Getting a driver handle

NTDEV
1

I’ve done this many times, but this is the first time on Win7 . I need to
open a handle to my driver from a user application, but I keep getting an
access denied error code. I’ve based the code on NonPnp in the latest
WinDDK, and from desk checking I don’t see anything that could cause the
problem. The code is different because the task at hand is different, but
the basics of creating the driver and device objects appear to be the same.
I do set the file for exclusive open since it is imperative that only one
handle be open to the driver at a time.

The parameter list I use for CreateFile is as follows:

name,

GENERIC_READ | GENERIC_WRITE,

0,

NULL,

OPEN_EXISTING,

FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED ,

NULL

I have even used this variant:

GENERIC_READ | GENERIC_WRITE,

0,

NULL,

CREATE_ALWAYS,

FILE_ATTRIBUTE_NORMAL,

NULL

But with the same result: Access Denied.

I’ve also tested opening \.\PhysicalDrive0 <file:>
and that succeeded. That tends to tell me that my problem resides in the
kernel side. Is an access list required for opening a handle to a device
driver now, or must access be set prior to opening that handle? Hmpf, or
have I simply bolaxed up the interface?

Gary G. Little

H (952) 223-1349

C (952) 454-4629

xxxxx@comcast.net</file:>

2

When you create your symbolic link DACL use something other than NULL DACL. Try this:

“D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)”

This discretionary ACL:

* Deny access to Built-in Guests
* Deny access to Anonymous Logon
* Allow read/write/execute to Authenticated Users
* Allow full control to Administrators

Windows 7 is more restrictive than prior versions when it comes to DACLs.

You can also run your app in XP compatibility mode. This bales the security operations more like the XP versions you are used to.

PITA.

Hope this helps.

Thomas F. Divine

From: Gary G. Little
Sent: Monday, May 17, 2010 4:16 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Getting a driver handle

I’ve done this many times, but this is the first time on Win7 . I need to open a handle to my driver from a user application, but I keep getting an access denied error code. I’ve based the code on NonPnp in the latest WinDDK, and from desk checking I don’t see anything that could cause the problem. The code is different because the task at hand is different, but the basics of creating the driver and device objects appear to be the same. I do set the file for exclusive open since it is imperative that only one handle be open to the driver at a time.

The parameter list I use for CreateFile is as follows:

name,

GENERIC_READ | GENERIC_WRITE,

0,

NULL,

OPEN_EXISTING,

FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED ,

NULL

I have even used this variant:

GENERIC_READ | GENERIC_WRITE,

0,

NULL,

CREATE_ALWAYS,

FILE_ATTRIBUTE_NORMAL,

NULL

But with the same result: Access Denied.

I’ve also tested opening \.\PhysicalDrive0 and that succeeded. That tends to tell me that my problem resides in the kernel side. Is an access list required for opening a handle to a device driver now, or must access be set prior to opening that handle? Hmpf, or have I simply bolaxed up the interface?

Gary G. Little

H (952) 223-1349

C (952) 454-4629

xxxxx@comcast.net

__________ Information from ESET Smart Security, version of virus signature database 5122 (20100517) __________

The message was checked by ESET Smart Security.

http://www.eset.com

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

PITA agreed.

Thanks for the reply Thomas.

Unfortuantely, or maybe fortunately, XP compatibility is not an option since
this is a Windows Filtering Platform driver which is not compatible with XP.
So, I shall attempt my very first ever ACL list and have something other
than a NULL in that third parameter.

Gary G. Little

H (952) 223-1349

C (952) 454-4629

xxxxx@comcast.net

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Thomas F. Divine
Sent: Monday, May 17, 2010 3:29 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Getting a driver handle

When you create your symbolic link DACL use something other than NULL DACL.
Try this:

“D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)”

This discretionary ACL:

* Deny access to Built-in Guests
* Deny access to Anonymous Logon
* Allow read/write/execute to Authenticated Users
* Allow full control to Administrators

Windows 7 is more restrictive than prior versions when it comes to DACLs.

You can also run your app in XP compatibility mode. This bales the security
operations more like the XP versions you are used to.

PITA.

Hope this helps.

Thomas F. Divine

From: Gary G. Little mailto:xxxxx

Sent: Monday, May 17, 2010 4:16 PM

To: Windows mailto:xxxxx System Software Devs Interest List

Subject: [ntdev] Getting a driver handle

I’ve done this many times, but this is the first time on Win7 . I need to
open a handle to my driver from a user application, but I keep getting an
access denied error code. I’ve based the code on NonPnp in the latest
WinDDK, and from desk checking I don’t see anything that could cause the
problem. The code is different because the task at hand is different, but
the basics of creating the driver and device objects appear to be the same.
I do set the file for exclusive open since it is imperative that only one
handle be open to the driver at a time.

