ZwMapViewOfSection() failed with error STATUS_INVALID_PARAMETER3 on x64(Windows 8.1 &

Hello,

In post create callback, I read file using FltCreateSectionForDataScan() and ZwMapViewOfSection() functions.
This reading is happening in the context of my user mode process.

PVOID pvBaseAdd;

pvBaseAdd = NULL;
liSectionOffset = Offset; // This section offset is align to allocation granularity i.e. 64k

NTStatus = ZwMapViewOfSection(
pSectionContext->hSectionHandle,
ZwCurrentProcess(),
&pvBaseAdd,
0,
0,
&liSectionOffset,
(PSIZE_T)&ulViewSize,
ViewUnmap,
0,
PAGE_READONLY
);

This call gets failed with STATUS_INVALID_PARAMETER_3 on 64 bit(windows 8.1 & above) machine.

I referred below link but it doesn’t work.
http://www.osronline.com/showThread.cfm?link=30527

Please help me to understand why it is failing.

Thanks in advance.

Try with ZeroBits set to 1.

ZwMapViewOfSection( pSectionContext->hSectionHandle,
ZwCurrentProcess(),
&pvBaseAdd,
1, // I want to map into a low half of the address space

It looks like overkill as ZwMapViewOfSection never maps in the system space. Nevertheless the system might check for this bit when a caller previous mode is KernelMode.

Thanks for your reply, but it is not working.

If I create section using FsRtlCreateSectionForDatascan() function then ZwMapViewOfSection() get SUCCESS.

Below is my code:

InitializeObjectAttributes(&oa, NULL, OBJ_KERNEL_HANDLE, NULL, NULL);
NTStatus = FltCreateSectionForDataScan(
FltInstance,
pFileObject,
pSectionContext,
SECTION_MAP_READ,
&oa,
NULL,
PAGE_READONLY,
SEC_COMMIT,
0,
&pSectionContext->hSectionHandle,
&pSectionContext->pvSectionObject,
NULL
);

You’re going to need to step into the function with the debugger and see
which check is failing. Even better if you have a working and non-working
case, just keep stepping until the two paths diverge.

Please report back with your findings and then maybe we can be of more
assistance in interpreting what you have found.

-scott
OSR
@OSRDrivers

wrote in message news:xxxxx@ntfsd…

Thanks for your reply, but it is not working.

If I create section using FsRtlCreateSectionForDatascan() function then
ZwMapViewOfSection() get SUCCESS.

Below is my code:

InitializeObjectAttributes(&oa, NULL, OBJ_KERNEL_HANDLE, NULL, NULL);
NTStatus = FltCreateSectionForDataScan(
FltInstance,
pFileObject,
pSectionContext,
SECTION_MAP_READ,
&oa,
NULL,
PAGE_READONLY,
SEC_COMMIT,
0,
&pSectionContext->hSectionHandle,
&pSectionContext->pvSectionObject,
NULL
);

Thanks Scott for your inputs.
Issue gets resolved by passing view size as pointer to SIZE_T instead of pointer to ULONG.

Oops!

Are you compiling /W4? Would have thought the compiler would catch this.

-scott
OSR
@OSRDrivers

wrote in message news:xxxxx@ntfsd…

Thanks Scott for your inputs.
Issue gets resolved by passing view size as pointer to SIZE_T instead of
pointer to ULONG.