Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTDEV
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


SL_FORCE_DIRECT_WRITE and MBRs

Jason_T.Jason_T. Member Posts: 72

Hello,

I recall years back when Vista first came out having a number of clients panic because their user mode disk utilities could no longer write to the disk without having a kernel driver component which added the SL_FORCE_DIRECT_WRITE flag to a write IRP. I've pretty much just worked off the assumption for the last 10+ years that you couldn't write an MBR from user mode for security reasons. But to my surprise today I found that simple CreateFile/WriteFile on \.\PhysicalDriveX allows updating sector 0 on both an MBR and GPT style disk (even while online and in use) as long as the process is run as admin. Was this relaxed at some point or did I just misunderstand it all these years? Seems awfully easy to modify the MBR, though you could make the argument that if a user has admin access they could just as well load their own driver to perform the IO that way... but with that line of thinking I'm not clear what the purpose of the IRP flag and the protection mechanism was ever meant to be in the first place. In other words, you can't open \.\PhysicalDriveX unless you are admin anyway, so what is the point of an additional write restriction which goes away if you are admin?

-JT

Comments

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 15 Jun 2020 LIVE ONLINE
Writing WDF Drivers 22 June 2020 LIVE ONLINE
Internals & Software Drivers 28 Sept 2020 Dulles, VA