HtsScsiView is a Windows 2000 scsi monitor application and kernel bus filter driver. Bus filtering is the third type of Plug and Play filter driver that can be implemented in Windows 2000. The other two types are Upper Filter Drivers and Lower Filter Drivers which come in the subflavors of Class Filter and Device Filter.

Upper and Lower filter drivers are moderately well documented in the NT ddk. Figuring out how to install a class filter driver is a bit of a puzzle, as the straightforward mechanism requires one to be the vendor of the filtered class, but once you read between the lines it all sort of makes sense.

The third type, bus filters, are mentioned in passing in the DDK, but other than the fact that they exist (and they do exist) no explanation at all is given. A bus filter driver is a PDO upper filter driver. It filters all the PDOs of a given bus driver, before these PDOs are attached to any PnP stack.

A prime example of where a bus filter driver comes in handy is the SCSI bus. Suppose that you wanted to monitor all SCSI activity on the system. There is no Upper Lower or Sideways filter driver that will do this, as each PDO created by ScsiPort potentially belongs to different PnP stacks based on the SCSI PnP enumeration ID of the PDO created by ScsiPort. What's a hacker to do?

Hollis Technology Solutions builds WDM drivers using our  exclusive WDM C++ class library: HTS genericWdmShell

HtsGenericWdmShell Class Library

Our object oriented solution to Wdm driver development simplifies the task of extending and modifying the Windows 2000 device driver architecture to support new devices or modify the behavior of existing devices and existing bus device drivers. As an example, our HtsScsiView application and driver filters all SCSI targets of any target type on the system, reporting SRB operations back to a simple GUI display.

Developing HtsScsiView required very little unique code. Most of the implementation is incorporated in our re-usable class library. The code developed for the SCSI request viewer dealt primarily with the interface to the data display application rather than the complexities of PnP state management.

The GenericWdmShell model overview

For a sample of the power of bus filtering, download HtsScsiView, a real time scsi bus filter driver and monitor application.

As always, please be aware that this is a test application that contains a kernel driver component. It should only be run on test systems, not on production systems.