驱动查询设备总线类型

//这个函数适用于minifilter 

//这是所有的设备类型

typedef enum _STORAGE_BUS_TYPE
{
 BusTypeUnknown = 0x00,
 BusTypeScsi = 0x01,
 BusTypeAtapi= 0x02,
 BusTypeAta = 0x03,
 BusType1394= 0x04,
  BusTypeSsa = 0x05,
 BusTypeFibre = 0x06,
  BusTypeUsb= 0x07,
  BusTypeRAID= 0x08,
 BusTypeiSCSI = 0x09,
 BusTypeSas = 0x0A,
 BusTypeSata = 0x0B,
 BusTypeMaxReserved = 0x7F
}STORAGE_BUS_TYPE, 
 *PSTORAGE_BUS_TYPE;

BOOLEAN IsUsb(PFLT_VOLUME volume)
{
	NTSTATUS status;
	KEVENT WaitEvent;
	PIRP NewIrp;
	PSTORAGE_DEVICE_DESCRIPTOR Descriptor = NULL;
	CHAR pBuffer[sizeof(STORAGE_DEVICE_DESCRIPTOR)* 4];
	IO_STATUS_BLOCK IoStatus;
	STORAGE_PROPERTY_QUERY Query;
	PDEVICE_OBJECT DiskDeviceObject;
	 
	// DbgBreakPoint();
	status = FltGetDiskDeviceObject(volume, &DiskDeviceObject);//获取卷的磁盘设备指针
	if (NT_SUCCESS(status))
	{
	 
		KeInitializeEvent(&WaitEvent, NotificationEvent, FALSE);
		Query.PropertyId = StorageDeviceProperty;//StorageDeviceType;//
		Query.QueryType = PropertyStandardQuery;
		//IOCTL_STORAGE_MEDIA_REMOVAL
		NewIrp = IoBuildDeviceIoControlRequest(IOCTL_STORAGE_QUERY_PROPERTY, DiskDeviceObject,
			(PVOID)&Query, sizeof(STORAGE_DEVICE_DESCRIPTOR), (PVOID)pBuffer,
			sizeof(STORAGE_DEVICE_DESCRIPTOR)* 4, FALSE, &WaitEvent, &IoStatus);
		if (NULL == NewIrp)   // can't create new irp
		{ 
			ObDereferenceObject(DiskDeviceObject);
			return FALSE;
		}
		else
		{
			status = IoCallDriver(DiskDeviceObject, NewIrp);

			if (status == STATUS_PENDING)
			{
				status = KeWaitForSingleObject(&WaitEvent, Executive, KernelMode, FALSE, NULL);
				status = IoStatus.Status;
			}
			if (!NT_SUCCESS(status))
			{
				ObDereferenceObject(DiskDeviceObject);
				return FALSE;
			}
			else
			{
				Descriptor = (PSTORAGE_DEVICE_DESCRIPTOR)pBuffer;
				ObDereferenceObject(DiskDeviceObject);
				return Descriptor->BusType == BusTypeUsb;
			}

		}
	}
 
	return FALSE;
}