Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


STATUS_IO_REPARSE_DATA_INVALID - modifying reparse point buffers

Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 303

Hello.

I am trying to modify a reparse buffer for a FSCTL_SET_REPARSE_POINT operation. The change is done via modifying the buffer with an extra folder name and using FltFsControlFile, although identical results arise when the call is just passed through and result checked in the postop.

I am getting STATUS_IO_REPARSE_DATA_INVALID error. I verified that the size is correct:

  • InputBufferSize is >8 and <16384 :)
  • InputBufferSize = ReparseBuffer.ReparseDataLength + 8
  • ReparseBuffer.ReparseDataLength is PrintNameOffset+PrintNameLength (since the print name offset is larger than the reparse name offset)
    Also verified that:

  • PrintNameOffset is < ReparseNameLength + ReparseNameOffset

  • The file name is correct

What else could be causing this NTSTATUS?

Comments

  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,121

    I've never encountered this, so the best I can suggest is Scott's article on chasing status's to their source in ntfs

    Please share when you find out what's up.

  • Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 303
    via Email
    I was afraid of that :(

    Turns out it was quick and easy. NTFS calls
    FsRtlValidateReparseBuffer, which does the validation.
    The buffer in question had PrintNameOffset set to a value other than
    SubstituteNameOffset+SubstituteNameLength+2 (yes, NULL presumed, and
    location presumed!). This means that the buffer cannot move the stuff
    around, as the documentation states (at least for NTFS).

    Dejan.

    On 4/8/20, rod_widdowson wrote:
    > OSR https://community.osr.com/
    >
    > rod_widdowson commented on STATUS_IO_REPARSE_DATA_INVALID - modifying
    > reparse point buffers
    >
    > I've never encountered this, so the best I can suggest is Scott's article on
    > chasing status's to their source in ntfs
    >
    > Please share when you find out what's up.
  • Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 303
    via Email
    I should note that this was tested on Server 2008 R2.
    Windows 10 is likely to be different in that regard.
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 15 Jun 2020 LIVE ONLINE
Writing WDF Drivers 22 June 2020 LIVE ONLINE
Internals & Software Drivers 28 Sept 2020 Dulles, VA