Hi Elad,
ZwFsControlFile is not defined in DDK and also in IFS header files.
You can define the function prototype in your header file as below.
NTSYSAPI
NTSTATUS
NTAPI
ZwfsControlFile(
IN HANDLE hFile,
IN HANDLE hEvent OPTIONAL,
IN PIO_APC_ROUTINE IoApcRoutine OPTIONAL,
IN PVOID IoApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK pIoStatusBlock,
IN ULONG FileSystemControlCode,
IN PVOID InBuffer OPTIONAL,
IN ULONG InBufferLength,
OUT PVOID OutBuffer OPTIONAL,
IN ULONG OutBufferLength
);
if it does not link while building the driver, you can write its
implementation as follows:
NTSYSAPI
NTSTATUS
NTAPI
ZwfsControlFile(
IN HANDLE hFile,
IN HANDLE hEvent OPTIONAL,
IN PIO_APC_ROUTINE IoApcRoutine OPTIONAL,
IN PVOID IoApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK pIoStatusBlock,
IN ULONG FileSystemControlCode,
IN PVOID InBuffer OPTIONAL,
IN ULONG InBufferLength,
OUT PVOID OutBuffer OPTIONAL,
IN ULONG OutBufferLength
)
{
NTSTATUS NtStatus;
void **lpParameterStack = &hFile;
_asm{
mov eax,0000003Bh
mov edx,lpParameterStack
int 2Eh
mov NtStatus,eax
}
return NtStatus;
}
These ZwXXX calls are wrappers around NtXXX system services. By putting
ServiceId in eax and Top of the parameter stack in edx and then callin int
2e will call NtXXX system services. You can find the info about
NtFsControlFile() in the book “Windows NT File System Internals” By Rajeev
Nagar at page Number 718.
Thanks
Prakash Bilodi
----- Original Message -----
From: Elad Zucker
To: File Systems Developers Interest List
Cc: Elad Zucker
Sent: Tuesday, February 29, 2000 4:16 PM
Subject: [ntfsd] RE: HELP DevIoCtrl to File System via Kernel Driver
> Hi Sara,
> Thanks again for reply to me …
>
> I Understand what u meant.
>
> but i have one big problem where is the ZwFsControlFile decleared ?
> i dont see it ?
>
> I have the all msdn … is it in the IFS header files ?
> is the IFS Headers are in the MSDN (somewhere on the disks) ??
>
> Thanks Again 
> Elad Zucker
>
> -----Original Message-----
> From: Sara Abraham
> To: File Systems Developers Interest List
> Date: Tuesday, February 29, 2000 10:11 PM
> Subject: [ntfsd] RE: HELP DevIoCtrl to File System via Kernel Driver
>
>
> >Hi Elad,
> >
> > It seems that the deviceobject you are sending the request to, is the
> media
> >device and not the device that represents the fs mount. I think that you
> >have some basic issues even before the issue of generating the correct
IRP.
> >Now I understand Tony’s original reply:
> >“The correct sequence is: lock, dismount, unlock”. As Tony says, there
are
> >semantics that you need to follow when you issue a dismount. And since
this
> >is working for you in user mode, you need to do the same for the kernel
> mode
> >implementation. You need to issue an open of \Device\HarddiskVolume2 ,
use
> >the filehandle to issue a lock request, and only then you can do your
> >dismount. You can issue the dismount by building the IRP as we discussed
> >(with the fsmount device object). But it would be much simpler to just
> issue
> >a NtFsControlFile() ( or it’s Zw equivalent). which is is defined in as:
> >
> >NTSTATUS
> >ZwFsControlFile(
> > IN HANDLE FileHandle,
> > IN HANDLE Event OPTIONAL,
> > IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
> > IN PVOID ApcContext OPTIONAL,
> > OUT PIO_STATUS_BLOCK IoStatusBlock,
> > IN ULONG IoControlCode,
> > IN PVOID InputBuffer OPTIONAL,
> > IN ULONG InputBufferLength,
> > OUT PVOID OutputBuffer OPTIONAL,
> > IN ULONG OutputBufferLength
> > );
> >
> >So, what you are doing in your kernel thread is the equivalent of what
you
> >did in your user mode application.
> >
> >Sara
> >
> >-----Original Message-----
> >From: Elad Zucker
> >To: Sara Abraham ; File Systems Developers Interest
List
> >
> >Date: Tuesday, February 29, 2000 2:56 AM
> >Subject: Re: [ntfsd] RE: HELP DevIoCtrl to File System via Kernel Driver
> >
> >
> >>I Tried your suggestion but it didnt work … now i have a result code of
:
> >>C000010 means STATUS_INVALID_DEVICE_REQUEST.
> >>
> >>do you know if in wondows 2000 the \Device\Hardvolume is the device i
need
> >>to sent the FsCtl ? this is the Device that aliased to C:/D:/E: and when
> >>tring to sent it via user mode to C:/D:/E: it works.
> >>
> >>have any suggestions ?
> >>
> >>i did all you said to the IRP . and checked it .
