diff --git a/src/detection/diskio/diskio.c b/src/detection/diskio/diskio.c index cb452743e..7dc4e548b 100644 --- a/src/detection/diskio/diskio.c +++ b/src/detection/diskio/diskio.c @@ -48,7 +48,7 @@ const char* ffDetectDiskIO(FFlist* result, FFDiskIOOptions* options) FFDiskIOResult* icPrev = (FFDiskIOResult*)ffListGet(&ioCounters1, i); FFDiskIOResult* icCurr = (FFDiskIOResult*)ffListGet(result, i); if (!ffStrbufEqual(&icPrev->name, &icCurr->name)) - return "Network interface name changed"; + return "Physical disk name changed"; static_assert(sizeof(FFDiskIOResult) - offsetof(FFDiskIOResult, bytesRead) == sizeof(uint64_t) * 4, "Unexpected struct FFDiskIOResult layout"); for (size_t off = offsetof(FFDiskIOResult, bytesRead); off < sizeof(FFDiskIOResult); off += sizeof(uint64_t)) diff --git a/src/detection/diskio/diskio_windows.c b/src/detection/diskio/diskio_windows.c index 9acf739a3..0c2ed7b72 100644 --- a/src/detection/diskio/diskio_windows.c +++ b/src/detection/diskio/diskio_windows.c @@ -43,9 +43,9 @@ const char* ffDiskIOGetIoCounters(FFlist* result, FFDiskIOOptions* options) continue; FFDiskIOResult* device = (FFDiskIOResult*) ffListAdd(result); - ffStrbufInit(&device->name); - STORAGE_DEVICE_DESCRIPTOR* sdd = (STORAGE_DEVICE_DESCRIPTOR*) sddBuffer; + + ffStrbufInit(&device->name); if (sdd->VendorIdOffset != 0) { ffStrbufSetS(&device->name, (const char*) sddBuffer + sdd->VendorIdOffset); @@ -60,13 +60,6 @@ const char* ffDiskIOGetIoCounters(FFlist* result, FFDiskIOOptions* options) ffStrbufTrimRight(&device->name, ' '); } - ffStrbufInit(&device->serial); - if (sdd->SerialNumberOffset != 0) - { - ffStrbufSetS(&device->serial, (const char*) sddBuffer + sdd->SerialNumberOffset); - ffStrbufTrim(&device->serial, ' '); - } - if (options->namePrefix.length && !ffStrbufStartsWith(&device->name, &options->namePrefix)) { ffStrbufDestroy(&device->name); @@ -74,6 +67,28 @@ const char* ffDiskIOGetIoCounters(FFlist* result, FFDiskIOOptions* options) continue; } + DISK_PERFORMANCE dp = {}; + if (DeviceIoControl(hDevice, IOCTL_DISK_PERFORMANCE, NULL, 0, &dp, sizeof(dp), &retSize, NULL)) + { + device->bytesRead = (uint64_t) dp.BytesRead.QuadPart; + device->readCount = (uint64_t) dp.ReadCount; + device->bytesWritten = (uint64_t) dp.BytesWritten.QuadPart; + device->writeCount = (uint64_t) dp.WriteCount; + } + else + { + ffStrbufDestroy(&device->name); + result->length--; + continue; + } + + ffStrbufInit(&device->serial); + if (sdd->SerialNumberOffset != 0) + { + ffStrbufSetS(&device->serial, (const char*) sddBuffer + sdd->SerialNumberOffset); + ffStrbufTrim(&device->serial, ' '); + } + device->removable = !!sdd->RemovableMedia; ffStrbufInit(&device->interconnect); @@ -102,15 +117,6 @@ const char* ffDiskIOGetIoCounters(FFlist* result, FFDiskIOOptions* options) default: ffStrbufSetF(&device->interconnect, "Unknown (%d)", (int) sdd->BusType); break; } - DISK_PERFORMANCE dp = {}; - if (DeviceIoControl(hDevice, IOCTL_DISK_PERFORMANCE, NULL, 0, &dp, sizeof(dp), &retSize, NULL)) - { - device->bytesRead = (uint64_t) dp.BytesRead.QuadPart; - device->readCount = (uint64_t) dp.ReadCount; - device->bytesWritten = (uint64_t) dp.BytesWritten.QuadPart; - device->writeCount = (uint64_t) dp.WriteCount; - } - DEVICE_SEEK_PENALTY_DESCRIPTOR dspd = {}; if(DeviceIoControl( hDevice,