how to access the raw partition

OSR_Community_User · March 3, 2006, 1:12pm

Hi , this is mrunal from Pune Institute Of Computer Technology.
I m trying to access raw partition in windows2000 from my filter driver which lies below NTFS drivers and above disk drivers. I tried ZwCreateFile call but it is returning FILE_SUPERSEDED in IoStatus. Wht does it mean?
Help me as soon as possible I need it in my Under Graduate Project.

Regards
Mrunal Rege

Jiyo cricket on Yahoo! India cricket
Yahoo! Messenger Mobile Stay in touch with your buddies all the time.

Alex_Ionescu-2 · March 3, 2006, 4:23pm

yuvraj rege wrote:

Hi , this is mrunal from Pune Institute Of Computer Technology.
I m trying to access raw partition in windows2000 from my filter driver
which lies below NTFS drivers and above disk drivers. I tried
ZwCreateFile call but it is returning FILE_SUPERSEDED in IoStatus. Wht
does it mean?
Help me as soon as possible I need it in my Under Graduate Project.

Regards
Mrunal Rege

Jiyo cricket on Yahoo! India cricket
http:</http:>
Yahoo! Messenger Mobile
http:</http:>
Stay in touch with your buddies all the time.

What status code are you getting from ZwCreateFile though?

You would get FILE_SUPERSEDED if you supplied FILE_SUPERSEDE in your
flags… in this case, the information in the I/O Status Block is merely
informational.

It’s also possible that you’re getting a failure in your Status (are
you?) and that the I/O Status Block isn’t giving you any “valid”
information (sometimes the lower drivers won’t clean it up).

So again, what’s your NTSTATUS?

Best regards,
Alex Ionescu

Lyndon_J_Clarke-2 · March 3, 2006, 4:53pm

FILE_SUPERSEDE = 0 = STATUS_SUCCESS?

“yuvraj rege” wrote in message news:xxxxx@ntdev…
Hi , this is mrunal from Pune Institute Of Computer Technology.
I m trying to access raw partition in windows2000 from my filter driver
which lies below NTFS drivers and above disk drivers. I tried ZwCreateFile
call but it is returning FILE_SUPERSEDED in IoStatus. Wht does it mean?
Help me as soon as possible I need it in my Under Graduate Project.

Regards
Mrunal Rege

Jiyo cricket on Yahoo! India cricket
Yahoo! Messenger Mobile Stay in touch with your buddies all the time.

OSR_Community_User · March 3, 2006, 5:30pm

Just for the record:

#define FILE_SUPERSEDE 0x00000000

So this might be a coincidence value.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

Looking forward to seeing you at the next OSR File Systems class in
Boston, MA April 18-21, 2006 (note new date - MS scheduled plugfest the
same week again.)

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Alex Ionescu
[397670]
Sent: Friday, March 03, 2006 4:22 PM
To: ntdev redirect
Subject: Re:[ntdev] how to access the raw partition

yuvraj rege wrote:

Hi , this is mrunal from Pune Institute Of Computer Technology.
I m trying to access raw partition in windows2000 from my filter
driver
which lies below NTFS drivers and above disk drivers. I tried
ZwCreateFile call but it is returning FILE_SUPERSEDED in IoStatus. Wht

does it mean?
Help me as soon as possible I need it in my Under Graduate Project.

Regards
Mrunal Rege

Jiyo cricket on Yahoo! India cricket

http:cricket/>
> Yahoo! Messenger Mobile
>
http:hoo.com/new/messenger/>
> Stay in touch with your buddies all the time.

What status code are you getting from ZwCreateFile though?

You would get FILE_SUPERSEDED if you supplied FILE_SUPERSEDE in your
flags… in this case, the information in the I/O Status Block is merely

informational.

It’s also possible that you’re getting a failure in your Status (are
you?) and that the I/O Status Block isn’t giving you any “valid”
information (sometimes the lower drivers won’t clean it up).

So again, what’s your NTSTATUS?

Best regards,
Alex Ionescu

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer</http:></http:>

Alex_Ionescu-2 · March 3, 2006, 5:51pm

Tony/Lyndon,

Actually the flag you get is FILE_SUPERSEDED. FILE_SUPERSEDE is what you
*send*.

But yes, they are both equal to 0, which is why I asked for his NTSTATUS
from ZwCreateFile.

Best regards,
Alex Ionescu

Tony Mason wrote:

Just for the record:

#define FILE_SUPERSEDE 0x00000000

So this might be a coincidence value.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

Looking forward to seeing you at the next OSR File Systems class in
Boston, MA April 18-21, 2006 (note new date - MS scheduled plugfest the
same week again.)

