• edit the file C:\storport\storage\port\raid\port\power.c and change the function RaidUnitSetPowerIrp so that it does not trigger the if in case of PowerSystemShutdown

• edit the file C:\storport\storage\port\raid\port\power.c and change the function RaidUnitSetSystemPowerIrp to

• edit the file C:\storport\storage\port\raid\port\unit.c and change the function RaUnitFlushQueueSrb to

• unpack the following directories from leaked source code archive nt5src.7z to C:\storport_orig:
• nt5src\Source\Win2K3\NT\drivers\inc
• nt5src\Source\Win2K3\NT\drivers\storage
• right click C:\storport_orig in Windows Explorer > Properties > uncheck "Read-only" > Apply > Apply changes to this folder, subfolders and files > 2 x OK
• copy C:\storport_orig to C:\storport
• delete the following files:
• C:\storport\inc\volmgr.h
• C:\storport\inc\volmgrx.h
• delete all directories in C:\storport\storage except the port directory
• delete the following directories:
• C:\storport\storage\port\diskdump
• C:\storport\storage\port\scsi
• C:\storport\storage\port\lib\ia64
• C:\storport\storage\port\raid\ext
• C:\storport\storage\port\raid\test
• copy C:\storport\storage\port\raid\port\raidport.src to C:\storport\storage\port\raid\port\raidport.def
• edit the file C:\storport\storage\port\raid\port\raidport.def and apply the following changes:
• remove the comment section at the start of the file
• remove the two comments at the end of the file
• remove the _AMD64_ definition
• edit the file C:\storport\storage\dirs and remove all listed directories except port
• edit the file C:\storport\storage\port\dirs and remove scsi and diskdump
• edit the file C:\storport\storage\port\raid\dirs and remove miniport
• edit the file C:\storport\storage\port\lib\precomp.h and correct the include path for portlib.h to
  #include <..\..\..\inc\portlib.h>
• edit the file C:\storport\storage\port\raid\port\precomp.h and correct the include path for portlib.h to
  #include "..\..\..\..\..\inc\portlib.h"
• edit the file C:\storport\storage\port\raid\port\sources and change LINKLIBS and DLLDEF to

LINKLIBS=$(DDK_LIB_PATH)\hal.lib        \
         $(DDK_LIB_PATH)\ntoskrnl.lib   \
         ..\storlib\$(O)\storlib.lib   \
         ..\..\lib\$(O)\portlib.lib
DLLDEF=raidport.def

//
// NB: These should come from ntrtl.h
//
/*
ULONG
vDbgPrintExWithPrefix(
    IN PCH Prefix,
    IN ULONG ComponentId,
    IN ULONG Level,
    IN PCSTR Format,
    va_list arglist
    );

NTSYSAPI
ULONG
NTAPI
DbgPrompt(
    PCH Prompt,
    PCH Response,
    ULONG MaximumResponseLength
    );
*/

        BOOLEAN WmiInitialized : 1;
        
        BOOLEAN BusInterfaceInternal : 1;
        
        BOOLEAN InHwInitialize : 1;
        
        BOOLEAN EnablePPnpPowerSrb : 1;

    RAID_ADAPTER_PARAMETERS Parameters;
    
    PHW_PASSIVE_INITIALIZE_ROUTINE HwPassiveInitRoutine;
    
} RAID_ADAPTER_EXTENSION, *PRAID_ADAPTER_EXTENSION;

//
// Scsi Ioctls
//

NTSTATUS
RaidAdapterScsiMiniportIoctl(
    IN PRAID_ADAPTER_EXTENSION Adapter,
    IN PIRP Irp
    );

NTSTATUS
RaidGetSrbIoctlFromIrp(
    IN PIRP Irp,
    OUT PSRB_IO_CONTROL* SrbIoctlBuffer,
    OUT ULONG* InputLength,
    OUT ULONG* OutputLength
    );

NTSTATUS
RaidAdapterScsiMiniportIoctlWithAddress(
    IN PRAID_ADAPTER_EXTENSION Adapter,
    IN PIRP Irp,
    UCHAR PathId,
    UCHAR TargetId,
    UCHAR Lun
    );

    RaidAdapterAcquireHwInitializeLock (Adapter, &LockContext);
    Adapter->Flags.InHwInitialize = TRUE;

    //
    // Re-enable interrupts.
    //

    RaidAdapterEnableInterrupts (Adapter);

