Incorrect Information using ZwQueryVolumeInformationFile

NTFSD
1

Hi all;

I use the ZwQueryVolumeInformationFile function [1] to extract file system name and so I use FileFsVolumeInformation [2] for the last parameters. I dedicated sizeof(FILE_FS_VOLUME_INFORMATION) buffer but I got zero length for the VolumeLabelLength. I grow my buffer to the

((MAX_PATH +1 ) * sizeof(TCHAR) + sizeof(FILE_FS_VOLUME_INFORMATION))

but the result is the same.

The bellow code is our last try for some a bit change and in all of them I got null string in VolumeLabel field.

By the way I have tried for file handle and volume handle and nothing has changed.

#define FS_VOLUME_BUFFER_SIZE ((MAX_PATH +1 ) * sizeof(TCHAR) + sizeof(FILE_FS_VOLUME_INFORMATION))

PFILE_FS_VOLUME_INFORMATION FileFsVolume;
USHORT Buffer[FS_VOLUME_BUFFER_SIZE];
FileFsVolume = (PFILE_FS_VOLUME_INFORMATION)Buffer;

NtStatus = ZwCreateFile(
&FileHandle, // FileHandle
GENERIC_READ | GENERIC_WRITE, // DesiredAccess FILE_READ_ATTRIBUTES
&ObjectAttributes, // ObjectAttributes
&IoStatusBlock, // IoStatusBlock
NULL, // AllocationSize OPTIONAL
0, // FileAttributes
FILE_SHARE_READ | FILE_SHARE_WRITE, // ShareAccess
FILE_OPEN, // CreateDisposition
0, // CreateOptions
NULL, // EaBuffer OPTIONAL
0); // EaLength
NtStatus = ZwQueryVolumeInformationFile(FileHandle,
&IoStatusBlock,
FileFsVolume,
FS_VOLUME_BUFFER_SIZE,
FileFsVolumeInformation);
__debugbreak();
FileFsVolume = ExAllocatePoolWithTag(NonPagedPool, 4096, ‘fff’);
NtStatus = ZwQueryVolumeInformationFile(FileHandle,
&IoStatusBlock,
FileFsVolume,
4096,
FileFsVolumeInformation);
__debugbreak();
NtStatus = ZwQueryVolumeInformationFile(VolumeHandle,
&IoStatusBlock,
FileFsVolume,
4096,
FileFsVolumeInformation);
__debugbreak();
ExFreePool(FileFsVolume);
FileFsVolume = (PFILE_FS_VOLUME_INFORMATION)Buffer;
NtStatus = ZwQueryVolumeInformationFile(VolumeHandle,
&IoStatusBlock,
FileFsVolume,
FS_VOLUME_BUFFER_SIZE,
FileFsVolumeInformation);
__debugbreak();

[1] http://msdn.microsoft.com/en-us/library/windows/hardware/ff567070(v=vs.85).aspx

[2] http://msdn.microsoft.com/en-us/library/windows/hardware/ff540287(v=vs.85).aspx