About ZwCreateSection

Hello,
All.I have created a named section object with ZwCreateSection function in my driver. The code to accomplish this process is shown in figure 1.

BOOLEAN g_CreateFlag = FALSE;
NTSTATUS AutoStartCreate(IN PDEVICE_OBJECT fdo, IN PIRP Irp)
{
PIO_STACK_LOCATION IrpStack = IoGetCurrentIrpStackLocation(Irp);
if (!g_CreateFlag)
{
LARGE_INTEGER size;
UNICODE_STRING usSectionName;
OBJECT_ATTRIBUTES objAttributes;
NTSTATUS status;

RtlInitUnicodeString(&usSectionName, L"\BaseNamedObjects\UserKernelSharedSection");
InitializeObjectAttributes(&objAttributes, &usSectionName, OBJ_CASE_INSENSITIVE, NULL, NULL);
size.HighPart = 0;
size.LowPart = 11074560;
status = ZwCreateSection(&g_hSection,SECTION_ALL_ACCESS, &objAttributes,&size,PAGE_READWRITE,0x8000000,NULL);
if(NT_SUCCESS(status))
{
g_CreateFlag = TRUE;
}

return CompleteIrp(Irp,STATUS_SUCCESS,0);
}
figure 1

In xp system, I can open successfully the object in my user_mode application. In vista,when I open the object ,the system tell me it can’t find the file. The code to open the object is shown in figure 2.

HANDLE hSection;
hSection = ::OpenFileMapping(FILE_MAP_READ|FILE_MAP_WRITE, FALSE, “UserKernelSharedSection”);
if (hSection == NULL)
{
LPVOID msg;
::FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,
NULL, GetLastError(),
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
(LPTSTR)&msg, 0, NULL);
AfxMessageBox((LPTSTR)msg);
::LocalFree(msg);
}
else
AfxMessageBox(_T(“OpenFileMapping OK”));

figure 2

Why? Could you help me? Thanks in advance!

Probably Vista uses other naming then \BaseNamedObjects

I would nearly never use shared memory between UM and KM. Using IOCTLs seems to be much better way.


Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

wrote in message news:xxxxx@ntfsd…
> Hello,
> All.I have created a named section object with ZwCreateSection function in my driver. The code to accomplish this process is shown in figure 1.
>
> BOOLEAN g_CreateFlag = FALSE;
> NTSTATUS AutoStartCreate(IN PDEVICE_OBJECT fdo, IN PIRP Irp)
> {
> PIO_STACK_LOCATION IrpStack = IoGetCurrentIrpStackLocation(Irp);
> if (!g_CreateFlag)
> {
> LARGE_INTEGER size;
> UNICODE_STRING usSectionName;
> OBJECT_ATTRIBUTES objAttributes;
> NTSTATUS status;
>
> RtlInitUnicodeString(&usSectionName, L"\BaseNamedObjects\UserKernelSharedSection");
> InitializeObjectAttributes(&objAttributes, &usSectionName, OBJ_CASE_INSENSITIVE, NULL, NULL);
> size.HighPart = 0;
> size.LowPart = 11074560;
> status = ZwCreateSection(&g_hSection,SECTION_ALL_ACCESS, &objAttributes,&size,PAGE_READWRITE,0x8000000,NULL);
> if(NT_SUCCESS(status))
> {
> g_CreateFlag = TRUE;
> }
>
> return CompleteIrp(Irp,STATUS_SUCCESS,0);
> }
> figure 1
>
> In xp system, I can open successfully the object in my user_mode application. In vista,when I open the object ,the system tell me it can’t find the file. The code to open the object is shown in figure 2.
>
> HANDLE hSection;
> hSection = ::OpenFileMapping(FILE_MAP_READ|FILE_MAP_WRITE, FALSE, “UserKernelSharedSection”);
> if (hSection == NULL)
> {
> LPVOID msg;
> ::FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,
> NULL, GetLastError(),
> MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
> (LPTSTR)&msg, 0, NULL);
> AfxMessageBox((LPTSTR)msg);
> ::LocalFree(msg);
> }
> else
> AfxMessageBox(_T(“OpenFileMapping OK”));
>
> figure 2
>
> Why? Could you help me? Thanks in advance!
>
>

Try “Global\UserKernelSharedSection” in the app? I’d imagine this happens because you are lucking out and remaining on session 0 mostly in your limited testing on XP (this isn’t always the case). It generally almost never the case that code interacting directly with the user runs on session zero in Vista and beyond.

  • S

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of wanmingliangdan@163.com
Sent: Friday, December 26, 2008 4:27 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] About ZwCreateSection

Hello,
All.I have created a named section object with ZwCreateSection function in my driver. The code to accomplish this process is shown in figure 1.

BOOLEAN g_CreateFlag = FALSE;
NTSTATUS AutoStartCreate(IN PDEVICE_OBJECT fdo, IN PIRP Irp)
{
PIO_STACK_LOCATION IrpStack = IoGetCurrentIrpStackLocation(Irp);
if (!g_CreateFlag)
{
LARGE_INTEGER size;
UNICODE_STRING usSectionName;
OBJECT_ATTRIBUTES objAttributes;
NTSTATUS status;

RtlInitUnicodeString(&usSectionName, L"\BaseNamedObjects\UserKernelSharedSection");
InitializeObjectAttributes(&objAttributes, &usSectionName, OBJ_CASE_INSENSITIVE, NULL, NULL);
size.HighPart = 0;
size.LowPart = 11074560;
status = ZwCreateSection(&g_hSection,SECTION_ALL_ACCESS, &objAttributes,&size,PAGE_READWRITE,0x8000000,NULL);
if(NT_SUCCESS(status))
{
g_CreateFlag = TRUE;
}

return CompleteIrp(Irp,STATUS_SUCCESS,0);
}
figure 1

In xp system, I can open successfully the object in my user_mode application. In vista,when I open the object ,the system tell me it can’t find the file. The code to open the object is shown in figure 2.

HANDLE hSection;
hSection = ::OpenFileMapping(FILE_MAP_READ|FILE_MAP_WRITE, FALSE, “UserKernelSharedSection”);
if (hSection == NULL)
{
LPVOID msg;
::FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,
NULL, GetLastError(),
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
(LPTSTR)&msg, 0, NULL);
AfxMessageBox((LPTSTR)msg);
::LocalFree(msg);
}
else
AfxMessageBox(_T(“OpenFileMapping OK”));

figure 2

Why? Could you help me? Thanks in advance!


NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@valhallalegends.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

>Try “Global\UserKernelSharedSection” in the app?

Am I wrong it should be \GLOBAL?? or ??GLOBAL
?


Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

No, the symlink in the BNO directory used by Win32 for the current session is called Global. It points to \Global?? Typically. Check the Platform SDK documentation on object naming.

? S

-----Original Message-----
From: Maxim S. Shatskih
Sent: Friday, December 26, 2008 13:52
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] About ZwCreateSection

>Try “Global\UserKernelSharedSection” in the app?

Am I wrong it should be \GLOBAL?? or ??GLOBAL
?


Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com


NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Thanks everyone ! I have resolved this problem. Use “Global\UserKernelSharedSection” in the app.