The parameter list I use for CreateFile is as follows:

name,

GENERIC_READ | GENERIC_WRITE,

0,

NULL,

OPEN_EXISTING,

FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED ,

NULL

I have even used this variant:

GENERIC_READ | GENERIC_WRITE,

0,

NULL,

CREATE_ALWAYS,

FILE_ATTRIBUTE_NORMAL,

NULL

But with the same result: Access Denied.

I’ve also tested opening \.\PhysicalDrive0 <file:>
and that succeeded. That tends to tell me that my problem resides in the
kernel side. Is an access list required for opening a handle to a device
driver now, or must access be set prior to opening that handle? Hmpf, or
have I simply bolaxed up the interface?

Gary G. Little

H (952) 223-1349

C (952) 454-4629

xxxxx@comcast.net

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com</file:></mailto:xxxxx></mailto:xxxxx>

4

Such a pain I wrote “I Just Wanted to Install My Dam Driver on Windows 7…”

http://ndis.blogspot.com/2009/03/i-just-wanted-to-install-my-dam-driver.html

Thomas

From: Gary G. Little
Sent: Monday, May 17, 2010 4:39 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Getting a driver handle

PITA agreed.

Thanks for the reply Thomas.

Unfortuantely, or maybe fortunately, XP compatibility is not an option since this is a Windows Filtering Platform driver which is not compatible with XP. So, I shall attempt my very first ever ACL list and have something other than a NULL in that third parameter.

Gary G. Little

H (952) 223-1349

C (952) 454-4629

xxxxx@comcast.net

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Thomas F. Divine
Sent: Monday, May 17, 2010 3:29 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Getting a driver handle

When you create your symbolic link DACL use something other than NULL DACL. Try this:

“D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)”

This discretionary ACL:

* Deny access to Built-in Guests
* Deny access to Anonymous Logon
* Allow read/write/execute to Authenticated Users
* Allow full control to Administrators

Windows 7 is more restrictive than prior versions when it comes to DACLs.

You can also run your app in XP compatibility mode. This bales the security operations more like the XP versions you are used to.

PITA.

Hope this helps.

Thomas F. Divine

From: Gary G. Little

Sent: Monday, May 17, 2010 4:16 PM

To: Windows System Software Devs Interest List

Subject: [ntdev] Getting a driver handle

I’ve done this many times, but this is the first time on Win7 . I need to open a handle to my driver from a user application, but I keep getting an access denied error code. I’ve based the code on NonPnp in the latest WinDDK, and from desk checking I don’t see anything that could cause the problem. The code is different because the task at hand is different, but the basics of creating the driver and device objects appear to be the same. I do set the file for exclusive open since it is imperative that only one handle be open to the driver at a time.

The parameter list I use for CreateFile is as follows:

name,

GENERIC_READ | GENERIC_WRITE,

0,

NULL,

OPEN_EXISTING,

FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED ,

NULL

I have even used this variant:

GENERIC_READ | GENERIC_WRITE,

0,

NULL,

CREATE_ALWAYS,

FILE_ATTRIBUTE_NORMAL,

NULL

But with the same result: Access Denied.

I’ve also tested opening \.\PhysicalDrive0 and that succeeded. That tends to tell me that my problem resides in the kernel side. Is an access list required for opening a handle to a device driver now, or must access be set prior to opening that handle? Hmpf, or have I simply bolaxed up the interface?

Gary G. Little

H (952) 223-1349

C (952) 454-4629

xxxxx@comcast.net

__________ Information from ESET Smart Security, version of virus signature database 5122 (20100517) __________

The message was checked by ESET Smart Security.

http://www.eset.com

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

__________ Information from ESET Smart Security, version of virus signature database 5122 (20100517) __________

The message was checked by ESET Smart Security.

http://www.eset.com

__________ Information from ESET Smart Security, version of virus signature database 5122 (20100517) __________

The message was checked by ESET Smart Security.

http://www.eset.com

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

5

Thanks for those links Thomas.

It makes me curious however, and this is directed more to Doron and other
Microsoft folks that monitor this l ist. How does the Toasters, NonPnP, and
other examples work on Win7 when a cursory look at those projects show NULL
being used for the security descriptor? Are those projects all basically
BROKEN in Win7?

Gary G. Little

H (952) 223-1349

C (952) 454-4629

xxxxx@comcast.net

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Thomas F. Divine
Sent: Monday, May 17, 2010 3:49 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Getting a driver handle

Such a pain I wrote "
http:l> I Just Wanted to Install My Dam Driver on Windows 7…"

http://ndis.blogspot.com/2009/03/i-just-wanted-to-install-my-dam-driver.html

Thomas

From: Gary G. Little mailto:xxxxx

Sent: Monday, May 17, 2010 4:39 PM

To: Windows System Software Devs Interest List mailto:xxxxx

Subject: RE: [ntdev] Getting a driver handle

PITA agreed.

