Access (Read) file from the driver

NTDEV
1

I am a newbie in Windows Driver Development and have a general question regarding file access from the driver.

Is it possible to open and read the file from the driver?
I assuem that the driver is device driver (KMDF) and it knows where the files are.

If yes, what’s the API to use?

Thanks.

2

Yes, it is possible, but there are restrictions on when you can do this, and
the path format is different.

In short, it’s more complicated that from user mode.

You might want to start by reading about ZwCreateFile.

Good luck,

mm

On Fri, Sep 23, 2011 at 5:16 PM, wrote:

> I am a newbie in Windows Driver Development and have a general question
> regarding file access from the driver.
>
> Is it possible to open and read the file from the driver?
> I assuem that the driver is device driver (KMDF) and it knows where the
> files are.
>
> If yes, what’s the API to use?
>
>
> Thanks.
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

3

Well, since it is a driver, it wouldn’t be an API (Application Program
Interface). It would be a DDI (Device Driver Interface) call. Look at
ZwCreateFile, ZwReadFile, ZwWriteFile, ZwClose. Critical here is that you
can only open, close, read and/or write a file from PASSIVE_LEVEL. Don’t
try to update it in your DPC or you will die horribly blue. So you have
to think about using worker threads (either from the file system thread
pool or one of your own) to handle file transactions, or do them from
top-level dispatch routines (which has its own set of hazards).

Note carefully that these calls do NOT use the same parameters as the APIs
they are named after!
joe

I am a newbie in Windows Driver Development and have a general question
regarding file access from the driver.

Is it possible to open and read the file from the driver?
I assuem that the driver is device driver (KMDF) and it knows where the
files are.

If yes, what’s the API to use?

Thanks.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

4

> Is it possible to open and read the file from the driver?

ZwCreate/Read/Write/File.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

5

> If yes, what’s the API to use?

Also note the context limitations on ZwXxxFile calls.

a) PASSIVE_LEVEL only

b) never ever make any low-level work (in the disk/volume filter, on which the FSD itself is depending) dependant on ZwXxx stuff.

Yes, you can bypass the PASSIVE_LEVEL limitation using IoQueueWorkItem, but, if the below-FSD disk request is pended till your work item will complete, and your work item does ZwXxx - then this is recipe for deadlock. There are just plain no 100% reliable ways to solve this, and you will have a flow of total hang issues in the field if you will release such a product.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

6

Thank you all for comments!