Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Re: Question of ZwWriteFile.

OSR_Community_UserOSR_Community_User Member Posts: 110,217
Thank you for your answer.

My filter driver is the automatical cypher file system. These problems is
at Rename action(IRP_SET_INFORMATION). Target file seem to be opened
without FILE_SYNCHRONOUS_IO_NOALERT.
At this action in my filter, when rename action is to rename from standard
file to a cypher file, I read, enrypt and write target file by FILE_OBJECT
in worker thread. So I wrote source following.

But I can not get the number of read/written bytes. How do I get the
number of bytes?

----------- This Source(Using WinDK) -----------
static void normalToPandora( PFILE_OBJECT fobj, HardkeyParameter *prm )
{
int n;
HANDLE h;
if ( !NT_SUCCESS(ObOpenObjectByPointer(fobj, 0, 0,
FILE_READ_DATA | FILE_WRITE_DATA | SYNCHRONIZE,
NULL, KernelMode, &h)) )
return;
char ev[20];
sprintf( ev, "\\Device\\X%8.8X", fobj );
_CEvent *sig = new _CEvent( ev ); // IoCreateSynchronizationEvent
char *buff = (char *)AllocMem( BUFFER_SIZE ); // NonPaged memory
for( LONGLONG off = 0;
(n = read(h, buff, off, BUFFER_SIZE, sig)) >= 0; off += n ) {
if ( !n ) continue;
EncryptStream( prm, off, n, buff );
write( h, buff, off, n, sig );
}
delete sig;
ZwClose( h );
FreeMem( buff );
}

static long
read( HANDLE h, void *buffer, LONGLONG offset, long length, _CEvent *ev )
{
NTSTATUS res;
IO_STATUS_BLOCK st;

ev->Clear();
res = ZwReadFile( h, ev->Handle(), NULL, NULL, &st, buffer, length,
(LARGE_INTEGER *)&offset, NULL );
if ( res == STATUS_PENDING ) ev->Wait();
return NT_SUCCESS( res ) ? st.Information : -1;
// I want to get the number of bytes
// and I/O status after read completion.
}

static long
write( HANDLE h, void *buffer, LONGLONG offset, long length, _CEvent *ev )
{
NTSTATUS res;
IO_STATUS_BLOCK st;

ev->Clear();
res = ZwWriteFile( h, ev->Handle(), NULL, NULL, &st, buffer, length,
(LARGE_INTEGER *)&offset, NULL );
if ( res == STATUS_PENDING ) ev->Wait();
return NT_SUCCESS( res ) ? st.Information : -1;
// I want to get the number of bytes
// and I/O status after read completion.
}


David Welch wrote:

> On Tue, 22 Feb 2000, it was written:
> >
> > Can I set a flag FILE_SYNCHRONOUS_IO_NOALERT in ObOpenObjectByPointer?
> >
> I don't think so. You could try getting the filename from the handle and
> then reopening it.
>
> >
> > What NtCreateEvent?
> >
> NTSTATUS STDCALL NtCreateEvent (OUT PHANDLE EventHandle,
> IN ACCESS_MASK DesiredAccess,
> IN POBJECT_ATTRIBUTES ObjectAttributes,
> IN BOOLEAN ManualReset,
> IN BOOLEAN InitialState)
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 9-13 Sept 2024 Live, Online
Developing Minifilters 15-19 July 2024 Live, Online
Internals & Software Drivers 11-15 Mar 2024 Live, Online
Writing WDF Drivers 20-24 May 2024 Live, Online