Thanks for the reply Thomas.

Unfortuantely, or maybe fortunately, XP compatibility is not an option since
this is a Windows Filtering Platform driver which is not compatible with XP.
So, I shall attempt my very first ever ACL list and have something other
than a NULL in that third parameter.

Gary G. Little

H (952) 223-1349

C (952) 454-4629

xxxxx@comcast.net

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Thomas F. Divine
Sent: Monday, May 17, 2010 3:29 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Getting a driver handle

When you create your symbolic link DACL use something other than NULL DACL.
Try this:

“D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)”

This discretionary ACL:

* Deny access to Built-in Guests
* Deny access to Anonymous Logon
* Allow read/write/execute to Authenticated Users
* Allow full control to Administrators

Windows 7 is more restrictive than prior versions when it comes to DACLs.

You can also run your app in XP compatibility mode. This bales the security
operations more like the XP versions you are used to.

PITA.

Hope this helps.

Thomas F. Divine

From: Gary G. Little mailto:xxxxx

Sent: Monday, May 17, 2010 4:16 PM

To: Windows mailto:xxxxx System Software Devs Interest List

Subject: [ntdev] Getting a driver handle

I’ve done this many times, but this is the first time on Win7 . I need to
open a handle to my driver from a user application, but I keep getting an
access denied error code. I’ve based the code on NonPnp in the latest
WinDDK, and from desk checking I don’t see anything that could cause the
problem. The code is different because the task at hand is different, but
the basics of creating the driver and device objects appear to be the same.
I do set the file for exclusive open since it is imperative that only one
handle be open to the driver at a time.

The parameter list I use for CreateFile is as follows:

name,

GENERIC_READ | GENERIC_WRITE,

0,

NULL,

OPEN_EXISTING,

FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED ,

NULL

I have even used this variant:

GENERIC_READ | GENERIC_WRITE,

0,

NULL,

CREATE_ALWAYS,

FILE_ATTRIBUTE_NORMAL,

NULL

But with the same result: Access Denied.

I’ve also tested opening \.\PhysicalDrive0 <file:>
and that succeeded. That tends to tell me that my problem resides in the
kernel side. Is an access list required for opening a handle to a device
driver now, or must access be set prior to opening that handle? Hmpf, or
have I simply bolaxed up the interface?

Gary G. Little

H (952) 223-1349

C (952) 454-4629

xxxxx@comcast.net

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com</file:></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></http:>

6

No, they are not broken. Are you running your test from an elevated command prompt?

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Gary G. Little
Sent: Monday, May 17, 2010 2:36 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Getting a driver handle

Thanks for those links Thomas.

It makes me curious however, and this is directed more to Doron and other Microsoft folks that monitor this l ist. How does the Toasters, NonPnP, and other examples work on Win7 when a cursory look at those projects show NULL being used for the security descriptor? Are those projects all basically BROKEN in Win7?

Gary G. Little
H (952) 223-1349
C (952) 454-4629
xxxxx@comcast.netmailto:xxxxx

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Thomas F. Divine
Sent: Monday, May 17, 2010 3:49 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Getting a driver handle

Such a pain I wrote “I Just Wanted to Install My Dam Driver on Windows 7…http:”

http://ndis.blogspot.com/2009/03/i-just-wanted-to-install-my-dam-driver.html

Thomas

From: Gary G. Littlemailto:xxxxx
Sent: Monday, May 17, 2010 4:39 PM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: RE: [ntdev] Getting a driver handle

PITA agreed.

Thanks for the reply Thomas.

Unfortuantely, or maybe fortunately, XP compatibility is not an option since this is a Windows Filtering Platform driver which is not compatible with XP. So, I shall attempt my very first ever ACL list and have something other than a NULL in that third parameter.

Gary G. Little
H (952) 223-1349
C (952) 454-4629
xxxxx@comcast.netmailto:xxxxx

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Thomas F. Divine
Sent: Monday, May 17, 2010 3:29 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Getting a driver handle

When you create your symbolic link DACL use something other than NULL DACL. Try this:

“D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)”

This discretionary ACL:

* Deny access to Built-in Guests
* Deny access to Anonymous Logon
* Allow read/write/execute to Authenticated Users
* Allow full control to Administrators

Windows 7 is more restrictive than prior versions when it comes to DACLs.

You can also run your app in XP compatibility mode. This bales the security operations more like the XP versions you are used to.

PITA.

Hope this helps.

Thomas F. Divine

From: Gary G. Littlemailto:xxxxx
Sent: Monday, May 17, 2010 4:16 PM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: [ntdev] Getting a driver handle

I’ve done this many times, but this is the first time on Win7 … I need to open a handle to my driver from a user application, but I keep getting an access denied error code. I’ve based the code on NonPnp in the latest WinDDK, and from desk checking I don’t see anything that could cause the problem. The code is different because the task at hand is different, but the basics of creating the driver and device objects appear to be the same. I do set the file for exclusive open since it is imperative that only one handle be open to the driver at a time.

