ArsenalRecon / Arsenal-Image-Mounter

Arsenal Image Mounter mounts the contents of disk images as complete disks in Microsoft Windows.
https://ArsenalRecon.com/weapons/image-mounter
Other
531 stars 89 forks source link

Is it possible to change the properties of a mounted disk? #49

Closed adlemx closed 4 weeks ago

adlemx commented 1 month ago

Is it possible to change the serial number and model (same as device name) of the disk that is mounted using AIM? Currently the disk model is listed as Arsenal Virtual SCSI Disk Device, and the s/n is a random uuid

LTRData commented 1 month ago

No, sorry, the logic for this is hard coded in the driver.

adlemx commented 1 month ago

Are you talking about phdskmnt.sys? What if I change it in the sources and compile it manually?

LTRData commented 1 month ago

Yes that's right. I think it should be fairly easy to make that change. There is a code path that is used to generate a unique id here: https://github.com/ArsenalRecon/Arsenal-Image-Mounter/blob/7e0fd50ffff13a6da1691e6dc60241e3b690083e/Unmanaged%20Source/phdskmnt/iodisp.cpp#L2235

adlemx commented 1 month ago

Thanks, I found this line of code, but it seems like the disk name should be the same as the image name, but it's not. https://github.com/ArsenalRecon/Arsenal-Image-Mounter/blob/7e0fd50ffff13a6da1691e6dc60241e3b690083e/Unmanaged%20Source/phdskmnt/iodisp.cpp#L2155 I also tried searching for "Arsenal Virtual SCSI Disk Device" throughout the solution, but I couldn't find anything. Can you please tell me where the device name is set?

LTRData commented 1 month ago

Thanks, I found this line of code, but it seems like the disk name should be the same as the image name, but it's not. https://github.com/ArsenalRecon/Arsenal-Image-Mounter/blob/7e0fd50ffff13a6da1691e6dc60241e3b690083e/Unmanaged%20Source/phdskmnt/iodisp.cpp#L2155

"File name" in this context is not related to the image file name if the actual image file is opened and handled by a user mode library. In such cases, the driver has no knowledge of the image file and this file name is rather the "file" used for communication between kernel level driver and the user mode backend.

I also tried searching for "Arsenal Virtual SCSI Disk Device" throughout the solution, but I couldn't find anything. Can you please tell me where the device name is set?

Those strings are defined here: https://github.com/ArsenalRecon/Arsenal-Image-Mounter/blob/7e0fd50ffff13a6da1691e6dc60241e3b690083e/Unmanaged%20Source/phdskmnt/inc/phdskmnt.h#L94

adlemx commented 4 weeks ago

Those strings are defined here:

https://github.com/ArsenalRecon/Arsenal-Image-Mounter/blob/7e0fd50ffff13a6da1691e6dc60241e3b690083e/Unmanaged%20Source/phdskmnt/inc/phdskmnt.h#L94

Thanks, but in this file I found only symbols "Arsenal" and "Virtual", although I can find other symbols: "SCSI", "Disk" and "Device"

And I have a lot of errors when I try to build phdskmnt, is there any instruction on how to build it?

LTRData commented 4 weeks ago

The string "SCSI Disk Device" must be from somewhere else. Where did you see that? What application showed that string? It is likely just a description of a device class or something like that.

LTRData commented 4 weeks ago

As for the build, you need to have WDK for Windows 10 installed and then in project properties point it to use the same WDK build toolchain as you have installed.

adlemx commented 4 weeks ago

The string "SCSI Disk Device" must be from somewhere else. Where did you see that? What application showed that string? It is likely just a description of a device class or something like that.

It shows up in the wmiс and in the device manager. image

I need the full model name of the drive to be equal to WDC WD40EZRZ-75GXCB0, is this possible?

LTRData commented 4 weeks ago

You would need a completely different kind of driver for that. A SCSI miniport like AIM would not be sufficient to control in detail what kind of device you create in that way. You can only chose between some SCSI device types and "SCSI Disk Device" is the only one that will emulate a disk.

You see the same behavior for the device below it, the ITGZ NvME that most probably also uses a simple SCSI miniport driver to emulate a SCSI disk using an NvME memory card. It also shows as a "SCSI Disk Device", because that is essentially what it is to the operating system.

LTRData commented 4 weeks ago

You can use my devioctl tool at https://ltr-data.se/files/win64/devioctl64.zip to see the properties that a disk driver actually returns for a disk.

For example: devioctl storprop C: or something like: devioctl storprop physicaldrive1

adlemx commented 4 weeks ago

image Yes, thanks, I understand. Is there any other virtual device driver in which you can completely change the model and s/n?

LTRData commented 4 weeks ago

I am not sure but I imagine there are probably not that many available. To for example emulate SATA instead of SCSI Disk also means a bit different behavior in various ways, so it is not as simple as just changing a device type flag or similar.

adlemx commented 4 weeks ago

Can you please name at least one project that can emulate sata? I tried searching but couldn't find a single one

LTRData commented 4 weeks ago

No, I do not know of any myself. Also, it seems it could be very difficult to implement it as a SATA miniport driver because of lack of the concept of "virtual miniport" for SATA port driver as opposed to Storport port driver (for SCSI). So, you might need to create a complete port driver yourself with the device properties you want.

adlemx commented 4 weeks ago

Thanks for the advice, I think this issue can be closed