    Status = RaCallMiniportHwInitialize (&Adapter->Miniport);
    Adapter->Flags.InHwInitialize = FALSE;

    if (NT_SUCCESS (Status)) {
        Adapter->Flags.InitializedMiniport = TRUE;
    }
    
    RaidAdapterReleaseHwInitializeLock (Adapter, &LockContext);
    
    if(NT_SUCCESS (Status) && Adapter->HwPassiveInitRoutine != NULL)
    {
        Succ = Adapter->HwPassiveInitRoutine (&Adapter->Miniport.PrivateDeviceExt->HwDeviceExtension);
        Status = RaidNtStatusFromBoolean (Succ);
    }
    
    return Status;
}

NTSTATUS
RaidAdapterScsiMiniportIoctlWithAddress(
    IN PRAID_ADAPTER_EXTENSION Adapter,
    IN PIRP Irp,
    UCHAR PathId,
    UCHAR TargetId,
    UCHAR Lun
    )
/*++

Routine Description:

    Handle an IOCTL_SCSI_MINIPORT ioctl for this adapter.

Arguments:

    Adapter - The adapter that should handle this IOCTL.

    Irp - Irp representing a SRB IOCTL.

Algorithm:

    Unlike scsiport, which translates the IOCTL into a IRP_MJ_SCSI
    request, then executes the request on the first logical unit in the
    unit list -- we execute the IOCTL "directly" on the adapter. We will
    be able to execute even when the adapter has detected no devices, if
    this matters.

Return Value:

    NTSTATUS code.

--*/
{
    NTSTATUS Status;
    PSCSI_REQUEST_BLOCK Srb;
    PEXTENDED_REQUEST_BLOCK Xrb;
    RAID_MEMORY_REGION SrbExtensionRegion;
    PSRB_IO_CONTROL SrbIoctl;
    ULONG InputLength;
    ULONG OutputLength;

    ASSERT_ADAPTER (Adapter);
    ASSERT (Irp != NULL);
    
    PAGED_CODE();

    Srb = NULL;
    Xrb = NULL;
    RaidCreateRegion (&SrbExtensionRegion);

    Status = RaidGetSrbIoctlFromIrp (Irp, &SrbIoctl, &InputLength, &OutputLength);

    if (!NT_SUCCESS (Status)) {
        Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
        goto done;
    }

    //
    // Begin allocation chain
    //
    
    Srb = RaidAllocateSrb (Adapter->DeviceObject);

    if (Srb == NULL) {
        Status = STATUS_NO_MEMORY;
        goto done;
    }

    Xrb = RaidAllocateXrb (NULL, Adapter->DeviceObject);

    if (Xrb == NULL) {
        Status = STATUS_NO_MEMORY;
        goto done;
    }


    RaidBuildMdlForXrb (Xrb, SrbIoctl, InputLength);

    //
    // Build the srb
    //

    Srb->OriginalRequest = Xrb;
    Srb->Length = sizeof (SCSI_REQUEST_BLOCK);
    Srb->Function = SRB_FUNCTION_IO_CONTROL;
    Srb->PathId = PathId;
    Srb->TargetId = TargetId;
    Srb->Lun = Lun;
    Srb->SrbFlags = SRB_FLAGS_DATA_IN ;
    Srb->DataBuffer = SrbIoctl;
    Srb->DataTransferLength = InputLength;
    Srb->TimeOutValue = SrbIoctl->Timeout;

    //
    // Fill in Xrb fields.
    //

    Xrb->Srb = Srb;
    Xrb->SrbData.OriginalRequest = Srb->OriginalRequest;
    Xrb->SrbData.DataBuffer = Srb->DataBuffer;



    //
    // Srb extension
    //


    Status = RaidDmaAllocateCommonBuffer (&Adapter->Dma,
                                          RaGetSrbExtensionSize (Adapter),
                                          &SrbExtensionRegion);

    if (!NT_SUCCESS (Status)) {
        goto done;
    }

    //
    // Get the VA for the SRB's extension
    //
    
    Srb->SrbExtension = RaidRegionGetVirtualBase (&SrbExtensionRegion);


    //
    // Map buffers, if necessary.
    //
    
    RaidAdapterMapBuffers (Adapter, Irp);


    //
    // Initialize the Xrb's completion event and
    // completion routine.
    //

