hi, all
i want to use FSCTL_GET_VOLUME_BITMAP in kernel to get the volume’s bitmap,
but when i use ZwFsControlFile with FSCTL_GET_VOLUME_BITMAP, the api failed
with status == STATUS_INVALID_DEVICE_REQUEST, what’s the wrong thing i do?
here is my code:
========================================================================
NTSTATUS status;
HANDLE fileHandle;
IO_STATUS_BLOCK iosb;
OBJECT_ATTRIBUTES objectAttributes;
STARTING_LCN_INPUT_BUFFER slib;
PVOID buffer;
ULONG bufferLength;
UNICODE_STRING fileName;
PVOLUME_BITMAP_BUFFER pvbb;
do {
RtlInitUnicodeString(&fileName, L"\??\C:");
InitializeObjectAttributes(&objectAttributes, &fileName,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
NULL, NULL);
status = ZwOpenFile(&fileHandle, SYNCHRONIZE | FILE_READ_ATTRIBUTES,
&objectAttributes, &iosb, FILE_SHARE_READ |
FILE_SHARE_WRITE,
FILE_NON_DIRECTORY_FILE |
FILE_SYNCHRONOUS_IO_NONALERT);
if (!NT_SUCCESS(status)) {
break;
}
bufferLength = 4 * 1024 * 1024;
buffer = ExAllocatePool(PagedPool, bufferLength);
if (!buffer) {
ZwClose(fileHandle);
status = STATUS_INSUFFICIENT_RESOURCES;
break;
}
slib.StartingVcn.QuadPart = 0;
status = STATUS_UNSUCCESSFUL;
while (!NT_SUCCESS(status)) {
status = ZwFsControlFile(fileHandle, NULL, NULL, NULL, &iosb,
FSCTL_GET_VOLUME_BITMAP, &slib,
sizeof(slib), buffer, bufferLength);
if (!NT_SUCCESS(status)) {
if ((STATUS_BUFFER_TOO_SMALL == status) ||
(STATUS_BUFFER_OVERFLOW == status)) {
ExFreePool(buffer);
bufferLength *= 2;
buffer = ExAllocatePool(PagedPool, bufferLength);
if (!buffer) {
status = STATUS_INSUFFICIENT_RESOURCES;
break;
}
} else {
break;
}
}
}
ZwClose(fileHandle);
if (!NT_SUCCESS(status)) {
break;
}
ExFreePool(buffer);
} while (FALSE);
return status;
========================================================================
Thanks.
