Bug Hunter Diary

[..][..]//// Current stack location - contains a pointer to the current// IO_STACK_LOCATION structure in the IRP stack. This field// should never be directly accessed by drivers. They should// use the standard functions.//struct _IO_STACK_LOCATION *CurrentStackLocation;The layout of the _IO_STACK_LOCATION structure is shown below (seentddk.h of the Windows Driver Kit):[..]typedef struct _IO_STACK_LOCATION {UCHAR MajorFunction;UCHAR MinorFunction;UCHAR Flags;UCHAR Control;[..]//// System service parameters for: NtDeviceIoControlFile//// Note that the user's output buffer is stored in the// UserBuffer field// and the user's input buffer is stored in the SystemBuffer// field.//[..]struct {ULONG OutputBufferLength;ULONG POINTER_ALIGNMENT InputBufferLength;ULONG POINTER_ALIGNMENT IoControlCode;PVOID Type3InputBuffer;} DeviceIoControl;In addition to the IoControlCode of the requested IOCTL, thisstructure contains information about the size of the input and outputbuffer. Now that I had more information about the _IO_STACK_LOCATIONstructure, I took a second look at the disassembly:[..].text:0001098C ; int __stdcall sub_1098C(int, PIRP Irp).text:0001098C sub_1098C proc near ; DATA XREF: DriverEntry+130[..].text:000109B2 mov ebx, [ebp+Irp] ; ebx = address of IRP.text:000109B5 mov eax, [ebx+60h] ; eax = address of CurrentStackLocation.text:000109B8 mov esi, [eax+8] ; ULONG InputBufferLength.text:000109BB mov [ebp+var_1C], esi ; save InputBufferLength in var_1C.text:000109BE mov edx, [eax+4] ; ULONG OutputBufferLength96 Chapter 6