File Open

NTFSD
1

Hi all,

How to open a file using INT 0x2E directly ?

Thanks in Advance,
Satish K.S

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

The parameters in eax define what Api is called.
however these can change between service packs.

Better use Native Apis , if you really want it.

regards
jeseem
mailto:xxxxx@hotmail.com

From: “Satish”
>Reply-To: “File Systems Developers”
>To: “File Systems Developers”
>Subject: [ntfsd] File Open
>Date: Wed, 28 Mar 2001 21:14:38 +0530
>
>Hi all,
>
>How to open a file using INT 0x2E directly ?
>
>Thanks in Advance,
>Satish K.S
>
>
>—
>You are currently subscribed to ntfsd as: xxxxx@hotmail.com
>To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

_________________________________________________________________________
Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

3

This is just a curious. Can u explain me ?

Regards,
Satish K.S

----- Original Message -----
From: “jeseem S”
To: “File Systems Developers”
Sent: Wednesday, March 28, 2001 4:16 PM
Subject: [ntfsd] Re: File Open

> The parameters in eax define what Api is called.
> however these can change between service packs.
>
> Better use Native Apis , if you really want it.
>
> regards
> jeseem
> mailto:xxxxx@hotmail.com
>
>
> >From: “Satish”
> >Reply-To: “File Systems Developers”
> >To: “File Systems Developers”
> >Subject: [ntfsd] File Open
> >Date: Wed, 28 Mar 2001 21:14:38 +0530
> >
> >Hi all,
> >
> >How to open a file using INT 0x2E directly ?
> >
> >Thanks in Advance,
> >Satish K.S
> >
> >
> >—
> >You are currently subscribed to ntfsd as: xxxxx@hotmail.com
> >To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
> _________________________________________________________________________
> Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@aalayance.com
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

4

take a look at this.
http://www.cmkrnl.com/arc-newint2e.html
Its fairly descriptive

regards
jeseem
mailto:xxxxx@hotmail.com

From: “Satish”
>Reply-To: “File Systems Developers”
>To: “File Systems Developers”
>Subject: [ntfsd] Re: File Open
>Date: Wed, 28 Mar 2001 21:53:45 +0530
>
>This is just a curious. Can u explain me ?
>
>Regards,
>Satish K.S
>
>----- Original Message -----
>From: “jeseem S”
>To: “File Systems Developers”
>Sent: Wednesday, March 28, 2001 4:16 PM
>Subject: [ntfsd] Re: File Open
>
>
> > The parameters in eax define what Api is called.
> > however these can change between service packs.
> >
> > Better use Native Apis , if you really want it.
> >
> > regards
> > jeseem
> > mailto:xxxxx@hotmail.com
> >
> >
> > >From: “Satish”
> > >Reply-To: “File Systems Developers”
> > >To: “File Systems Developers”
> > >Subject: [ntfsd] File Open
> > >Date: Wed, 28 Mar 2001 21:14:38 +0530
> > >
> > >Hi all,
> > >
> > >How to open a file using INT 0x2E directly ?
> > >
> > >Thanks in Advance,
> > >Satish K.S
> > >
> > >
> > >—
> > >You are currently subscribed to ntfsd as: xxxxx@hotmail.com
> > >To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
> >
>
> > Get Your Private, Free E-mail from MSN Hotmail at
>http://www.hotmail.com.
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@aalayance.com
> > To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
>—
>You are currently subscribed to ntfsd as: xxxxx@hotmail.com
>To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

5

This will explain about Adding our own services in Kernal mode.

Actually i wanted to open a file from user Mode using 0x2E. Anybody has idea
?

Thanks in Advance,
Satish K.S

----- Original Message -----
From: “jeseem S”
To: “File Systems Developers”
Sent: Wednesday, March 28, 2001 4:42 PM
Subject: [ntfsd] Re: File Open

> take a look at this.
> http://www.cmkrnl.com/arc-newint2e.html
> Its fairly descriptive
>
> regards
> jeseem
> mailto:xxxxx@hotmail.com
>
>
> >From: “Satish”
> >Reply-To: “File Systems Developers”
> >To: “File Systems Developers”
> >Subject: [ntfsd] Re: File Open
> >Date: Wed, 28 Mar 2001 21:53:45 +0530
> >
> >This is just a curious. Can u explain me ?
> >
> >Regards,
> >Satish K.S
> >
> >----- Original Message -----
> >From: “jeseem S”
> >To: “File Systems Developers”
> >Sent: Wednesday, March 28, 2001 4:16 PM
> >Subject: [ntfsd] Re: File Open
> >
> >
> > > The parameters in eax define what Api is called.
> > > however these can change between service packs.
> > >
> > > Better use Native Apis , if you really want it.
> > >
> > > regards
> > > jeseem
> > > mailto:xxxxx@hotmail.com
> > >
> > >
> > > >From: “Satish”
> > > >Reply-To: “File Systems Developers”
> > > >To: “File Systems Developers”
> > > >Subject: [ntfsd] File Open
> > > >Date: Wed, 28 Mar 2001 21:14:38 +0530
> > > >
> > > >Hi all,
> > > >
> > > >How to open a file using INT 0x2E directly ?
> > > >
> > > >Thanks in Advance,
> > > >Satish K.S
> > > >
> > > >
> > > >—
> > > >You are currently subscribed to ntfsd as: xxxxx@hotmail.com
> > > >To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> > >
> > >
> >
> > > Get Your Private, Free E-mail from MSN Hotmail at
> >http://www.hotmail.com.
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@aalayance.com
> > > To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
> >
> >—
> >You are currently subscribed to ntfsd as: xxxxx@hotmail.com
> >To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
> Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@aalayance.com
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

6

> Actually i wanted to open a file from user Mode using 0x2E. Anybody has
idea

Why not use CreateFile (well, or NtCreateFile - Win32 does not support
specifying the allocation size for a newly created file) for this?
If you really need this for some weird reason - disassemble
ntdll!NtCreateFile and do the same. It is a very short function of several
instructions - int 2eh is one of them.

Max

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

7

Here is the Code which i got and tried

mov eax, 64h
lea edx, [esp+Argument1]
int 2eh

This is not working. It is not switching to Kernal mode only
Do u have any idea?

Regards,
Satish K.S

----- Original Message -----
From: “Maxim S. Shatskih”
To: “File Systems Developers”
Sent: Friday, March 30, 2001 5:47 PM
Subject: [ntfsd] Re: File Open

> > Actually i wanted to open a file from user Mode using 0x2E. Anybody has
> idea
>
> Why not use CreateFile (well, or NtCreateFile - Win32 does not support
> specifying the allocation size for a newly created file) for this?
> If you really need this for some weird reason - disassemble
> ntdll!NtCreateFile and do the same. It is a very short function of several
> instructions - int 2eh is one of them.
>
> Max
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@aalayance.com
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com