Files copied to system32\drivers missing

Hi Ntdev,

I know windows has System File Protection(SFP) on the files in system32\drivers and what ever modification we do is ignored and even when we delete a sys file it is replaced right away. However I was under the impresion that if I were to copy my own file say abcd.sys to system32\drivers it would remain untouched. However it does not appear so.

The funny thing is if I do ls -l (Mksnt) I do see my abcd.sys but if I do a dir or attrib I dont see it? I can do a cp or mv (both mksnt) but I cannot fo a copy or move. Hence my app when it tries to starts the service gets ERROR_FILE_NOT_FOUND error. Please advice on what is the correct and official way of copying sys file to system32\drivers so that Windows apps can see it?

I am runnign W2K3 Server 64 bit OS

thanks
ananda

Probably you became victim of the file system redirector and you are copying
from a 32 bit process without any special measures. Look in
Windows\SysWow32\Drivers to see if you can find it there.

/Daniel

wrote in message news:xxxxx@ntdev…
> Hi Ntdev,
>
> I know windows has System File Protection(SFP) on the files in
> system32\drivers and what ever modification we do is ignored and even when
> we delete a sys file it is replaced right away. However I was under the
> impresion that if I were to copy my own file say abcd.sys to
> system32\drivers it would remain untouched. However it does not appear so.
>
> The funny thing is if I do ls -l (Mksnt) I do see my abcd.sys but if I do
> a dir or attrib I dont see it? I can do a cp or mv (both mksnt) but I
> cannot fo a copy or move. Hence my app when it tries to starts the service
> gets ERROR_FILE_NOT_FOUND error. Please advice on what is the correct and
> official way of copying sys file to system32\drivers so that Windows apps
> can see it?
>
> I am runnign W2K3 Server 64 bit OS
>
> thanks
> ananda
>
>

Wow! I mean WOW64!! They ended up in C:\WINDOWS\SysWOW64\Drivers. I
don’t have SysWow32. But thanks for the suggestion it solved my problem.
Now, since I know where it is, I can point my StartService to the
SysWow64\drivers and it should work. My guess is since my driver is a
pure EM64-T driver built using the x64 DDK the OS copies it over
silently to SysWow64\drivers. I am sure it leaves a link or some trail
behind which the mksnt tools exploits and dir does not. Thanks again my
problem is solved. This thread can be closed.
Regards
ananda

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Daniel Terhell
Sent: Saturday, September 22, 2007 11:49 PM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] Files copied to system32\drivers missing

Probably you became victim of the file system redirector and you are
copying
from a 32 bit process without any special measures. Look in
Windows\SysWow32\Drivers to see if you can find it there.

/Daniel

wrote in message news:xxxxx@ntdev…
> Hi Ntdev,
>
> I know windows has System File Protection(SFP) on the files in
> system32\drivers and what ever modification we do is ignored and even
when
> we delete a sys file it is replaced right away. However I was under
the
> impresion that if I were to copy my own file say abcd.sys to
> system32\drivers it would remain untouched. However it does not appear
so.
>
> The funny thing is if I do ls -l (Mksnt) I do see my abcd.sys but if I
do
> a dir or attrib I dont see it? I can do a cp or mv (both mksnt) but I
> cannot fo a copy or move. Hence my app when it tries to starts the
service
> gets ERROR_FILE_NOT_FOUND error. Please advice on what is the correct
and
> official way of copying sys file to system32\drivers so that Windows
apps
> can see it?
>
> I am runnign W2K3 Server 64 bit OS
>
> thanks
> ananda
>
>


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

> -----Original Message-----

From: xxxxx@lists.osr.com [mailto:bounce-301196-
xxxxx@lists.osr.com] On Behalf Of Vardhana, Ananda
Sent: Sunday, September 23, 2007 12:02 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Files copied to system32\drivers missing

Wow! I mean WOW64!! They ended up in C:\WINDOWS\SysWOW64\Drivers. I
don’t have SysWow32. But thanks for the suggestion it solved my
problem.
Now, since I know where it is, I can point my StartService to the
SysWow64\drivers and it should work. My guess is since my driver is a
pure EM64-T driver built using the x64 DDK the OS copies it over
silently to SysWow64\drivers. I am sure it leaves a link or some trail
behind which the mksnt tools exploits and dir does not. Thanks again my
problem is solved. This thread can be closed.
Regards
ananda
[PCAUSA] Actually, maybe not…

On x64 systems 32-bit applications are handled specially when they attempt
to access “the system folder” and below. And names are nonsense.

On x64 systems 64-bit executables are located in the (sorry…) System32
folder. 64-bit drivers are located (sorry…) in the System32\Drivers
folder.

On x64 systems 32-bit executables that would be located in “the system
folder” on 32-bit machines will be located in the (sorry…) SysWow64
folder.