The parameter list I use for CreateFile is as follows:

name,
GENERIC_READ | GENERIC_WRITE,
0,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED ,
NULL

I have even used this variant:

GENERIC_READ | GENERIC_WRITE,
0,
NULL,
CREATE_ALWAYS,
FILE_ATTRIBUTE_NORMAL,
NULL

But with the same result: Access Denied.

I’ve also tested opening \.\PhysicalDrive0<file:> and that succeeded. That tends to tell me that my problem resides in the kernel side. Is an access list required for opening a handle to a device driver now, or must access be set prior to opening that handle? Hmpf, or have I simply bolaxed up the interface?

Gary G. Little
H (952) 223-1349
C (952) 454-4629
xxxxx@comcast.netmailto:xxxxx

Information from ESET Smart Security, version of virus signature database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Information from ESET Smart Security, version of virus signature database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

Information from ESET Smart Security, version of virus signature database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Information from ESET Smart Security, version of virus signature database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

Information from ESET Smart Security, version of virus signature database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></file:></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></http:></mailto:xxxxx>

7

Of course. I either open an elevated Powershell or start a VS 2008 remote
debugging instance that has been elevated.

Gary G. Little

H (952) 223-1349

C (952) 454-4629

xxxxx@comcast.net

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Monday, May 17, 2010 4:54 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Getting a driver handle

No, they are not broken. Are you running your test from an elevated command
prompt?

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Gary G. Little
Sent: Monday, May 17, 2010 2:36 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Getting a driver handle

Thanks for those links Thomas.

It makes me curious however, and this is directed more to Doron and other
Microsoft folks that monitor this l ist. How does the Toasters, NonPnP, and
other examples work on Win7 when a cursory look at those projects show NULL
being used for the security descriptor? Are those projects all basically
BROKEN in Win7?

Gary G. Little

H (952) 223-1349

C (952) 454-4629

xxxxx@comcast.net

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Thomas F. Divine
Sent: Monday, May 17, 2010 3:49 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Getting a driver handle

Such a pain I wrote "
http:l> I Just Wanted to Install My Dam Driver on Windows 7…"

http://ndis.blogspot.com/2009/03/i-just-wanted-to-install-my-dam-driver.html

Thomas

From: Gary G. Little mailto:xxxxx

Sent: Monday, May 17, 2010 4:39 PM

To: Windows System Software Devs Interest List mailto:xxxxx

Subject: RE: [ntdev] Getting a driver handle

PITA agreed.

Thanks for the reply Thomas.

Unfortuantely, or maybe fortunately, XP compatibility is not an option since
this is a Windows Filtering Platform driver which is not compatible with XP.
So, I shall attempt my very first ever ACL list and have something other
than a NULL in that third parameter.

Gary G. Little

H (952) 223-1349

C (952) 454-4629

xxxxx@comcast.net

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Thomas F. Divine
Sent: Monday, May 17, 2010 3:29 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Getting a driver handle

When you create your symbolic link DACL use something other than NULL DACL.
Try this:

“D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)”

This discretionary ACL:

* Deny access to Built-in Guests
* Deny access to Anonymous Logon
* Allow read/write/execute to Authenticated Users
* Allow full control to Administrators

Windows 7 is more restrictive than prior versions when it comes to DACLs.

You can also run your app in XP compatibility mode. This bales the security
operations more like the XP versions you are used to.

PITA.

Hope this helps.

Thomas F. Divine

From: Gary G. Little mailto:xxxxx

Sent: Monday, May 17, 2010 4:16 PM

To: Windows mailto:xxxxx System Software Devs Interest List

Subject: [ntdev] Getting a driver handle

I’ve done this many times, but this is the first time on Win7 . I need to
open a handle to my driver from a user application, but I keep getting an
access denied error code. I’ve based the code on NonPnp in the latest
WinDDK, and from desk checking I don’t see anything that could cause the
problem. The code is different because the task at hand is different, but
the basics of creating the driver and device objects appear to be the same.
I do set the file for exclusive open since it is imperative that only one
handle be open to the driver at a time.

The parameter list I use for CreateFile is as follows:

name,

GENERIC_READ | GENERIC_WRITE,

0,

NULL,

OPEN_EXISTING,

FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED ,

NULL

I have even used this variant:

GENERIC_READ | GENERIC_WRITE,

0,

NULL,

CREATE_ALWAYS,

FILE_ATTRIBUTE_NORMAL,

NULL

But with the same result: Access Denied.

I’ve also tested opening \.\PhysicalDrive0 <file:>
and that succeeded. That tends to tell me that my problem resides in the
kernel side. Is an access list required for opening a handle to a device
driver now, or must access be set prior to opening that handle? Hmpf, or
have I simply bolaxed up the interface?

