A device which isn't opened by WinObj

NTDEV
1

RtlInitUnicodeString(&sddl, _T(“D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;GA;;;BU)”));

status = IoCreateDeviceSecure(
pDriverObject,
sizeof(DEVICE_EXTENSION),
pDeviceName,
FILE_DEVICE_DISK,
0,
FALSE,
&sddl,
NULL,
&pDeviceObject
); // Succeed

IoCreateSymbolicLink(…) // Succeed

And I tried to open in user mode(Run as administrator)

CreateFile(DeviceSymlinkName, …) // fail ERROR_FILE_NOT_FOUND

The device has been created and it’s symbolic link created well(in /GLOBAL?? namespace)

Sysinternals WinObj can’t open the device either.(But the device is represented well on WinObj’s list)

If I create the device on DriverEntry routine, I can open the device well.
But I create the device on DeviceIoControl routine, I can’t open and WinObj can’t either.
So, I tried to make a system thread in DeviceIoContol routine, and made a device in system thread. But it didn’t work.

What’s wrong?

2

>But I create the device on DeviceIoControl routine, I can’t open and WinObj can’t either.
Did you mean that you create a device object in the dispatch function of IRP_MJ_DEVICE_CONTROL?

NTDEV is sponsored by OSR
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

In the case where you are creating the devobj outside of DriverEntry, are you clearing DO_DEVICE_INITIALIZING?

d

dent from a phpne with no keynoard

-----Original Message-----
From: xxxxx@gmail.com
Sent: August 22, 2010 7:25 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] A device which isn’t opened by WinObj

RtlInitUnicodeString(&sddl, _T(“D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;GA;;;BU)”));

status = IoCreateDeviceSecure(
pDriverObject,
sizeof(DEVICE_EXTENSION),
pDeviceName,
FILE_DEVICE_DISK,
0,
FALSE,
&sddl,
NULL,
&pDeviceObject
); // Succeed

IoCreateSymbolicLink(…) // Succeed

And I tried to open in user mode(Run as administrator)

CreateFile(DeviceSymlinkName, …) // fail ERROR_FILE_NOT_FOUND

The device has been created and it’s symbolic link created well(in /GLOBAL?? namespace)

Sysinternals WinObj can’t open the device either.(But the device is represented well on WinObj’s list)

If I create the device on DriverEntry routine, I can open the device well.
But I create the device on DeviceIoControl routine, I can’t open and WinObj can’t either.
So, I tried to make a system thread in DeviceIoContol routine, and made a device in system thread. But it didn’t work.

What’s wrong?

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

4

@chang pei

Yes, it’s right.

5

@Doron Holan

Oh my god. I missed it. Thank you very much.

By the way, in DriverEntry routine, I didn’t remove the flag either.

After DriverEntry routine, does Windows Excutive(probably IoManager? is it right?) remove the flag automatically?

6

Yes, the io manager clears the flag for you for every device object you create in DriverEntry

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Sunday, August 22, 2010 8:34 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] A device which isn’t opened by WinObj

@Doron Holan

Oh my god. I missed it. Thank you very much.

By the way, in DriverEntry routine, I didn’t remove the flag either.

After DriverEntry routine, does Windows Excutive(probably IoManager? is it right?) remove the flag automatically?

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

7

> If I create the device on DriverEntry routine, I can open the device well.

But I create the device on DeviceIoControl routine, I can’t open and WinObj can’t either.

Reset the DO_DEVICE_INITIALIZING flag manually.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

8

> After DriverEntry routine, does Windows Excutive(probably IoManager? is it right?) remove the flag

automatically?

Yes.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com