    KeInitializeEvent (&Xrb->u.CompletionEvent,
                       NotificationEvent,
                       FALSE);

    //
    // Set the completion routine for the Xrb. This effectivly makes the
    // XRB synchronous.
    //
    
    RaidXrbSetCompletionRoutine (Xrb,
                                 RaidXrbSignalCompletion);

    //
    // And execute the Xrb.
    //
    
    Status = RaidAdapterRaiseIrqlAndExecuteXrb (Adapter, Xrb);

    if (NT_SUCCESS (Status)) {
        KeWaitForSingleObject (&Xrb->u.CompletionEvent,
                               Executive,
                               KernelMode,
                               FALSE,
                               NULL);

        Status = RaidSrbStatusToNtStatus (Srb->SrbStatus);
    }


done:

    //
    // Set the information length to the min of the output buffer length
    // and the length of the data returned by the SRB.
    //
        
    if (NT_SUCCESS (Status)) {
        Irp->IoStatus.Information = min (OutputLength,
                                         Srb->DataTransferLength);
    } else {
        Irp->IoStatus.Information = 0;
    }

    //
    // Deallocate everything
    //

    if (RaidIsRegionInitialized (&SrbExtensionRegion)) {
        RaidDmaFreeCommonBuffer (&Adapter->Dma,
                                 &SrbExtensionRegion);
        RaidDeleteRegion (&SrbExtensionRegion);
        Srb->SrbExtension = NULL;
    }


    if (Xrb != NULL) {
        RaidFreeXrb (Xrb, FALSE);
        Srb->OriginalRequest = NULL;
    }


    //
    // The SRB extension and XRB must be released before the
    // SRB is freed.
    //

    if (Srb != NULL) {
        RaidFreeSrb (Srb);
        Srb = NULL;
    }

    return RaidCompleteRequest (Irp,
                                
                                Status);
}

//
// NB: Figure out how to pull in NTRTL.
//
/*
ULONG
vDbgPrintExWithPrefix(
    IN PCH Prefix,
    IN ULONG ComponentId,
    IN ULONG Level,
    IN PCH Format,
    va_list arglist
    );
*/

//------------------------------------------------------------------------------
// 100% match Windows Server 2003 SP2 x86 retail storport.sys
// only the offset of Adapter->Interrupt does not match 100%
//------------------------------------------------------------------------------
KIRQL RaidAdapterAcquireInterruptLock(RAID_ADAPTER_EXTENSION *Adapter)
{
    KIRQL irql;
    irql = PASSIVE_LEVEL;
    if(Adapter->Interrupt)
    {
        irql = KeAcquireInterruptSpinLock(Adapter->Interrupt);
    }

    return irql;
}


//------------------------------------------------------------------------------
// 100% match Windows Server 2003 SP2 x86 retail storport.sys
// only the offset of Adapter->Interrupt does not match 100%
//------------------------------------------------------------------------------
VOID RaidAdapterReleaseInterruptLock(RAID_ADAPTER_EXTENSION *Adapter,KIRQL OldIrq)
{
    if(Adapter->Interrupt)
    {
        KeReleaseInterruptSpinLock(Adapter->Interrupt,OldIrq);
    }
}


//------------------------------------------------------------------------------
// 100% match Windows 7 SP1 x86 retail storport.sys
//------------------------------------------------------------------------------
VOID StorAcquireSpinLock(PVOID HwDeviceExtension,STOR_SPINLOCK SpinLock,PVOID LockContext,
                         PSTOR_LOCK_HANDLE LockHandle)
{
    PRAID_ADAPTER_EXTENSION Adapter;

    Adapter = RaidpPortGetAdapter (HwDeviceExtension);

    LockHandle->Lock = SpinLock;

    switch(LockHandle->Lock)
    {
        case InterruptLock:
        {
            LockHandle->Context.OldIrql = RaidAdapterAcquireInterruptLock(Adapter);
            break;
        }
        case StartIoLock:
        {
            RaidAdapterAcquireStartIoLock(Adapter,(PLOCK_CONTEXT)&LockHandle->Context);
            break;
        }
        case DpcLock:
        {
            KeAcquireInStackQueuedSpinLock((PKSPIN_LOCK)&((PSTOR_DPC)LockContext)->Lock,
                                           (PKLOCK_QUEUE_HANDLE)&LockHandle->Context);
            break;
        }
    }
}