Gary G. Little

H (952) 223-1349

C (952) 454-4629

xxxxx@comcast.net

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com</file:></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></http:>

8

I’ve solved the problem, well, better said, I’ve got something that works on
Win7. I use WdfDeviceInitAssignSDDLString to assign
SDDL_DEVOBJ_SYS_ALL_ADM_ALL to the WDF_DEVICEINIT object before I create the
WDF device object. That allows me to get a handle and then do the IO the
must be done. But, my question is still why such is not required, or at
least needed, by the examples in the WDK that open handles to device
drivers. The only place I see WDIASS (wow perfect . wadi-ass) used in the
WDK src directories is the two rawpdo examples. So how does NonPnP and
Toaster skate around this in Win7? I can’t be just be elevation because of
all of my testing is done elevated.

Gary G. Little

H (952) 223-1349

C (952) 454-4629

xxxxx@comcast.net

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Monday, May 17, 2010 4:54 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Getting a driver handle

No, they are not broken. Are you running your test from an elevated command
prompt?

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Gary G. Little
Sent: Monday, May 17, 2010 2:36 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Getting a driver handle

Thanks for those links Thomas.

It makes me curious however, and this is directed more to Doron and other
Microsoft folks that monitor this l ist. How does the Toasters, NonPnP, and
other examples work on Win7 when a cursory look at those projects show NULL
being used for the security descriptor? Are those projects all basically
BROKEN in Win7?

Gary G. Little

H (952) 223-1349

C (952) 454-4629

xxxxx@comcast.net

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Thomas F. Divine
Sent: Monday, May 17, 2010 3:49 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Getting a driver handle

Such a pain I wrote "
http:l> I Just Wanted to Install My Dam Driver on Windows 7…"

http://ndis.blogspot.com/2009/03/i-just-wanted-to-install-my-dam-driver.html

Thomas

From: Gary G. Little mailto:xxxxx

Sent: Monday, May 17, 2010 4:39 PM

To: Windows System Software Devs Interest List mailto:xxxxx

Subject: RE: [ntdev] Getting a driver handle

PITA agreed.

Thanks for the reply Thomas.

Unfortuantely, or maybe fortunately, XP compatibility is not an option since
this is a Windows Filtering Platform driver which is not compatible with XP.
So, I shall attempt my very first ever ACL list and have something other
than a NULL in that third parameter.

Gary G. Little

H (952) 223-1349

C (952) 454-4629

xxxxx@comcast.net

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Thomas F. Divine
Sent: Monday, May 17, 2010 3:29 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Getting a driver handle

When you create your symbolic link DACL use something other than NULL DACL.
Try this:

“D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)”

This discretionary ACL:

* Deny access to Built-in Guests
* Deny access to Anonymous Logon
* Allow read/write/execute to Authenticated Users
* Allow full control to Administrators

Windows 7 is more restrictive than prior versions when it comes to DACLs.

You can also run your app in XP compatibility mode. This bales the security
operations more like the XP versions you are used to.

PITA.

Hope this helps.

Thomas F. Divine

From: Gary G. Little mailto:xxxxx

Sent: Monday, May 17, 2010 4:16 PM

To: Windows mailto:xxxxx System Software Devs Interest List

Subject: [ntdev] Getting a driver handle

I’ve done this many times, but this is the first time on Win7 . I need to
open a handle to my driver from a user application, but I keep getting an
access denied error code. I’ve based the code on NonPnp in the latest
WinDDK, and from desk checking I don’t see anything that could cause the
problem. The code is different because the task at hand is different, but
the basics of creating the driver and device objects appear to be the same.
I do set the file for exclusive open since it is imperative that only one
handle be open to the driver at a time.

The parameter list I use for CreateFile is as follows:

name,

GENERIC_READ | GENERIC_WRITE,

0,

NULL,

OPEN_EXISTING,

FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED ,

NULL

I have even used this variant:

GENERIC_READ | GENERIC_WRITE,

0,

NULL,

CREATE_ALWAYS,

FILE_ATTRIBUTE_NORMAL,

NULL

But with the same result: Access Denied.

I’ve also tested opening \.\PhysicalDrive0 <file:>
and that succeeded. That tends to tell me that my problem resides in the
kernel side. Is an access list required for opening a handle to a device
driver now, or must access be set prior to opening that handle? Hmpf, or
have I simply bolaxed up the interface?

Gary G. Little

H (952) 223-1349

C (952) 454-4629

xxxxx@comcast.net

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com</file:></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></http:>

9

I’d get the ACL from the device object and cross reference it with the token
of the thread/process that has the issue.

