Question: I am new in driver development.
I started to develop usb filter driver for Windows7 in order to hide from user some usb device types. I attach my driver on USB hub and can intercept IRP\_MN\_QUERY\_DEVICE\_RELATIONS. I have a few questions:

1 - On `IRP_MN_QUERY_DEVICE_RELATIONS` (`QueryDeviceRelations.Type` is BusRelations) I receive a pointer to `DEVICE_RELATIONS struct`.As I understand the Objects array in the struct should hold pointers to PDOs. But, when I test `DO_BUS_ENUMERATED_DEVICE` flag (From msdn: *The operating system sets this flag in each physical device object (PDO). Drivers must not modify this flag.*) sometime I see this flag is turned on, and some time the flag is turned off. Does it means that sometime I see PDO and sometime I see FDO? Or some another explanation for this issue? When I get some `PDEVICE_OBJECT`, how can I know Is it PDO or FDO?

2 - When the user plugs in some usb device, and the filter driver should handle `IRP_MN_QUERY_DEVICE_RELATIONS`, how can I determine which device from Object array is just now plugged in device and which one was plugged in before, and which one is marked as inactive?

Thanks in advance.
Felix.

Answer: 
There is undocumented member `DeviceNode` in `DEVOBJ_EXTENSION` because it is not a part of WDM.h and NTDDK.h, so private to the IO or PnP Managers. In any case it is NULL for non-PDO's so "unsupported way" is 

```
if (DeviceObject->DeviceObjectExtension->DeviceNode) {
        // PDO!
    } else {
        // non-PDO!
    }

```

I'd prefer not to use it. Instead of it, you can find actual device object via `IoGetDeviceObjectPointer` or by walking through devobj list starting from `PDRIVER_OBJECT`.
In order to determinate whether devobj is PDO send QDR/TargetDeviceRelation (unref `PDEVICE_OBJECT` in list when done). If succeeded, resulting devobj in the QDR will be the PDO your device. [Here is](http://blogs.msdn.com/b/doronh/archive/2006/06/12/629120.aspx) a good explanation of this. Another option is to use `DO_BUS_ENUMERATED_DEVICE`.
Also take into account that this flag does not means *initialized* PDO. It set before initialization and upon structure allocation.
I've never seen FDOs arrive in a BusRelations update, but perhaps you have another filter driver on your way? Anyway, Tamir answered that question just fine :)

About your second question, the only way I know is to keep a copy of the previously-received Objects array and compare. Don't try to rely on any particular ordering of devices since it can change between versions.