Hi Guys,

I've an application that formats removable usb drive through SCSI interface,
this has worked for me for years including on Win2k,WinXP,Win2003 and Vista
build 5600. But since Vista build 5728 something has broken.

Below is a sample application that reproduces our problem.

What it does is writing 100 times “Hello World!” data string on sector 108
through SCSI interface. The results that we see is that majority of the
writes on the sector fail(see attached screenshot) and even the ones that
claim to succeed write garbage data and not the “Hello World!”.

Something that we noted, and have no explanation about is that if we write
on sectors between range of 0..N-1 where N is the start sector of the first
partition, everything works fine, but N and above we get this inconsistency.

I hope you will be able to help me with this issue.

Thanks in advance,

John

----- CUT ----
// ScsiSample.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include <Windows.h>
#include <string>
#include <tchar.h>
#include "ntddscsi.h" //From the DDK

#define WRITE_10 0x2a


#ifdef UNICODE
typedef std::wstring tstring;
#else
typedef std::string tstring;
#endif

#define SB_LENGTH 32
#pragma pack(push,1)
typedef struct _SCSI_PASS_THROUGH_DIRECT_WITH_BUFFER
{
SCSI_PASS_THROUGH_DIRECT sptd;
ULONG Filler;
UCHAR ucSenseBuf[SB_LENGTH];
} SCSI_PASS_THROUGH_DIRECT_WITH_BUFFER,
*PSCSI_PASS_THROUGH_DIRECT_WITH_BUFFER;
#pragma pack(pop)

HANDLE open(const TCHAR* deviceName)
{
return CreateFile(deviceName,GENERIC_READ | GENERIC_WRITE,
FILE_SHARE_WRITE | FILE_SHARE_READ,
NULL, OPEN_EXISTING,
FILE_FLAG_WRITE_THROUGH | FILE_FLAG_NO_BUFFERING, //Flags;
NULL);

}

bool dok_lock(HANDLE handle)
{
unsigned long ulRetData;
return
DeviceIoControl(handle,FSCTL_LOCK_VOLUME,NULL,0,NULL,0,&ulRetData,NULL) !=
0;
}


bool dok_unlock(HANDLE handle)
{
unsigned long ulRetData;
return
DeviceIoControl(handle,FSCTL_UNLOCK_VOLUME,NULL,0,NULL,0,&ulRetData,NULL) !=
0;
}

bool dok_umount(HANDLE handle)
{
unsigned long ulRetData;
return
DeviceIoControl(handle,FSCTL_DISMOUNT_VOLUME,NULL,0,NULL,0,&ulRetData,NULL)
!= 0;
}

bool dok_umount(const TCHAR* deviceName)
{
HANDLE handle = open(deviceName);
if (handle == INVALID_HANDLE_VALUE)
{
_tprintf(_T("dok_umount Failed in CreateFile le=%u\n"),GetLastError());
return false;
}

unsigned long ulRetData = 0;
BOOL bResult =
DeviceIoControl(handle,FSCTL_DISMOUNT_VOLUME,NULL,0,NULL,0,&ulRetData,NULL)
;
CloseHandle(handle);
return bResult != 0;
}


//This program write a text in sector 108 (physical address) on the device
int _tmain(int argc, _TCHAR* argv[])
{
if (argc != 2)
{
_tprintf(_T("Usage %s <drive letter>\n"),argv[0]);
return 1;
}

tstring path = tstring(_T("\\\\.\\")) + *argv[1] + tstring(_T(":"));
HANDLE hFile = open(path.c_str());
if (hFile == INVALID_HANDLE_VALUE)
{
_tprintf(_T("Failed in CreateFile le=%u\n"),GetLastError());
return 2;
}

if (!dok_lock(hFile))
{
_tprintf(_T("Failed in FSCTL_LOCK_VOLUME le=%u\n"),GetLastError());
return 2;
}

if (!dok_umount(hFile))
{
_tprintf(_T("Failed in FSCTL_DISMOUNT_VOLUME le=%u\n"),GetLastError());
return 2;
}



// write 100 times "Hello World" in sector 108 (physical address) on the
device
for(int i = 0; i < 100; i ++)
{
//Constrcut SCSCI command.
#define CDB_SIZE 10 // the size of the command
BYTE CDB[CDB_SIZE];
ZeroMemory(CDB, sizeof CDB);

size_t nSectorOffset = 108; //We write at sector "108"

CDB[0] = WRITE_10;
CDB[1] = 0;
CDB[2] = (BYTE)((nSectorOffset>>24)&0xff);
CDB[3] = (BYTE)((nSectorOffset>>16)&0xff);
CDB[4] = (BYTE)((nSectorOffset>>8) &0xff);
CDB[5] = (BYTE)((nSectorOffset) &0xff);
CDB[8] = 1; //How many sector to write


SCSI_PASS_THROUGH_DIRECT_WITH_BUFFER scsiBuff;

memset(&scsiBuff, 0, sizeof(SCSI_PASS_THROUGH_DIRECT_WITH_BUFFER));

// We use VirtualAlloc so the data will be aligned on page boundry
char* DATA_TO_WRITE = (char*)
VirtualAlloc(NULL,512,MEM_COMMIT,PAGE_READWRITE);
DWORD numWritten = 0;
strcpy(DATA_TO_WRITE, "Hello World!");

scsiBuff.sptd.DataTransferLength = 512;
scsiBuff.sptd.DataBuffer = DATA_TO_WRITE;
scsiBuff.sptd.CdbLength = CDB_SIZE;
scsiBuff.sptd.Length = sizeof(SCSI_PASS_THROUGH_DIRECT);
scsiBuff.sptd.PathId = 0;
scsiBuff.sptd.TargetId = 1;
scsiBuff.sptd.Lun = 0;
scsiBuff.sptd.SenseInfoLength = SB_LENGTH;
scsiBuff.sptd.TimeOutValue = 10;
scsiBuff.sptd.SenseInfoOffset =
offsetof(SCSI_PASS_THROUGH_DIRECT_WITH_BUFFER, ucSenseBuf);

memcpy(scsiBuff.sptd.Cdb, CDB, min(CDB_SIZE, 16));

size_t nDataLen = sizeof(SCSI_PASS_THROUGH_DIRECT_WITH_BUFFER);

DWORD retSize = 0;

BOOL bStatus = DeviceIoControl(
hFile,
IOCTL_SCSI_PASS_THROUGH_DIRECT,
&scsiBuff,
nDataLen,
&scsiBuff,
nDataLen,
&retSize,
NULL
);


if (bStatus)
{
printf("Test succeeded %d\n",i);
}
else
{
printf("Test %d failed DeviceIoControl returned %u\n",i, GetLastError());
}
}


if (!dok_unlock(hFile))
{
_tprintf(_T("Failed in FSCTL_UNLOCK_VOLUME le=%u\n"),GetLastError());
return 2;
}


CloseHandle(hFile);

return 0;
}