FSCTL_GET_RETRIEVAL_POINTER_BASE returns invalid parameter as response in file system filter driver

Shashi140

Hi,

I want to retrieve the sector offset information to calculate LBA of a file from my file system filter driver. I am able to get response for FSCTL_GET_RETRIEVAL_POINTERS IOCTL, but for FSCTL_GET_RETRIEVAL_POINTER_BASE it is returning as INVALID parameter. Any thing am missing here. The file also has been opened with GENERIC_ALL_ACCESS.

RETRIEVAL_POINTER_BASE SectOffset = { 0 };
Status = FltFsControlFile(pVolumeCtx->Instance, pFileObject, FSCTL_GET_RETRIEVAL_POINTER_BASE, NULL, 0, &SectOffset, 8, NULL);

        if (Status == STATUS_SUCCESS)
        {
            Trace(TRACE_LEVEL_INFORMATION, TRACE_FLAG_FILTERMISC, "SectorOffset %lld", SectOffset.FileAreaOffset.QuadPart);
        }

Thanks,

Scott_Noone_(OSR)

This one needs to be sent to a volume open and not a file open. You can check the FAT source for anything else it might be:

https://github.com/microsoft/Windows-driver-samples/blob/main/filesys/fastfat/fsctrl.c#L7034