!devobj will give you the address of the DACL, which you can then use !acl
on. For the token use !token and then cross reference the results to see why
you’re being denied access. There’s an old article here
http://www.osronline.com/article.cfm?id=459 that shows this.

-scott

–
Scott Noone
Consulting Associate
OSR Open Systems Resources, Inc.
http://www.osronline.com

“Gary G. Little” wrote in message
news:xxxxx@ntdev…
I’ve solved the problem, well, better said, I’ve got something that works on
Win7. I use WdfDeviceInitAssignSDDLString to assign
SDDL_DEVOBJ_SYS_ALL_ADM_ALL to the WDF_DEVICEINIT object before I create the
WDF device object. That allows me to get a handle and then do the IO the
must be done. But, my question is still why such is not required, or at
least needed, by the examples in the WDK that open handles to device
drivers. The only place I see WDIASS (wow perfect . wadi-ass) used in the
WDK src directories is the two rawpdo examples. So how does NonPnP and
Toaster skate around this in Win7? I can’t be just be elevation because of
all of my testing is done elevated.

Gary G. Little
H (952) 223-1349
C (952) 454-4629
xxxxx@comcast.net

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Monday, May 17, 2010 4:54 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Getting a driver handle

No, they are not broken. Are you running your test from an elevated command
prompt?

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Gary G. Little
Sent: Monday, May 17, 2010 2:36 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Getting a driver handle

Thanks for those links Thomas.

It makes me curious however, and this is directed more to Doron and other
Microsoft folks that monitor this l ist. How does the Toasters, NonPnP, and
other examples work on Win7 when a cursory look at those projects show NULL
being used for the security descriptor? Are those projects all basically
BROKEN in Win7?

Gary G. Little
H (952) 223-1349
C (952) 454-4629
xxxxx@comcast.net

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Thomas F. Divine
Sent: Monday, May 17, 2010 3:49 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Getting a driver handle

Such a pain I wrote “I Just Wanted to Install My Dam Driver on Windows 7…”

http://ndis.blogspot.com/2009/03/i-just-wanted-to-install-my-dam-driver.html

Thomas

From: Gary G. Little
Sent: Monday, May 17, 2010 4:39 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Getting a driver handle

PITA agreed.

Thanks for the reply Thomas.

Unfortuantely, or maybe fortunately, XP compatibility is not an option since
this is a Windows Filtering Platform driver which is not compatible with XP.
So, I shall attempt my very first ever ACL list and have something other
than a NULL in that third parameter.

Gary G. Little
H (952) 223-1349
C (952) 454-4629
xxxxx@comcast.net

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Thomas F. Divine
Sent: Monday, May 17, 2010 3:29 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Getting a driver handle

When you create your symbolic link DACL use something other than NULL DACL.
Try this:

“D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)”

This discretionary ACL:

* Deny access to Built-in Guests
* Deny access to Anonymous Logon
* Allow read/write/execute to Authenticated Users
* Allow full control to Administrators

Windows 7 is more restrictive than prior versions when it comes to DACLs.

You can also run your app in XP compatibility mode. This bales the security
operations more like the XP versions you are used to.

PITA.

Hope this helps.

Thomas F. Divine

From: Gary G. Little
Sent: Monday, May 17, 2010 4:16 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Getting a driver handle

I’ve done this many times, but this is the first time on Win7 . I need to
open a handle to my driver from a user application, but I keep getting an
access denied error code. I’ve based the code on NonPnp in the latest
WinDDK, and from desk checking I don’t see anything that could cause the
problem. The code is different because the task at hand is different, but
the basics of creating the driver and device objects appear to be the same.
I do set the file for exclusive open since it is imperative that only one
handle be open to the driver at a time.

The parameter list I use for CreateFile is as follows:

name,
GENERIC_READ | GENERIC_WRITE,
0,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED ,
NULL

I have even used this variant:

GENERIC_READ | GENERIC_WRITE,
0,
NULL,
CREATE_ALWAYS,
FILE_ATTRIBUTE_NORMAL,
NULL

But with the same result: Access Denied.

I’ve also tested opening \.\PhysicalDrive0 and that succeeded. That tends
to tell me that my problem resides in the kernel side. Is an access list
required for opening a handle to a device driver now, or must access be set
prior to opening that handle? Hmpf, or have I simply bolaxed up the
interface?

Gary G. Little
H (952) 223-1349
C (952) 454-4629
xxxxx@comcast.net

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

Information from ESET Smart Security, version of virus signature
database 5128 (20100519)

The message was checked by ESET Smart Security.

http://www.eset.com

10

What device class is the driver installed under?
d

sent from a phpne with no keynoard

From: Gary G. Little
Sent: May 19, 2010 9:57 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Getting a driver handle

I?ve solved the problem, well, better said, I?ve got something that works on Win7. I use WdfDeviceInitAssignSDDLString to assign SDDL_DEVOBJ_SYS_ALL_ADM_ALL to the WDF_DEVICEINIT object before I create the WDF device object. That allows me to get a handle and then do the IO the must be done. But, my question is still why such is not required, or at least needed, by the examples in the WDK that open handles to device drivers. The only place I see WDIASS (wow perfect ? wadi-ass) used in the WDK src directories is the two rawpdo examples. So how does NonPnP and Toaster skate around this in Win7? I can?t be just be elevation because of all of my testing is done elevated.

