hi,
I am trying to read file in by FltReadFile() in precreate but it crashes system. Any help would thankful.
NTStatus = FltGetVolumeFromInstance( Instance, &volume );
if (!NT_SUCCESS( NTStatus )) {
return NTStatus;
}
NTStatus = FltGetVolumeProperties( volume,
&volumeProps,
sizeof( volumeProps ),
&Length );
if (NT_ERROR( NTStatus )) {
return NTStatus;
}
Length = max( 40, volumeProps.SectorSize );
Buffer = FltAllocatePoolAlignedWithTag(
Instance,
NonPagedPool,
Length,
‘ncaS’
);
pwszPath = ExAllocateFromNPagedLookasideList(&g_DriverGlobals.FilepathLookaside);
if (NULL == pwszPath)
{
return NTStatus;
}
RtlZeroMemory(pwszPath, FNS_MAX_FILEPATH_LEN * sizeof(WCHAR));
NTStatus = RtlStringCchCatNW(
pwszPath,
FNS_MAX_FILEPATH_LEN,
FNS_OBJNAME_PREFIX_W,
FNS_OBJNAME_PREFIX_LEN
);
if (STATUS_SUCCESS != NTStatus)
{
return NTStatus;
}
stLenInChars = wcslen(pwszPath);
NTStatus = RtlStringCchCatNW(
pwszPath,
FNS_MAX_FILEPATH_LEN,
pwszFileName,
(FNS_MAX_FILEPATH_LEN - stLenInChars)
);
if (STATUS_SUCCESS != NTStatus)
{
ExFreeToNPagedLookasideList(
&g_DriverGlobals.FilepathLookaside,
pwszPath);
return NTStatus;
}
RtlInitUnicodeString(&usObjectName, pwszPath);
InitializeObjectAttributes(
&oa,
&usObjectName,
OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE,
NULL,
NULL
);
NTStatus = FltCreateFile(
g_DriverGlobals.pThisFilter,// Filter.
Instance, // Instance for the filter.
&hFile, // Handle to the file (on return).
FILE_GENERIC_READ, // Desired access.
&oa, // Object attributes.
&IoStatus, // IO status block.
NULL, // Allocation size.
FILE_ATTRIBUTE_NORMAL, // File attributes.
FILE_SHARE_READ |
FILE_SHARE_WRITE |
FILE_SHARE_DELETE, // Shared access.
FILE_OPEN, // Create disposition.
0, // Create options.
NULL, // EA buffer.
0, // EA length.
0 // Flags.
);
if (STATUS_SUCCESS != NTStatus)
{
return NTStatus;
}
NTStatus = FltReadFile(
Instance,
hFile,
&ByteOffset,
Length,
Buffer,
FLTFL_IO_OPERATION_NON_CACHED | FLTFL_IO_OPERATION_DO_NOT_UPDATE_BYTE_OFFSET,
&BytesRead,
NULL,
NULL);
if ((STATUS_SUCCESS != NTStatus)
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffff8000196c, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff800028d04e0, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
PAGE_FAULT_IN_NONPAGED_AREA (50)
Thanks,
~Sachin