//------------------------------------------------------------------------------
// 100% match Windows 7 SP1 x86 retail storport.sys
//------------------------------------------------------------------------------
VOID StorReleaseSpinLock(PVOID HwDeviceExtension,PSTOR_LOCK_HANDLE LockHandle)
{
    PRAID_ADAPTER_EXTENSION Adapter;

    Adapter = RaidpPortGetAdapter (HwDeviceExtension);

    switch(LockHandle->Lock)
    {
        case InterruptLock:
        {
            RaidAdapterReleaseInterruptLock(Adapter,LockHandle->Context.OldIrql);
            break;
        }
        case StartIoLock:
        {
            RaidAdapterReleaseStartIoLock(Adapter,(PLOCK_CONTEXT)&LockHandle->Context);
            break;
        }
        case DpcLock:
        {
            KeReleaseInStackQueuedSpinLock((PKLOCK_QUEUE_HANDLE)&LockHandle->Context);
            break;
        }
    }
}


//------------------------------------------------------------------------------
// 100% match Windows 7 SP1 x86 retail storport.sys
//------------------------------------------------------------------------------
VOID StorInitializeDpc(PVOID HwDeviceExtension,PSTOR_DPC Dpc,PHW_DPC_ROUTINE HwDpcRoutine)
{
    KeInitializeDpc((PRKDPC)Dpc, (PKDEFERRED_ROUTINE) HwDpcRoutine, HwDeviceExtension);
    Dpc->Lock = 0;
}


//------------------------------------------------------------------------------
// 100% match Windows 7 SP1 x86 retail storport.sys
//------------------------------------------------------------------------------
BOOLEAN StorIssueDpc(PVOID HwDeviceExtension,PSTOR_DPC Dpc,PVOID SystemArgument1,
                     PVOID SystemArgument2)
{
    return KeInsertQueueDpc((PRKDPC)Dpc,SystemArgument1,SystemArgument2);
}


//------------------------------------------------------------------------------
// 100% match Windows Server 2003 SP2 x86 retail storport.sys
//------------------------------------------------------------------------------
#define TRACE_MESSAGE_SEQUENCE              1  // Message should include a sequence number
#define TRACE_MESSAGE_GUID                  2  // Message includes a GUID
#define TRACE_MESSAGE_TIMESTAMP             8  // Message includes a timestamp
#define TRACE_MESSAGE_SYSTEMINFO            32 // Message includes system information TID,PID
__drv_maxIRQL(HIGH_LEVEL) NTKERNELAPI NTSTATUS WmiTraceMessage(__in TRACEHANDLE LoggerHandle,
__in ULONG MessageFlags,__in LPCGUID MessageGuid,__in USHORT MessageNumber,...);
NTSTATUS WPP_SF_(TRACEHANDLE LoggerHandle,USHORT MessageNumber,LPCGUID MessageGuid)
{
    return WmiTraceMessage(LoggerHandle,TRACE_MESSAGE_SEQUENCE | TRACE_MESSAGE_GUID |
                           TRACE_MESSAGE_TIMESTAMP | TRACE_MESSAGE_SYSTEMINFO,MessageGuid,
                           MessageNumber,NULL);
}


//------------------------------------------------------------------------------
// near 100% match Windows Server 2003 SP2 x86 retail storport.sys
// only difference is that WPP tracing is not done correctly
//------------------------------------------------------------------------------
PULONG _WPP_GLOBAL_Control = NULL;
TRACEHANDLE unk_20008 = 0x7CF4010094F40100;
GUID aGnkh = {0x68AAAD67,0x0700,0x6A21,0x5D,0x1A,0x7E,0xC9,0xB8,0xA2,0x38,0x9D};
BOOLEAN StorEnablePassiveInitialization(PVOID HwDeviceExtension,
                                        PHW_PASSIVE_INITIALIZE_ROUTINE HwPassiveInitializeRoutine)
{
    PRAID_ADAPTER_EXTENSION Adapter;