Gary G. Little
H (952) 223-1349
C (952) 454-4629
xxxxx@comcast.net

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Monday, May 17, 2010 4:54 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Getting a driver handle

No, they are not broken. Are you running your test from an elevated command prompt?

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Gary G. Little
Sent: Monday, May 17, 2010 2:36 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Getting a driver handle

Thanks for those links Thomas.

It makes me curious however, and this is directed more to Doron and other Microsoft folks that monitor this l ist. How does the Toasters, NonPnP, and other examples work on Win7 when a cursory look at those projects show NULL being used for the security descriptor? Are those projects all basically BROKEN in Win7?

Gary G. Little
H (952) 223-1349
C (952) 454-4629
xxxxx@comcast.netmailto:xxxxx

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Thomas F. Divine
Sent: Monday, May 17, 2010 3:49 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Getting a driver handle

Such a pain I wrote “I Just Wanted to Install My Dam Driver on Windows 7…http:”

http://ndis.blogspot.com/2009/03/i-just-wanted-to-install-my-dam-driver.html

Thomas

From: Gary G. Littlemailto:xxxxx
Sent: Monday, May 17, 2010 4:39 PM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: RE: [ntdev] Getting a driver handle

PITA agreed.

Thanks for the reply Thomas.

Unfortuantely, or maybe fortunately, XP compatibility is not an option since this is a Windows Filtering Platform driver which is not compatible with XP. So, I shall attempt my very first ever ACL list and have something other than a NULL in that third parameter.

Gary G. Little
H (952) 223-1349
C (952) 454-4629
xxxxx@comcast.netmailto:xxxxx

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Thomas F. Divine
Sent: Monday, May 17, 2010 3:29 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Getting a driver handle

When you create your symbolic link DACL use something other than NULL DACL. Try this:

“D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)”

This discretionary ACL:

* Deny access to Built-in Guests
* Deny access to Anonymous Logon
* Allow read/write/execute to Authenticated Users
* Allow full control to Administrators

Windows 7 is more restrictive than prior versions when it comes to DACLs.

You can also run your app in XP compatibility mode. This bales the security operations more like the XP versions you are used to.

PITA.

Hope this helps.

Thomas F. Divine

From: Gary G. Littlemailto:xxxxx
Sent: Monday, May 17, 2010 4:16 PM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: [ntdev] Getting a driver handle

I?ve done this many times, but this is the first time on Win7 ? I need to open a handle to my driver from a user application, but I keep getting an access denied error code. I?ve based the code on NonPnp in the latest WinDDK, and from desk checking I don?t see anything that could cause the problem. The code is different because the task at hand is different, but the basics of creating the driver and device objects appear to be the same. I do set the file for exclusive open since it is imperative that only one handle be open to the driver at a time.

The parameter list I use for CreateFile is as follows:

name,
GENERIC_READ | GENERIC_WRITE,
0,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED ,
NULL

I have even used this variant:

GENERIC_READ | GENERIC_WRITE,
0,
NULL,
CREATE_ALWAYS,
FILE_ATTRIBUTE_NORMAL,
NULL

But with the same result: Access Denied.

I?ve also tested opening \.\PhysicalDrive0<file:> and that succeeded. That tends to tell me that my problem resides in the kernel side. Is an access list required for opening a handle to a device driver now, or must access be set prior to opening that handle? Hmpf, or have I simply bolaxed up the interface?

Gary G. Little
H (952) 223-1349
C (952) 454-4629
xxxxx@comcast.netmailto:xxxxx

Information from ESET Smart Security, version of virus signature database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Information from ESET Smart Security, version of virus signature database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

Information from ESET Smart Security, version of virus signature database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Information from ESET Smart Security, version of virus signature database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

Information from ESET Smart Security, version of virus signature database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Information from ESET Smart Security, version of virus signature database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

Information from ESET Smart Security, version of virus signature database 5128 (20100519)

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></file:></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></http:></mailto:xxxxx>

11

I use the same method to install as NonPnP, and like NonPnP I have an
install application that installs the driver and updates the WdfCoinstaller
if needed. I have no Class defined in the INF file.