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Alex Ionescu
[397670]
Sent: Friday, March 03, 2006 4:22 PM
To: ntdev redirect
Subject: Re:[ntdev] how to access the raw partition

yuvraj rege wrote:

>Hi , this is mrunal from Pune Institute Of Computer Technology.
>I m trying to access raw partition in windows2000 from my filter

driver

>which lies below NTFS drivers and above disk drivers. I tried
>ZwCreateFile call but it is returning FILE_SUPERSEDED in IoStatus. Wht

>does it mean?
>Help me as soon as possible I need it in my Under Graduate Project.
>
>
>Regards
>Mrunal Rege
>
>

>Jiyo cricket on Yahoo! India cricket
>

http:> cricket/>
>
>>Yahoo! Messenger Mobile
>>
>
> http:> hoo.com/new/messenger/>
>
>>Stay in touch with your buddies all the time.
>
>
> What status code are you getting from ZwCreateFile though?
>
> You would get FILE_SUPERSEDED if you supplied FILE_SUPERSEDE in your
> flags… in this case, the information in the I/O Status Block is merely
>
> informational.
>
> It’s also possible that you’re getting a failure in your Status (are
> you?) and that the I/O Status Block isn’t giving you any “valid”
> information (sometimes the lower drivers won’t clean it up).
>
> So again, what’s your NTSTATUS?
>
> Best regards,
> Alex Ionescu
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
></http:></http:>

OSR_Community_User · March 4, 2006, 6:06am

Hello Sir,
Thank you for response!
You have asked me about the return value of ZwCreateFile. Its STATUS_OBJECT_PATH_SYNTAX_BAD . Then how can I give the correct path? Give me some example ,please.

NOTE: I have changed the return type of osr function “OsrNTStatusToString”
from PUCHAR to char * .
Here is the source code:

NTSTATUS
WcdCreate(
IN PDEVICE_OBJECT DeviceObject,
IN PIRP Irp
)
{

UNICODE_STRING FileName;
NTSTATUS ntStatus;
HANDLE FileHandle;
OBJECT_ATTRIBUTES ObjectAttributes;
WCHAR PathPrefix = L"\Device\Harddisk0\Dp(2)0xfe730c00-0x1780800+2";
ULONG FileNameLength;
IO_STATUS_BLOCK IoStatus;
char *result;

UNREFERENCED_PARAMETER(DeviceObject);
Irp->IoStatus.Status = STATUS_SUCCESS;

FileNameLength = sizeof(PathPrefix);
FileName.Buffer = ExAllocatePool(NonPagedPool,
FileNameLength);
FileName.MaximumLength = (USHORT)FileNameLength;
RtlMoveMemory (FileName.Buffer, PathPrefix, sizeof(PathPrefix));

InitializeObjectAttributes ( &ObjectAttributes,
&FileName,
OBJ_CASE_INSENSITIVE,
NULL,
NULL );

ntStatus= ZwCreateFile(
&FileHandle,
FILE_READ_DATA | FILE_WRITE_DATA,
&ObjectAttributes,
&IoStatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
0,
FILE_OPEN_IF,
FILE_NON_DIRECTORY_FILE,
NULL,
0
);

result=OsrNTStatusToString(ntStatus);

DbgPrint(“\n\n%s”,result);

ZwClose( FileHandle );

DbgPrint(“\n\nWCD : WCD_Create called”);
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return STATUS_SUCCESS;
} // end WcdCreate()

“Alex Ionescu [397670]” wrote:
yuvraj rege wrote:
> Hi , this is mrunal from Pune Institute Of Computer Technology.
> I m trying to access raw partition in windows2000 from my filter driver
> which lies below NTFS drivers and above disk drivers. I tried
> ZwCreateFile call but it is returning FILE_SUPERSEDED in IoStatus. Wht
> does it mean?
> Help me as soon as possible I need it in my Under Graduate Project.
>
>
> Regards
> Mrunal Rege
>
> ------------------------------------------------------------------------
> Jiyo cricket on Yahoo! India cricket
>
> Yahoo! Messenger Mobile
>
> Stay in touch with your buddies all the time.

What status code are you getting from ZwCreateFile though?

You would get FILE_SUPERSEDED if you supplied FILE_SUPERSEDE in your
flags… in this case, the information in the I/O Status Block is merely
informational.

