); 
          if (p-> UrbHeader.Function! =
URB_FUNCTION_GET_DESCRIPTOR_FROM_INTERFACE)
          return DefaultPnp123 (I);
          return PassThrough (I, LinkTo (DeviceControlComplete123), this);
}

**Zecho** · 21-02-2010

we will use IoAttachDevice device objects inserted in the device stack. Driver Studio encapsulates this function. The Driver Studio, other Drivers Programs need to use Initialize to initialize device objects and interfaces for the filter driver, the key is that we need to Attach filter be attached to the stack. Best of luck.