FILE_INTERNAL_INFORMATION on NTFS volume fails

NTFSD
1

Hi,

Does anybody have experience with querying FILE_INTERNAL_INFORMATION with
ZwQueryVolumeInformationFile to get the file reference number of a file,
i.e.:

status = ZwQueryVolumeInformationFile( fileHandle, &ioStatusBlock, fileInfo,
sizeof(FILE_INTERNAL_INFORMATION), FileInternalInformation );

I am trying to execute this command on an NTFS volume on XP SP2, but I just
can’t make it work.

First, I tried to set the Length parameter to
sizeof(FILE_INTERNAL_INFORMATION) as shown above, but then I got a
PAGE_FAULT_BEYOND_END_OF_ALLOCATION bugcheck.

Next, I allocated a 1000 bytes buffer, just to see what would happen. The
command succeeded (both status == STATUS_SUCCESS and ioStatusBlock.Status ==
STATUS_SUCCESS), but fileInfo->IndexNumber (file reference number) was 0 and
ioStatusBlock.Information (number of bytes written) was 0x30. This is really
strange, since sizeof(FILE_INTERNAL_INFORMATION) == 8.

It is just as if I get other information than what I ask for.

When I try to query other information, e.g. FILE_FS_ATTRIBUTE_INFORMATION,
it works perfectly.

I have tried different combinations of arguments to ZwCreateFile when I open
the file handle, but the result is always the same. Can anybody tell me what
I am doing wrong?

Thanks,

Carsten Schmidt

2

I don’t think your code is asking for what YOU think you are asking for.
Internal ID is a file (or directory) attribute, but you are using the
volume API to retrieve it. Thus, you are asking for
FileFsControlInformation (= 6, just like FileInternalInformation, but in
a different enum value).

From my count, the FILE_FS_CONTROL_INFORMATION structure contains 5
LARGE_INTEGER values and one ULONG, so 0x30 is probably padded out (I
get 0x2c when I count it) by the compiler.

Try doing this, but use ZwQueryInformationFile on a file or directory
instead - I think it will behave the way you expect.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Carsten Schmidt
Sent: Wednesday, October 13, 2004 8:52 PM
To: ntfsd redirect
Subject: [ntfsd] FILE_INTERNAL_INFORMATION on NTFS volume fails

Hi,

Does anybody have experience with querying FILE_INTERNAL_INFORMATION
with
ZwQueryVolumeInformationFile to get the file reference number of a file,

i.e.:

status = ZwQueryVolumeInformationFile( fileHandle, &ioStatusBlock,
fileInfo,
sizeof(FILE_INTERNAL_INFORMATION), FileInternalInformation );

I am trying to execute this command on an NTFS volume on XP SP2, but I
just
can’t make it work.

First, I tried to set the Length parameter to
sizeof(FILE_INTERNAL_INFORMATION) as shown above, but then I got a
PAGE_FAULT_BEYOND_END_OF_ALLOCATION bugcheck.

Next, I allocated a 1000 bytes buffer, just to see what would happen.
The
command succeeded (both status == STATUS_SUCCESS and
ioStatusBlock.Status ==
STATUS_SUCCESS), but fileInfo->IndexNumber (file reference number) was 0
and
ioStatusBlock.Information (number of bytes written) was 0x30. This is
really
strange, since sizeof(FILE_INTERNAL_INFORMATION) == 8.

It is just as if I get other information than what I ask for.

When I try to query other information, e.g.
FILE_FS_ATTRIBUTE_INFORMATION,
it works perfectly.

I have tried different combinations of arguments to ZwCreateFile when I
open
the file handle, but the result is always the same. Can anybody tell me
what
I am doing wrong?

Thanks,

Carsten Schmidt

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Of course! I was looking totally in the wrong direction.

Thanks,

Carsten Schmidt

“Tony Mason” wrote in message news:xxxxx@ntfsd…
I don’t think your code is asking for what YOU think you are asking for.
Internal ID is a file (or directory) attribute, but you are using the
volume API to retrieve it. Thus, you are asking for
FileFsControlInformation (= 6, just like FileInternalInformation, but in
a different enum value).

From my count, the FILE_FS_CONTROL_INFORMATION structure contains 5
LARGE_INTEGER values and one ULONG, so 0x30 is probably padded out (I
get 0x2c when I count it) by the compiler.

Try doing this, but use ZwQueryInformationFile on a file or directory
instead - I think it will behave the way you expect.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Carsten Schmidt
Sent: Wednesday, October 13, 2004 8:52 PM
To: ntfsd redirect
Subject: [ntfsd] FILE_INTERNAL_INFORMATION on NTFS volume fails

Hi,

Does anybody have experience with querying FILE_INTERNAL_INFORMATION
with
ZwQueryVolumeInformationFile to get the file reference number of a file,

i.e.:

status = ZwQueryVolumeInformationFile( fileHandle, &ioStatusBlock,
fileInfo,
sizeof(FILE_INTERNAL_INFORMATION), FileInternalInformation );

I am trying to execute this command on an NTFS volume on XP SP2, but I
just
can’t make it work.

First, I tried to set the Length parameter to
sizeof(FILE_INTERNAL_INFORMATION) as shown above, but then I got a
PAGE_FAULT_BEYOND_END_OF_ALLOCATION bugcheck.

Next, I allocated a 1000 bytes buffer, just to see what would happen.
The
command succeeded (both status == STATUS_SUCCESS and
ioStatusBlock.Status ==
STATUS_SUCCESS), but fileInfo->IndexNumber (file reference number) was 0
and
ioStatusBlock.Information (number of bytes written) was 0x30. This is
really
strange, since sizeof(FILE_INTERNAL_INFORMATION) == 8.

It is just as if I get other information than what I ask for.

When I try to query other information, e.g.
FILE_FS_ATTRIBUTE_INFORMATION,
it works perfectly.

I have tried different combinations of arguments to ZwCreateFile when I
open
the file handle, but the result is always the same. Can anybody tell me
what
I am doing wrong?

Thanks,

Carsten Schmidt

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com