    Adapter = RaidpPortGetAdapter (HwDeviceExtension);

    if(Adapter->Flags.InHwInitialize == FALSE)
    {
        if(_WPP_GLOBAL_Control != NULL)
        {
            WPP_SF_(unk_20008,0x0B,&aGnkh);
        }

        return FALSE;
    }

    Adapter->HwPassiveInitRoutine = HwPassiveInitializeRoutine;

    return TRUE;
}


VOID
StorPortNotification(
    IN SCSI_NOTIFICATION_TYPE NotificationType,
    IN PVOID HwDeviceExtension,
    ...
    )
{
    PRAID_ADAPTER_EXTENSION Adapter;
    PSCSI_REQUEST_BLOCK Srb;
    PHW_INTERRUPT HwTimerRoutine;
    ULONG Timeout;
    PHW_PASSIVE_INITIALIZE_ROUTINE HwPassiveInitializeRoutine;
    PSTOR_DPC Dpc;
    PHW_DPC_ROUTINE HwDpcRoutine;
    PVOID SystemArgument1;
    PVOID SystemArgument2;
    PLONG Succ;
    STOR_SPINLOCK SpinLock;
    PVOID LockContext;
    PSTOR_LOCK_HANDLE LockHandle;
    va_list ap;

    Adapter = RaidpPortGetAdapter (HwDeviceExtension);
    
    va_start(ap, HwDeviceExtension);

    switch (NotificationType) {

        case EnablePassiveInitialization:
            HwPassiveInitializeRoutine = va_arg (ap, PHW_PASSIVE_INITIALIZE_ROUTINE);
            Succ = va_arg (ap, PLONG);
            *Succ = StorEnablePassiveInitialization(HwDeviceExtension,
                                                    HwPassiveInitializeRoutine);
            break;

        case InitializeDpc:
            Dpc = va_arg (ap, PSTOR_DPC);
            HwDpcRoutine = va_arg (ap, PHW_DPC_ROUTINE);
            StorInitializeDpc(HwDeviceExtension, Dpc, HwDpcRoutine);
            break;

        case IssueDpc:
            Dpc = va_arg (ap, PSTOR_DPC);
            SystemArgument1 = va_arg (ap, PVOID);
            SystemArgument2 = va_arg (ap, PVOID);
            Succ = va_arg (ap, PLONG);
            *Succ = StorIssueDpc(HwDeviceExtension, Dpc, SystemArgument1, SystemArgument2);
            break;

        case AcquireSpinLock:
            SpinLock = va_arg (ap, STOR_SPINLOCK);
            LockContext = va_arg (ap, PVOID);
            LockHandle = va_arg (ap, PSTOR_LOCK_HANDLE);
            StorAcquireSpinLock(HwDeviceExtension, SpinLock, LockContext, LockHandle);
            break;

        case ReleaseSpinLock:
            LockHandle = va_arg (ap, PSTOR_LOCK_HANDLE);
            StorReleaseSpinLock(HwDeviceExtension, LockHandle);
            break;

        case RequestComplete:
            Srb = va_arg (ap, PSCSI_REQUEST_BLOCK);
            RaidAdapterRequestComplete (Adapter, RaidGetAssociatedXrb (Srb));
            break;

#pragma alloc_text(PAGE, RaUnitStorageQueryPropertyIoctl)
#pragma alloc_text(PAGE, RaUnitScsiMiniportIoctl)

        case IOCTL_STORAGE_QUERY_PROPERTY:
            Status = RaUnitStorageQueryPropertyIoctl (Unit, Irp);
            break;

        case IOCTL_SCSI_MINIPORT:
            Status = RaUnitScsiMiniportIoctl (Unit, Irp);
            break;

//------------------------------------------------------------------------------
// 100% correct builded on WDK version 7600.16385.1 and Windows 7 free build
// environment
//------------------------------------------------------------------------------
NTSTATUS RaUnitScsiMiniportIoctl(IN PRAID_UNIT_EXTENSION Unit,IN PIRP Irp)
{
    NTSTATUS Status;
    PSRB_IO_CONTROL SrbIoctl;
    ULONG InputLength;
    ULONG OutputLength;

    PAGED_CODE();
    ASSERT_UNIT(Unit);

    Status = RaidGetSrbIoctlFromIrp(Irp,&SrbIoctl,&InputLength,&OutputLength);
    if(!NT_SUCCESS(Status))
    {
        return RaidCompleteRequest(Irp,STATUS_INVALID_PARAMETER);
    }

