completely disable usb storage...write a mini filter driver ?

hello,

our software goes in schools and some teachers have requested that they be
able to enable/disable usb sticks. this is becasue the kids keep bringing in
locked down exes such as firefox on usb stick.

i have already written a mini filter driver for keyboard and mouse using the
samples in the WDK (7600). i just needed these devices to be enabled/disabled
too and i do so by dropping all the packets in the ServiceCallback. i made it
apply to all keyboards and mouses by installing the two drivers at class
level in the registry.

so now i am looking to do the same for usb sticks. all i really need is for
the usb mini filter driver to prevent reading/writing/copying/pasting. so
again this must be applied to all usb sticks, at the class level. there are a
few usb samples out there, usbsamp, osrusbfx2, toaster - which is the best
starting point for me to do this ?

Just disable the USBSTOR service.

--
Maxim S. Shatskih
Windows DDK MVP

http://www.storagecraft.com

"unclepauly" <> wrote in message news:8B0E7F2E-EF5F-4B43-AE2F-...
> hello,
>
> our software goes in schools and some teachers have requested that they be
> able to enable/disable usb sticks. this is becasue the kids keep bringing in
> locked down exes such as firefox on usb stick.
>
> i have already written a mini filter driver for keyboard and mouse using the
> samples in the WDK (7600). i just needed these devices to be enabled/disabled
> too and i do so by dropping all the packets in the ServiceCallback. i made it
> apply to all keyboards and mouses by installing the two drivers at class
> level in the registry.
>
> so now i am looking to do the same for usb sticks. all i really need is for
> the usb mini filter driver to prevent reading/writing/copying/pasting. so
> again this must be applied to all usb sticks, at the class level. there are a
> few usb samples out there, usbsamp, osrusbfx2, toaster - which is the best
> starting point for me to do this ?

by this i think you mean setting the USBSTOR reg key to 4, thereby disabling
usbstor.sys ? this is fine for installed usb sticks, but as soon as you
insert a new one (ie one that requires installing) it gets set back to 4...


"Maxim S. Shatskih" wrote:

> Just disable the USBSTOR service.
>
> --
> Maxim S. Shatskih
> Windows DDK MVP
>
> http://www.storagecraft.com
>
> "unclepauly" <> wrote in message news:8B0E7F2E-EF5F-4B43-AE2F-...
> > hello,
> >
> > our software goes in schools and some teachers have requested that they be
> > able to enable/disable usb sticks. this is becasue the kids keep bringing in
> > locked down exes such as firefox on usb stick.
> >
> > i have already written a mini filter driver for keyboard and mouse using the
> > samples in the WDK (7600). i just needed these devices to be enabled/disabled
> > too and i do so by dropping all the packets in the ServiceCallback. i made it
> > apply to all keyboards and mouses by installing the two drivers at class
> > level in the registry.
> >
> > so now i am looking to do the same for usb sticks. all i really need is for
> > the usb mini filter driver to prevent reading/writing/copying/pasting. so
> > again this must be applied to all usb sticks, at the class level. there are a
> > few usb samples out there, usbsamp, osrusbfx2, toaster - which is the best
> > starting point for me to do this ?
> .
>

i hope people are still watching this thread....

Doran - i am trying to do what you said above by using the diskperf sample
to get me started. i have built the diskperf.sys file using an xp checked
environment and copied the .sys file to system32/drivers. then i created the
service in the registry:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\diskperf]
Type : 0x0000001
Start : 0x0000003
ErrorControl : 0x0000001
ImagePath : "system32\drivers\diskperf.sys"
Group : "PnP Filter"

then i set the UpperFilters of the DiskDrive class
(4D36E967-E325-11CE-BFC1-08002BE10318) to be:

diskperf
PartMgr

(PartMgr was already there)

after doing a reboot the OS crashes and i have to go into last known working
system to get it back. if i try safe mode i see it hanging on diskperf.sys
before it crashes.

all i have done is build the sample from the WDK - do you know what could be
the problem here ?

as an aside, if you think the diskperf sample is the wrong way to go please
let me know of a better alternative.
thank you.

damn it, im very sorry i had a typo in my diskperf service so ignore my last
post - i set startup type to 3 instead of 0.....its working now. anyway if
you think this is still the wrong way to go (there is a better sample) please
let me know.
grateful for your help

Doran (or anyone else who can help) - i have been playing with the AddDevice
function - you said above that in AddDevice i can check if the device is on a
USB bus - how to do this ? i assume i will need to do this before
IoCreateDevice, which is the first thing that happens. So i am guessing that
some member of either DRIVER_OBJECT or DEVICE_OBJECT can identify the device
as usb - but i cannot work out how to do this.

thank you.

"unclepauly" <> wrote in message
news:014C185F-EEB2-48B8-B930-...
> damn it, im very sorry i had a typo in my diskperf service so ignore my
> last
> post - i set startup type to 3 instead of 0.....its working now. anyway if
> you think this is still the wrong way to go (there is a better sample)
> please
> let me know.
> grateful for your help

Now, if you catch one more typo, your chances to get help may improve

Why so many questions about filters at all?
You just need to disable usbstor, this does not involve messing with
filters.
--pa

Pavel - yes, disabling the usbstor is the advice that i have been given. by
disabling the usbstor, i assume you are all talking about setting the reg
'start' key to 4. however we have found that this does not always work, and
that we sometimes still able to use usb sticks on the machine. i think it was
when we inserted a stick that was not currently installed, the reg key got
set back 3...so now you will tell me to prevent new sticks from being
installed ! yes we could do that but ideally we want something that can just
enable/disable usb sticks at the click of a button, just like i have already
done for keyboard and mouse, using the WDK samples. so a filter it is, and if
i use Doran's suggestion i can trap usb sticks in the AddDevice function and
give IoCreateDevice some random value so that it doesnt create it as
storage.....it has taken a few days to get soemthing up and running, but i
think the end result will do exactly what we want....