> >>I also tried to sent in the MN the IRP_MN_MOUNT_VOLUME and it return the
> >>same error code …
> >>
> >>Please if you can help me !
> >>
> >>Thanks,
> >>Elad Zucker
> >>xxxxx@netvision.net.il
> >>----- Original Message -----
> >>From: Sara Abraham
> >>To: File Systems Developers Interest List
> >>Sent: Tuesday, February 29, 2000 2:02 AM
> >>Subject: [ntfsd] RE: HELP DevIoCtrl to File System via Kernel Driver
> >>
> >>
> >>> It is in ntddk.h and defined as:
> >>> #define IRP_MJ_FILE_SYSTEM_CONTROL 0x0d
> >>> #define IRP_MN_USER_FS_REQUEST 0x00
> >>> FSCTL_DISMOUNT_VOLUME is defined in the ifskit, ntifs.h as:
> >>> #define FSCTL_DISMOUNT_VOLUME
> CTL_CODE(FILE_DEVICE_FILE_SYSTEM,
> >>8,
> >>> METHOD_BUFFERED, FILE_ANY_ACCESS)
> >>>
> >>> I am pretty sure that all you’ll have to do is issue a
> >>> IoBuildDeviceIoControlRequest( IRP_MJ_DEVICE_CONTROL,…)
> >>> and then:
> >>> irpSp = IoGetNextIrpStackLocation( irp );
> >>> irpSp->MajorFunction = IRP_MJ_FILE_SYSTEM_CONTROL;
> >>> irpSp->MinorFunction = IRP_MN_USER_FS_REQUEST;
> >>> and then IoCallDriver().
> >>>
> >>> Sara
> >>>
> >>>
> >>>
> >>> -----Original Message-----
> >>> From: Elad Zucker
> >>> To: File Systems Developers Interest List ; Sara
> >>> Abraham
> >>> Date: Monday, February 28, 2000 2:35 PM
> >>> Subject: Re: [ntfsd] RE: HELP DevIoCtrl to File System via Kernel
Driver
> >>>
> >>>
> >>> >
> >>> >-----Original Message-----
> >>> >From: Sara Abraham
> >>> >To: File Systems Developers Interest List
> >>> >Date: Tuesday, February 29, 2000 12:16 AM
> >>> >Subject: [ntfsd] RE: HELP DevIoCtrl to File System via Kernel Driver
> >>> >
> >>> >
> >>> >>>till now everything look ok.
> >>> >>>but now i sent the IOCTL to the FastFat (HarddiskVolume2) with the
> >>> >routine
> >>> >>>IoBuildDeviceIoControlRequest . the result was the error C0000002
> >means
> >>> >>>STATUS_NOT_IMPLEMENTED.
> >>> >>>
> >>> >>When you build the IRP with IoBuildDeviceIoControlRequest() you get
a
> >>> >>MajorFunction:IRP_MJ_DEVICE_CONTROL or
IRP_MJ_INTERNAL_DEVICE_CONTROL,
> >>> what
> >>> >>you really need is an IRP with
> >>> >>IRP_MJ_FILE_SYSTEM_CONTROL,IRP_MN_USER_FS_REQUEST and IoControlCode
=
> >>> >>FSCTL_DISMOUNT_VOLUME. The easiest is probably to use
> >>> >>IoBuildDeviceIoControlRequest () and then change fields in the IRP.
> Run
> >>> >your
> >>> >>user level utility, which works fine, put a breakpoint in
> >>> >>FatDismountVolume() and check the IRP. Make sure that the IRP you
> >>created
> >>> >in
> >>> >>your kernel driver is identical.
> >>> >>If there is a kernel equivalent to NtFsControlFile() that it might
be
> >>> >easier
> >>> >>to just use it.
> >>> >>
> >>> >>Sara
> >>> >>
> >>> >
> >>> >Thanks Sara for your answer !
> >>> >
> >>> >I remember reading somewhere abour IRP_MJ_FILE_SYSTEM_CONROL but its
> not
> >>on
> >>> >the
> >>> >NTDDK.H ! is it in the IFS ?
> >>> >
> >>> >could u please give me the values of those IRPs ?
> >>> >second where is the IoControl and the and the Major /Minor … i know
> >they
> >>> >are in the stack
> >>> >but they are not fixed … how can i get to change them manually ?
> >>> >
> >>> >are u sure this will solve the problem ?
> >>> >
> >>> >thanks you !
> >>> >Elad Zucker
> >>> >
> >>>
> >>>
> >>> —
> >>> You are currently subscribed to ntfsd as: xxxxx@netvision.net.il
> >>> To unsubscribe send a blank email to $subst(‘Email.Unsub’)
> >>>
> >>>
> >>
> >
> >
> >—
> >You are currently subscribed to ntfsd as: xxxxx@netvision.net.il
> >To unsubscribe send a blank email to $subst(‘Email.Unsub’)
> >
> >
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@interactivesi.com
> To unsubscribe send a blank email to $subst(‘Email.Unsub’)
>
>