Gary G. Little

H (952) 223-1349

C (952) 454-4629

xxxxx@comcast.net

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Wednesday, May 19, 2010 5:25 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Getting a driver handle

What device class is the driver installed under?
d

sent from a phpne with no keynoard

From: Gary G. Little
Sent: May 19, 2010 9:57 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Getting a driver handle

I’ve solved the problem, well, better said, I’ve got something that works on
Win7. I use WdfDeviceInitAssignSDDLString to assign
SDDL_DEVOBJ_SYS_ALL_ADM_ALL to the WDF_DEVICEINIT object before I create the
WDF device object. That allows me to get a handle and then do the IO the
must be done. But, my question is still why such is not required, or at
least needed, by the examples in the WDK that open handles to device
drivers. The only place I see WDIASS (wow perfect . wadi-ass) used in the
WDK src directories is the two rawpdo examples. So how does NonPnP and
Toaster skate around this in Win7? I can’t be just be elevation because of
all of my testing is done elevated.

Gary G. Little

H (952) 223-1349

C (952) 454-4629

xxxxx@comcast.net

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Monday, May 17, 2010 4:54 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Getting a driver handle

No, they are not broken. Are you running your test from an elevated command
prompt?

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Gary G. Little
Sent: Monday, May 17, 2010 2:36 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Getting a driver handle

Thanks for those links Thomas.

It makes me curious however, and this is directed more to Doron and other
Microsoft folks that monitor this l ist. How does the Toasters, NonPnP, and
other examples work on Win7 when a cursory look at those projects show NULL
being used for the security descriptor? Are those projects all basically
BROKEN in Win7?

Gary G. Little

H (952) 223-1349

C (952) 454-4629

xxxxx@comcast.net

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Thomas F. Divine
Sent: Monday, May 17, 2010 3:49 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Getting a driver handle

Such a pain I wrote “
http:l> I Just Wanted to Install My Dam Driver on Windows 7…”

http://ndis.blogspot.com/2009/03/i-just-wanted-to-install-my-dam-driver.html

Thomas

From: Gary G. Little mailto:xxxxx

Sent: Monday, May 17, 2010 4:39 PM

To: Windows System Software Devs Interest List mailto:xxxxx

Subject: RE: [ntdev] Getting a driver handle

PITA agreed.

Thanks for the reply Thomas.

Unfortuantely, or maybe fortunately, XP compatibility is not an option since
this is a Windows Filtering Platform driver which is not compatible with XP.
So, I shall attempt my very first ever ACL list and have something other
than a NULL in that third parameter.

Gary G. Little

H (952) 223-1349

C (952) 454-4629

xxxxx@comcast.net

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Thomas F. Divine
Sent: Monday, May 17, 2010 3:29 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Getting a driver handle

When you create your symbolic link DACL use something other than NULL DACL.
Try this:

“D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)”

This discretionary ACL:

* Deny access to Built-in Guests
* Deny access to Anonymous Logon
* Allow read/write/execute to Authenticated Users
* Allow full control to Administrators

Windows 7 is more restrictive than prior versions when it comes to DACLs.

You can also run your app in XP compatibility mode. This bales the security
operations more like the XP versions you are used to.

PITA.

Hope this helps.

Thomas F. Divine

From: Gary G. Little mailto:xxxxx

Sent: Monday, May 17, 2010 4:16 PM

To: Windows mailto:xxxxx System Software Devs Interest List

Subject: [ntdev] Getting a driver handle

I’ve done this many times, but this is the first time on Win7 . I need to
open a handle to my driver from a user application, but I keep getting an
access denied error code. I’ve based the code on NonPnp in the latest
WinDDK, and from desk checking I don’t see anything that could cause the
problem. The code is different because the task at hand is different, but
the basics of creating the driver and device objects appear to be the same.
I do set the file for exclusive open since it is imperative that only one
handle be open to the driver at a time.

The parameter list I use for CreateFile is as follows:

name,

GENERIC_READ | GENERIC_WRITE,

0,

NULL,

OPEN_EXISTING,

FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED ,

NULL

I have even used this variant:

GENERIC_READ | GENERIC_WRITE,

0,

NULL,

CREATE_ALWAYS,

FILE_ATTRIBUTE_NORMAL,

NULL

But with the same result: Access Denied.

I’ve also tested opening \.\PhysicalDrive0 <file:>
and that succeeded. That tends to tell me that my problem resides in the
kernel side. Is an access list required for opening a handle to a device
driver now, or must access be set prior to opening that handle? Hmpf, or
have I simply bolaxed up the interface?

Gary G. Little

H (952) 223-1349

C (952) 454-4629

xxxxx@comcast.net

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Information from ESET Smart Security, version of virus signature
database 5122 (20100517)

The message was checked by ESET Smart Security.

http://www.eset.com

Information from ESET Smart Security, version of virus signature
database 5128 (20100519)

The message was checked by ESET Smart Security.

http://www.eset.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Information from ESET Smart Security, version of virus signature
database 5130 (20100519)

The message was checked by ESET Smart Security.

http://www.eset.com</file:></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></http:>