    // because of this check Windows 7 is not capable to handle CrystalDiskInfo SMART commands
    //if(RtlCompareMemory(SrbIoctl->Signature,"HYBRDISK",8) == 8 &&
    //   SrbIoctl->ControlCode == IOCTL_SCSI_MINIPORT_NVCACHE)
    // we could change this like follows to make it work with CrystalDiskInfo's SMART commands
    // at the end we decided to comment out this code completely to make it work always
    //if(RtlCompareMemory(SrbIoctl->Signature,"SCSIDISK",8) == 8 &&
    //   SrbIoctl->ControlCode == IOCTL_SCSI_MINIPORT)
    //{
        if(Irp->RequestorMode != KernelMode)
        {
            return RaidCompleteRequest(Irp,STATUS_ACCESS_DENIED);
        }
    //}
    //else
    //{
        //return RaUnitUnknownIoctl(Unit,Irp);
    //}

    return RaidAdapterScsiMiniportIoctlWithAddress(Unit->Adapter,Irp,Unit->Address.PathId,
                                                   Unit->Address.TargetId,Unit->Address.Lun);
}

if (PowerState.SystemState > PowerSystemShutdown) {

//------------------------------------------------------------------------------
// near 100% match Windows Server 2003 SP2 x86 retail storport.sys
// only trace function WmiTraceMessage is missing
//------------------------------------------------------------------------------
NTSTATUS
RaidUnitSetSystemPowerIrp(
    IN PRAID_UNIT_EXTENSION Unit,
    IN PIRP Irp
    )
{
    NTSTATUS Status;
    POWER_STATE DevicePowerState;
    POWER_STATE SystemPowerState;
	
    DebugPower (("Unit %p, Irp %p, Set System Power, ret SUCCESS\n",
                 Unit, Irp));

    SystemPowerState = RaidPowerStateFromIrp (Irp);
    DevicePowerState.DeviceState = DeviceStateTable [SystemPowerState.SystemState];

    Status = PoRequestPowerIrp (Unit->DeviceObject, IRP_MN_SET_POWER, DevicePowerState, NULL, Irp, NULL);
    if (Status == STATUS_PENDING)
    {
    	Status = STATUS_SUCCESS;	
    }
    PoStartNextPowerIrp (Irp);
    return RaidCompleteRequest (Irp,  Status);
}

//------------------------------------------------------------------------------
// 100% match Windows Server 2003 SP2 x86 retail storport.sys
// only the offset of &Unit->IoQueue does not match 100%
//------------------------------------------------------------------------------
NTSTATUS
RaUnitFlushQueueSrb(
    IN PRAID_UNIT_EXTENSION Unit,
    IN PIRP FlushIrp
    )
/*++

Routine Description:

    Flush the pending queue, canceling all requests.

Arguments:

    Unit - Supplies pointer to unit to flush.

    FlushIrp - Supplies the IRP representing the flush queue request.

Return Value:

    NTSTATUS code.

Environment:

    DISPATCH_LEVEL or below.

--*/
{
    PIRP Irp;
    PSCSI_REQUEST_BLOCK Srb;
    LIST_ENTRY listHead;
    PIRP nextIrp = NULL;
    PLIST_ENTRY nextEntry;

    ASSERT (RaidIsUnitQueueFrozen (Unit));

    //
    // Flush all entries.
    //
    
    InitializeListHead (&listHead);
    for (Irp = RaidRemoveIoQueue (&Unit->IoQueue);
         Irp != NULL;
         Irp = RaidRemoveIoQueue (&Unit->IoQueue)) {

        InsertTailList (&listHead,&Irp->Tail.Overlay.ListEntry);
    }

    RaidThawUnitQueue (Unit);

    while (!IsListEmpty (&listHead))
    {
        nextEntry = RemoveHeadList (&listHead);
        nextIrp = CONTAINING_RECORD (nextEntry, IRP, Tail.Overlay.ListEntry);

        Srb = RaidSrbFromIrp (nextIrp);
        Srb->SrbStatus = SRB_STATUS_REQUEST_FLUSHED;
        nextIrp->IoStatus.Information = 0;
        RaidCompleteRequest (nextIrp,  STATUS_UNSUCCESSFUL);

        nextIrp = NULL;
    }

    // This solves a bug with CD-/DVD-ROM drives where the original storport
    // driver uses the Irp instead of the FlushIrp here. This throws an
    // exception, because Irp can be NULL.
    Srb = RaidSrbFromIrp (FlushIrp);
    Srb->SrbStatus = SRB_STATUS_SUCCESS;
    FlushIrp->IoStatus.Information = 0;
    return RaidCompleteRequest (FlushIrp,  STATUS_SUCCESS);
}