If you use a 32-bit application on a 64-bit machine to access “the system
folder”, then behind the scenes the system maps the path to the SysWow64
folder. So, on a 64-bit system if a 32-bit application (e.g., a 32-bit
installer…) tries to copy a driver to the “System32\Drivers” folder, it
ends up in the “SysWow64\Drivers” folder - which is the wrong place.

If you convert the same installer application to be a 64-bit application,
then the driver goes to the “System32\Drivers” folder - where all 64-bit
drivers should reside.

I hope this has been helpful…

Thomas F. Divine

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Daniel Terhell
Sent: Saturday, September 22, 2007 11:49 PM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] Files copied to system32\drivers missing

Probably you became victim of the file system redirector and you are
copying
from a 32 bit process without any special measures. Look in
Windows\SysWow32\Drivers to see if you can find it there.

/Daniel

wrote in message news:xxxxx@ntdev…
> > Hi Ntdev,
> >
> > I know windows has System File Protection(SFP) on the files in
> > system32\drivers and what ever modification we do is ignored and even
> when
> > we delete a sys file it is replaced right away. However I was under
> the
> > impresion that if I were to copy my own file say abcd.sys to
> > system32\drivers it would remain untouched. However it does not
> appear
> so.
> >
> > The funny thing is if I do ls -l (Mksnt) I do see my abcd.sys but if
> I
> do
> > a dir or attrib I dont see it? I can do a cp or mv (both mksnt) but I
> > cannot fo a copy or move. Hence my app when it tries to starts the
> service
> > gets ERROR_FILE_NOT_FOUND error. Please advice on what is the
> correct
> and
> > official way of copying sys file to system32\drivers so that Windows
> apps
> > can see it?
> >
> > I am runnign W2K3 Server 64 bit OS
> >
> > thanks
> > ananda
> >
> >
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer

Thanks Thomas, now I know exactly what is what(It is indeed a holy mess
:-)) and my program is working as it should.
Best
Ananda

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Thomas F. Divine
Sent: Sunday, September 23, 2007 9:45 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Files copied to system32\drivers missing

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-301196-
xxxxx@lists.osr.com] On Behalf Of Vardhana, Ananda
Sent: Sunday, September 23, 2007 12:02 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Files copied to system32\drivers missing

Wow! I mean WOW64!! They ended up in C:\WINDOWS\SysWOW64\Drivers. I
don’t have SysWow32. But thanks for the suggestion it solved my
problem.
Now, since I know where it is, I can point my StartService to the
SysWow64\drivers and it should work. My guess is since my driver is a
pure EM64-T driver built using the x64 DDK the OS copies it over
silently to SysWow64\drivers. I am sure it leaves a link or some trail
behind which the mksnt tools exploits and dir does not. Thanks again
my
problem is solved. This thread can be closed.
Regards
ananda
[PCAUSA] Actually, maybe not…

On x64 systems 32-bit applications are handled specially when they
attempt
to access “the system folder” and below. And names are nonsense.

On x64 systems 64-bit executables are located in the (sorry…) System32
folder. 64-bit drivers are located (sorry…) in the System32\Drivers
folder.

On x64 systems 32-bit executables that would be located in “the system
folder” on 32-bit machines will be located in the (sorry…) SysWow64
folder.

If you use a 32-bit application on a 64-bit machine to access “the
system
folder”, then behind the scenes the system maps the path to the SysWow64
folder. So, on a 64-bit system if a 32-bit application (e.g., a 32-bit
installer…) tries to copy a driver to the “System32\Drivers” folder,
it
ends up in the “SysWow64\Drivers” folder - which is the wrong place.

If you convert the same installer application to be a 64-bit
application,
then the driver goes to the “System32\Drivers” folder - where all 64-bit
drivers should reside.

I hope this has been helpful…

Thomas F. Divine

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Daniel Terhell
Sent: Saturday, September 22, 2007 11:49 PM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] Files copied to system32\drivers missing

Probably you became victim of the file system redirector and you are
copying
from a 32 bit process without any special measures. Look in
Windows\SysWow32\Drivers to see if you can find it there.

/Daniel

wrote in message news:xxxxx@ntdev…
> > Hi Ntdev,
> >
> > I know windows has System File Protection(SFP) on the files in
> > system32\drivers and what ever modification we do is ignored and
even
> when
> > we delete a sys file it is replaced right away. However I was under
> the
> > impresion that if I were to copy my own file say abcd.sys to
> > system32\drivers it would remain untouched. However it does not
> appear
> so.
> >
> > The funny thing is if I do ls -l (Mksnt) I do see my abcd.sys but if
> I
> do
> > a dir or attrib I dont see it? I can do a cp or mv (both mksnt) but
I
> > cannot fo a copy or move. Hence my app when it tries to starts the
> service
> > gets ERROR_FILE_NOT_FOUND error. Please advice on what is the
> correct
> and
> > official way of copying sys file to system32\drivers so that Windows
> apps
> > can see it?
> >
> > I am runnign W2K3 Server 64 bit OS
> >
> > thanks
> > ananda
> >
> >
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer