Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

ZwOpenFile return status 0xc0000034

Alexey_YerakhavetsAlexey_Yerakhavets Member - All Emails Posts: 24
Hello everybody. In the upper filter driver of the disk device, after sending the IOCTL_STORAGE_GET_DEVICE_NUMBER request, I get the device type 07, the device number 1 and the partition number 0. Next, I want to read the MBR using the ZwOpenFile function, but I always get the status 0xc0000034(The object name is not found.). As an object name parameter I tried to pass: \\Device\\Harddisk1\\Partition0, \\??\\ , \\??\\PhysicalDrive1 , \\Device\\harddisk1\\DR1, \\??\\F: (The letter of my device).

Is it possible that the sector can not be read by the disk device driver? Or it is necessary to do it with the help of the driver of the partition?

Comments

  • Sergey_PisarevSergey_Pisarev Member - All Emails Posts: 141
    Try to check with winobj if these paths you trying to open actually present in the object manager namespace.

    > On 15 Aug 2018, at 19:08, xxxxx@gmail.com <xxxxx@lists.osr.com> wrote:
    >
    > Hello everybody. In the upper filter driver of the disk device, after sending the IOCTL_STORAGE_GET_DEVICE_NUMBER request, I get the device type 07, the device number 1 and the partition number 0. Next, I want to read the MBR using the ZwOpenFile function, but I always get the status 0xc0000034(The object name is not found.). As an object name parameter I tried to pass: \\Device\\Harddisk1\\Partition0, \\??\\ , \\??\\PhysicalDrive1 , \\Device\\harddisk1\\DR1, \\??\\F: (The letter of my device).
    >
    > Is it possible that the sector can not be read by the disk device driver? Or it is necessary to do it with the help of the driver of the partition?
    >
    > ---
    > NTDEV is sponsored by OSR
    >
    > Visit the list online at: <http://www.osronline.com/showlists.cfm?list=ntdev>;
    >
    > MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
    > Details at <http://www.osr.com/seminars>;
    >
    > To unsubscribe, visit the List Server section of OSR Online at <http://www.osronline.com/page.cfm?name=ListServer>;
  • Sergey_PisarevSergey_Pisarev Member - All Emails Posts: 141
    Also you can do it with windbg’s !object command

    > On 15 Aug 2018, at 19:47, Sergey Pisarev <xxxxx@gmail.com> wrote:
    >
    > Try to check with winobj if these paths you trying to open actually present in the object manager namespace.
    >
    >> On 15 Aug 2018, at 19:08, xxxxx@gmail.com <xxxxx@lists.osr.com> wrote:
    >>
    >> Hello everybody. In the upper filter driver of the disk device, after sending the IOCTL_STORAGE_GET_DEVICE_NUMBER request, I get the device type 07, the device number 1 and the partition number 0. Next, I want to read the MBR using the ZwOpenFile function, but I always get the status 0xc0000034(The object name is not found.). As an object name parameter I tried to pass: \\Device\\Harddisk1\\Partition0, \\??\\ , \\??\\PhysicalDrive1 , \\Device\\harddisk1\\DR1, \\??\\F: (The letter of my device).
    >>
    >> Is it possible that the sector can not be read by the disk device driver? Or it is necessary to do it with the help of the driver of the partition?
    >>
    >> ---
    >> NTDEV is sponsored by OSR
    >>
    >> Visit the list online at: <http://www.osronline.com/showlists.cfm?list=ntdev>;
    >>
    >> MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
    >> Details at <http://www.osr.com/seminars>;
    >>
    >> To unsubscribe, visit the List Server section of OSR Online at <http://www.osronline.com/page.cfm?name=ListServer>;
    >
  • Tim_RobertsTim_Roberts Member - All Emails Posts: 12,720
    xxxxx@gmail.com wrote:
    > Hello everybody. In the upper filter driver of the disk device, after sending the IOCTL_STORAGE_GET_DEVICE_NUMBER request, I get the device type 07, the device number 1 and the partition number 0. Next, I want to read the MBR using the ZwOpenFile function, but I always get the status 0xc0000034(The object name is not found.). As an object name parameter I tried to pass: \\Device\\Harddisk1\\Partition0, \\??\\ , \\??\\PhysicalDrive1 , \\Device\\harddisk1\\DR1, \\??\\F: (The letter of my device).
    >
    > Is it possible that the sector can not be read by the disk device driver? Or it is necessary to do it with the help of the driver of the partition?

    Again, we're not sure where you are in the disk stack.  If you're really
    filtering a disk device, then you are below the level of the partition. 
    You can open \device\harddisk1, but the disk doesn't know anything about
    partitions.  That's a concept that happens above you.

    And, if you are a disk filter, then you probably ARE \device\harddisk1.

    --
    Tim Roberts, xxxxx@probo.com
    Providenza & Boekelheide, Inc.

    Tim Roberts, [email protected]
    Providenza & Boekelheide, Inc.

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!