It’s also possible that you’re getting a failure in your Status (are
you?) and that the I/O Status Block isn’t giving you any “valid”
information (sometimes the lower drivers won’t clean it up).

So again, what’s your NTSTATUS?

Best regards,
Alex Ionescu

—
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

---------------------------------
Jiyo cricket on Yahoo! India cricket
Yahoo! Messenger Mobile Stay in touch with your buddies all the time.

Lyndon_J_Clarke-2 · March 4, 2006, 6:09am

Alex - Okay I missed a ‘D’ when I typed

“Alex Ionescu [397670]” wrote in message
news:xxxxx@ntdev…
> Tony/Lyndon,
>
> Actually the flag you get is FILE_SUPERSEDED. FILE_SUPERSEDE is what you
> send.
>
> But yes, they are both equal to 0, which is why I asked for his NTSTATUS
> from ZwCreateFile.
>
> Best regards,
> Alex Ionescu
>
> Tony Mason wrote:
>> Just for the record:
>>
>> #define FILE_SUPERSEDE 0x00000000
>>
>> So this might be a coincidence value.
>>
>> Regards,
>>
>> Tony
>>
>> Tony Mason
>> Consulting Partner
>> OSR Open Systems Resources, Inc.
>> http://www.osr.com
>> Looking forward to seeing you at the next OSR File Systems class in
>> Boston, MA April 18-21, 2006 (note new date - MS scheduled plugfest the
>> same week again.)
>>
>> -----Original Message-----
>> From: xxxxx@lists.osr.com
>> [mailto:xxxxx@lists.osr.com] On Behalf Of Alex Ionescu
>> [397670]
>> Sent: Friday, March 03, 2006 4:22 PM
>> To: ntdev redirect
>> Subject: Re:[ntdev] how to access the raw partition
>>
>> yuvraj rege wrote:
>>
>>>Hi , this is mrunal from Pune Institute Of Computer Technology.
>>>I m trying to access raw partition in windows2000 from my filter
>>
>> driver
>>>which lies below NTFS drivers and above disk drivers. I tried
>>>ZwCreateFile call but it is returning FILE_SUPERSEDED in IoStatus. Wht
>>
>>
>>>does it mean?
>>>Help me as soon as possible I need it in my Under Graduate Project.
>>>
>>> Regards
>>>Mrunal Rege
>>>
>>
>> ------------------------------------------------------------------------
>>
>>>Jiyo cricket on Yahoo! India cricket
>>
>> http:>> cricket/>
>>
>>>Yahoo! Messenger Mobile
>>
>> http:>> hoo.com/new/messenger/>
>>>Stay in touch with your buddies all the time.
>>
>>
>> What status code are you getting from ZwCreateFile though?
>>
>> You would get FILE_SUPERSEDED if you supplied FILE_SUPERSEDE in your
>> flags… in this case, the information in the I/O Status Block is merely
>>
>> informational.
>>
>> It’s also possible that you’re getting a failure in your Status (are
>> you?) and that the I/O Status Block isn’t giving you any “valid”
>> information (sometimes the lower drivers won’t clean it up).
>>
>> So again, what’s your NTSTATUS?
>>
>> Best regards,
>> Alex Ionescu
>>
>> —
>> Questions? First check the Kernel Driver FAQ at
>> http://www.osronline.com/article.cfm?id=256
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>>
></http:></http:>

OSR_Community_User · March 4, 2006, 8:28am

Without going any further:

FileNameLength = sizeof(PathPrefix);

This sets FileNameLength to 4, which is NOT what you want.
It’s all stupid C/C++: WCHAR PathPrefix is treated by the compiler as a pointer (to WCHAR, but this does not matter here).
On a 32-bit box all ptrs are 4 bytes.

To find the buffer length, either count WCHARs manually, or, for testing purposes,
do like that:

#define Elts(array) (sizeof(array) / sizeof(array[0])) // Elts(L"ab") is 3, Elts(“ab”) is also 3

#define MY_W_STRING L"\Device\Harddisk0\Dp(2)0xfe730c00-0x1780800+2"

WCHAR* PathPrefix = MY_W_STRING;
ULONG FileNameLength = Elts(MY_W_STRING); // length in WCHARs, includes ending zero

etc.

You may want to re-read about arrays in C, they are - do not laugh! - tricky.
I’d say there are NO arrays in C at all, only pointers:-)

----- Original Message -----
From: yuvraj rege
To: Windows System Software Devs Interest List
Sent: Saturday, March 04, 2006 6:05 AM
Subject: Re:[ntdev] how to access the raw partition