PDA

View Full Version : Volume Shadow Copy Service


Orkblutt
December 13th, 2012, 06:15
Hi,

I'm working on some backup software using VSS to backup open files like databases on Windows.
According to Microsoft, you have to compile your code using SDKs for each platform and link statically to VSS library. The result is you will have 1 binary working on 2003, 1 binary for 2008, 1 binary for 7, etc.
I really don't like the idea to have to compile for each platform every time you have to update. My VSS component is in a separate module from my main code so it should avoid to have to be updated too often. But I still don't like that idea.

I'm wondering what could be the best method to avoid that issue.

A good diagram to show how VSS works internally:
http://msdn.microsoft.com/en-us/library/windows/desktop/aa384589%28v=vs.85%29.aspx ("http://msdn.microsoft.com/en-us/library/windows/desktop/aa384589%28v=vs.85%29.aspx")

A good example to VSS programming:
http://www.codeproject.com/Articles/321273/VSS-API-IN-CPP ("http://www.codeproject.com/Articles/321273/VSS-API-IN-CPP")

We will use that code for our tests.

All is done using IVssBackupComponents COM interface. You can find the description in vsbackup.h from your SDK. All methods are implemented in vssapi.dll
Code:
class __declspec(uuid("665c1d5f-c218-414d-a05d-7fef5f9d5c86") IVssBackupComponents : public IUnknown
{
...
STDMETHOD(InitializeForBackup)(IN BSTR bstrXML = NULL) = 0; //14h
...
}


First we create instance of that object calling CreateVssBackupComponents(Internal) exported from vssapi.dll
Then we follow the flow showed in diagram to make the snapshot we want to work on...

Here the start of code using .h and lib from SDK 7.1:
Code:

text:004E4649 call j_?CreateVssBackupComponents@@YAJPAPAVIVssBackupComponents@@@Z ; CreateVssBackupComponents(IVssBackupComponents * *)
.text:004E464E add esp, 4
.text:004E4651 mov [ebp+result], eax
.text:004E4654 cmp [ebp+result], 0
.text:004E4658 jnz loc_4E4D5C
.text:004E465E mov esi, esp
.text:004E4660 push 0
.text:004E4662 mov eax, [ebp+pBackup]
.text:004E4665 mov ecx, [eax]
.text:004E4667 mov edx, [ebp+pBackup]
.text:004E466A push edx
.text:004E466B mov eax, [ecx+14h]
.text:004E466E call eax //pBackup->InitializeForBackup()


Now what is the more reliable method to get address of IVssBackupComponents's methods from vssapi.dll ?
Should I wrote a kind of wrapper for that interface and setup address at runtime by scanning vssapi.dll ?

Code:
.text:716EF52C dd offset ?InitializeForBackup@CVssBackupComponents@@UAGJPAG@Z ;


Code:

interface IVssBackupComponents: public IUnknow
{
...
STDMETHOD(InitializeForBackup)(IN BSTR bstrXML = NULL) = hVssApiBase + 0x716EF52C;
...
}



Thank you for your help.

Orkblutt