Access files on a mapped network drive

NTDEV
1

Hello all:

I’m trying to access files on a mapped network drive. It seems that it always returns 0xC000003A on XP if I just pass W:\Test.txt to ZwCreateFile.

I searched on this list for couple hours but could not get any ideas which I have ever seen sometime ago.

Is there any kernel way except using a helper DLL to translate W:\Test.txt to a UNC path?

Thanks in advance.

R.Y.

2

Mapped drives are local to the user session accessing the network share (I
don’t know if ‘user session’ is the right term…).

Is the code executing ZwCreateFile running in the context of the calling
process (if any)?

Have a nice day
GV

----- Original Message -----
From:
To: “Windows System Software Devs Interest List”
Sent: Monday, November 06, 2006 3:11 PM
Subject: [ntdev] Access files on a mapped network drive

> Hello all:
>
> I’m trying to access files on a mapped network drive. It seems that it
> always returns 0xC000003A on XP if I just pass W:\Test.txt to
> ZwCreateFile.
>
> I searched on this list for couple hours but could not get any ideas which
> I have ever seen sometime ago.
>
> Is there any kernel way except using a helper DLL to translate W:\Test.txt
> to a UNC path?
>
> Thanks in advance.
>
> R.Y.
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer

3

ZwCreateFile runs in a impersonated system thread. It can access UNC files but fails with mapped network files.

I do not think it’s the problem of user rights since 0xC000003A means Object_not_found. I know there is no volume object of W:. So I guess there may be another solution for accessing such files in kernel. Or AFD?

4

xxxxx@ybwork.com wrote:

ZwCreateFile runs in a impersonated system thread. It can access UNC files but fails with mapped network files.

I do not think it’s the problem of user rights since 0xC000003A means Object_not_found. I know there is no volume object of W:. So I guess there may be another solution for accessing such files in kernel.

Sure there is. Use UNC names instead of the mapped drive letters.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

5

Drive letter share mappings are in a special object directory that is named
per-logon-session. In general, this means they won’t work in a driver like
you might hope unless your caller is always in the same logon session
context (unlikely).

–
Ken Johnson (Skywing)
Windows SDK MVP
http://www.nynaeve.net

wrote in message news:xxxxx@ntdev…
> Hello all:
>
> I’m trying to access files on a mapped network drive. It seems that it
> always returns 0xC000003A on XP if I just pass W:\Test.txt to
> ZwCreateFile.
>
> I searched on this list for couple hours but could not get any ideas which
> I have ever seen sometime ago.
>
> Is there any kernel way except using a helper DLL to translate W:\Test.txt
> to a UNC path?
>
> Thanks in advance.
>
> R.Y.
>

6

Not sure the term of ‘same logon session’. If you mean the Windows logon, that’s what I have done. In my driver, whenever I try to access a remote file, I use the logged-on user’s credentials from a helper DLL to impersonate the worker thread before calling Zwxxx.

I’m interested in ‘special object directory’. Is this availabe in kernel?

Or, simply, any solution to translate W:\test.txt to \Server\share\test.txt in Windows kernel mode? This is the key point of my question.

7

LSA logon session. Try exploring with WinObj in
\Sessions<ts-session-id>\DosDevices<lsa-logon-session-id> and you should
see mapped drive letter symlinks there. This naming convention for `net
use’d’ drive letters is undocumented and subject to change, and is new to
Windows XP.

–
Ken Johnson (Skywing)
Windows SDK MVP
http://www.nynaeve.net

wrote in message news:xxxxx@ntdev…
> [quote]
> In general, this means they won’t work in a driver like
> you might hope unless your caller is always in the same logon session
> context (unlikely).
> [/quote]
>
> Not sure the term of ‘same logon session’. If you mean the Windows logon,
> that’s what I have done. In my driver, whenever I try to access a remote
> file, I use the logged-on user’s credentials from a helper DLL to
> impersonate the worker thread before calling Zwxxx.
>
> I’m interested in ‘special object directory’. Is this availabe in kernel?
>
> Or, simply, any solution to translate W:\test.txt to
> \Server\share\test.txt in Windows kernel mode? This is the key point of
> my question.
>

8

hmmm…if it’s specific to XP, I can not use it in a commercial product. Anyway, thanks.