Hi all,
I try to use ZwSetInformationFile with FileShortNameInformation. I call this
routine in my driver entry routine (just for testing) and the ZwSetInfo…
call always fail with STATUS_PRIVILEGE_NOT_HELD.
I use Win XP Pro, the volume is NTFS and it is mounted. I have also enabled
the privilege SE_RESTORE_PRIVILEGE using ZwAdjustPrivilegesToken on the
current process token. But is still fails.
Does anybody know what I am doing wrong?
The non-working code looks like this:
NTSTATUS status; TOKEN_PRIVILEGES privSet; HANDLE tokenHandle;
TOKEN_PRIVILEGES tokenPriv;
// Open current process token
status = ZwOpenProcessToken(NtCurrentProcess(), TOKEN_ALL_ACCESS,
&tokenHandle);
if ( !NT_SUCCESS( status ) )
{
KdPrint((“[BCatDriver] NtOpenProcessToken failed, status 0x%x\n”,
status));
return status;
}
// Set up the information about the privilege we are adjusting
privSet.PrivilegeCount = 1;
privSet.Privileges[0].Luid = RtlConvertUlongToLuid(SE_RESTORE_PRIVILEGE);
privSet.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
status = ZwAdjustPrivilegesToken(tokenHandle, FALSE, &privSet,
sizeof(privSet), NULL, NULL);
if ( !NT_SUCCESS( status ) )
KdPrint((“[BCatDriver] ZwAdjustPrivilegesToken failed, status 0x%x\n”,
status));
ZwClose(tokenHandle);
OBJECT_ATTRIBUTES oa; UNICODE_STRING filenameu; HANDLE handle;
IO_STATUS_BLOCK iosb;
RtlInitUnicodeString( &filenameu, L"\DosDevices\C:\directory1" );
InitializeObjectAttributes( &oa, &filenameu, OBJ_CASE_INSENSITIVE|
OBJ_KERNEL_HANDLE , NULL, NULL );
NTSTATUS ntStatus = ZwCreateFile( &handle, GENERIC_WRITE|DELETE, &oa,
&iosb, 0, FILE_ATTRIBUTE_NORMAL, 0, FILE_OPEN, 0, NULL, 0 );
if ( NT_SUCCESS( ntStatus ) )
{
PFILE_NAME_INFORMATION fileNameInfo = (PFILE_NAME_INFORMATION) new
(PagedPool) WCHAR[20];
fileNameInfo->FileNameLength = wcslen( L"direct~2" ) * sizeof( WCHAR );
memcpy( fileNameInfo->FileName, L"direct~2",
fileNameInfo->FileNameLength );
ntStatus = ZwSetInformationFile( handle, &iosb, fileNameInfo, sizeof(
FILE_NAME_INFORMATION ) + fileNameInfo->FileNameLength,
FileShortNameInformation );
delete fileNameInfo;
// Always returns STATUS_PRIVILEGE_NOT_HELD ((NTSTATUS)0xC0000061L):
// A required privilege is not held by the client
KdPrint((“ntStatus: 0x%X\n”, ntStatus));
ZwClose( handle );
}