7.) Patch original Windows 7 SP1 x86 storport to make it work with Windows 2003 Server
----------------------------------------------------------------------------------------------

We patch the original Windows 7 SP1 x86 storport.sys Version 6.1.7601.17514 to function properly with Windows 2003 Server. Therefore we have to do the following steps:

• download Dependency Walker v2.2
• unpack depends22_x86.zip to C:\depends22_x86
• run C:\depends22_x86\depends.exe > Menu > File > Open... > choose Windows 7 SP1 x86 storport.sys > Open > we see a message that errors were detected > OK

• on the upper left window click on NTOSKRNL.EXE > in the upper right window sort the column Function and after that the column PI > this way all red marked imports are on top sorted by name
• we have the following missing imports in NTOSKRNL.EXE:

• replace the missing imports like NTOSKRNL_Emu does it and compile ntoskrn7.sys
• patch the following bytes in storport.sys of Windows 7 SP1 x86:

  Offset    Size in Bytes    Comment
  -----------------------------------------------------------------------------------------------------------------
  0x120     2                MajorSubsystemVersion and MinorSubsystemVersion changed from 6.1 to 5.1
  0x130     4                checksum of executable corrected
  0x170     8                Directory Security (Certificate Table) RVA and size set to zero, because the
                             certificate was removed 
  0xFE79    2                disable compare of SRB_IO_CONTROL Signature to string "HYBRDISK" to enable SMART
                             commands for CrystalDiskInfo
  0xFE85    2                disable compare of SRB_IO_CONTROL ControlCode to IOCTL_SCSI_MINIPORT_NVCACHE to
                             enable SMART commands for CrystalDiskInfo
  0x1CE9B   5                imports section ntoskrnl.exe replaced by ntoskrn7.sys
  0x1CE05   0                the security cookie check is not patched for a Windows 7 driver
  0x22A00   0x1B80           only present in original driver file, code signing certificate removed in patched
                             driver file

8.) How to apply the storport patches
-----------------------------------------

To apply the Windows 2003 Server storport patch based on the leaked source code do the following:

• rename C:\WINDOWS\system32\dllcache\storport.sys to storport.sys_
• rename C:\WINDOWS\system32\drivers\storport.sys to storport.sys_
• we will get a Windows File Protection warning dialog where we press Cancel and Yes
• copy the patched storport_for_Windows_2003_with_SMART_support\storport\bin\storport.sys to C:\WINDOWS\system32\drivers
• we will get a Windows File Protection warning dialog where we press Cancel and Yes
• reboot the computer

We tested the SSD read/write performance afterwards with CrystalDiskMark 6.0.1.



To apply the Windows 7 storport and ntoskrn7 patch do the following:

• rename C:\WINDOWS\system32\dllcache\storport.sys to storport.sys_
• rename C:\WINDOWS\system32\drivers\storport.sys to storport.sys_
• we will get a Windows File Protection warning dialog where we press Cancel and Yes
• copy the patched storport_for_Windows_2003_with_SMART_support\ntoskrnl7\bin\storport.sys to C:\WINDOWS\system32\drivers
• we will get a Windows File Protection warning dialog where we press Cancel and Yes
• copy storport_for_Windows_2003_with_SMART_support\ntoskrnl7\bin\ntoskrn7.sys to C:\WINDOWS\system32\drivers
• reboot the computer

Here we also tested the SSD read/write performance afterwards with CrystalDiskMark 6.0.1.



Attention: These drivers have not been tested extensively and should not be use in a production environment! These patches were done for educational and proof of concept purposes only.

9.) Credits and Download Links
----------------------------------

A BIG THANKS goes out to the following geniuses:

• Mov AX, 0xDEAD (NTOSKRNL_Emu)
• hiyohiyo (CrystalDiskInfo)
• Steve P. Miller (Dependency Walker)
• Matthew D. Hendel (Microsoft Windows 2003 storport driver)
• Fernando (Win-Raid Forum)
• daniel_k (Win-Raid Forum)

Much appreciated!



The complete storport package with all necessary files can be downloaded from Sourceforge.

Thanks for your attention and interest in this topic.
Greets Kai Schtrom

Version 1.1 May 05, 2021