IoBuildSynchronousFsdRequest issues

NTFSD
1

Hello,

Overall objective: Read a file that is open with exclusive access
(locked) by some unknown process.

I have a kernel driver that receives a unicode string w/path & file name…

If I do ZwOpenFile on an unlocked file followed by ZwReadFile, it works
as expected.
Do the same on a locked file, I get STATUS_SHARING_VIOLATION as expected.

If I do ZwOpenFile on a locked file w/DesiredAccess =
FILE_READ_ATTRIBUTES only, I can use ZwQueryInformationFile to get
the size.

I know I have to create my own IRP with the IRP_PAGING_IO flag bit set
to make this work. (At least I think this is true…)

My immediate objective is to create my own IRPs to read an unlocked file
and then deal with the issues raised by IRP_PAGING_IO.

Currently:

A)
ZwOpenFile with DesiredAccess = FILE_READ_ATTRIBUTES only, ShareAccess =
FILE_SHARE_READ.
ZwQueryInformationFile to get the file size.

B)
IoGetDeviceObjectPointer (&Name, FILE_READ_ATTRIBUTES, &FileObject,
&DeviceObject);

C)
IoBuildSynchronousFsdRequest (IRP_MJ_READ, DeviceObject, Buffer,
PAGE_SIZE, Offset, &Event, &Iosb);

D)
IrpSp = IoGetNextIrpStackLocation (Irp);
IrpSp->FileObject = FileObject;

E)
IoCallDriver (DeviceObject, Irp);
if STATUS_PENDING, KeWaitForSingleObject (&Event, …) + get real status
from Iosb.Status;

F)
Status is STATUS_FILE_CLOSED.

I’ve experimented with variations at A) (leave file open, close file,
etc) and get either STATUS_SHARING_VIOLATION at B) or the status shown
at F).

Any comments on where I’m going wrong will be greatly appreciated.
Mickey.

2

Try using IoCreateFileSpecifyDeviceObjectHint with the
IO_IGNORE_SHARE_ACCESS_CHECK option. FltCreateFile supports that option
too.

~Eric

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mickey Lane
Sent: Tuesday, April 29, 2008 10:09 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] IoBuildSynchronousFsdRequest issues

Hello,

Overall objective: Read a file that is open with exclusive access
(locked) by some unknown process.

I have a kernel driver that receives a unicode string w/path & file
name…

If I do ZwOpenFile on an unlocked file followed by ZwReadFile, it works
as expected.
Do the same on a locked file, I get STATUS_SHARING_VIOLATION as
expected.

If I do ZwOpenFile on a locked file w/DesiredAccess =
FILE_READ_ATTRIBUTES only, I can use ZwQueryInformationFile to get the
size.

I know I have to create my own IRP with the IRP_PAGING_IO flag bit set
to make this work. (At least I think this is true…)

My immediate objective is to create my own IRPs to read an unlocked file

and then deal with the issues raised by IRP_PAGING_IO.

Currently:

A)
ZwOpenFile with DesiredAccess = FILE_READ_ATTRIBUTES only, ShareAccess =

FILE_SHARE_READ.
ZwQueryInformationFile to get the file size.

B)
IoGetDeviceObjectPointer (&Name, FILE_READ_ATTRIBUTES, &FileObject,
&DeviceObject);

C)
IoBuildSynchronousFsdRequest (IRP_MJ_READ, DeviceObject, Buffer,
PAGE_SIZE, Offset, &Event, &Iosb);

D)
IrpSp = IoGetNextIrpStackLocation (Irp);
IrpSp->FileObject = FileObject;

E)
IoCallDriver (DeviceObject, Irp);
if STATUS_PENDING, KeWaitForSingleObject (&Event, …) + get real status

from Iosb.Status;

F)
Status is STATUS_FILE_CLOSED.

I’ve experimented with variations at A) (leave file open, close file,
etc) and get either STATUS_SHARING_VIOLATION at B) or the status shown
at F).

Any comments on where I’m going wrong will be greatly appreciated.
Mickey.

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@edsiohio.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Eric Diven wrote:

Try using IoCreateFileSpecifyDeviceObjectHint with the
IO_IGNORE_SHARE_ACCESS_CHECK option. FltCreateFile supports that option
too.

~Eric

Thanks for the suggestion.

With the target file locked, changed the driver to the following.
Status from read is the same.

A)
IoGetDeviceObjectPointer (&Name, FILE_READ_ATTRIBUTES, &FileObject,
&DeviceObject);

B)
IoCreateFileSpecifyDeviceObjectHint (
&FileHandle,
GENERIC_READ, // ACCESS_MASK DesiredAccess,
&Oa, // OBJECT_ATTRIBUTES
&Iosb,
NULL, // AllocationSize OPTIONAL,
0, // Needed for open only
0, // ShareAccess ignored (options below)
FILE_OPEN, // Fail if file does not exist
FILE_NON_DIRECTORY_FILE, // CreateOptions (probably ignored)
NULL, // EaBuffer OPTIONAL,
0, // EaLength,
CreateFileTypeNone, // CREATE_FILE_TYPE CreateFileType,
NULL, // NULL for drivers,
IO_IGNORE_SHARE_ACCESS_CHECK, // Options,
DeviceObject);

C)
ZwQueryInformationFile correctly returns the file size

D)
IoBuildSynchronousFsdRequest (IRP_MJ_READ, DeviceObject, Buffer,
PAGE_SIZE, Offset, &Event, &Iosb);

E)
IrpSp = IoGetNextIrpStackLocation (Irp);
IrpSp->FileObject = FileObject;

F)
IoCallDriver (DeviceObject, Irp);
if STATUS_PENDING, KeWaitForSingleObject (&Event, …) + get real status
from Iosb.Status;

G)
Status is STATUS_FILE_CLOSED.

If I removed steps D) - F) and went back to ZwReadFile, would it work?

Thanks,
Mickey.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mickey Lane
Sent: Tuesday, April 29, 2008 10:09 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] IoBuildSynchronousFsdRequest issues

Hello,

Overall objective: Read a file that is open with exclusive access
(locked) by some unknown process.

I have a kernel driver that receives a unicode string w/path & file
name…

If I do ZwOpenFile on an unlocked file followed by ZwReadFile, it works
as expected.
Do the same on a locked file, I get STATUS_SHARING_VIOLATION as
expected.

If I do ZwOpenFile on a locked file w/DesiredAccess =
FILE_READ_ATTRIBUTES only, I can use ZwQueryInformationFile to get the
size.

I know I have to create my own IRP with the IRP_PAGING_IO flag bit set
to make this work. (At least I think this is true…)

My immediate objective is to create my own IRPs to read an unlocked file

and then deal with the issues raised by IRP_PAGING_IO.

Currently:

A)
ZwOpenFile with DesiredAccess = FILE_READ_ATTRIBUTES only, ShareAccess =

FILE_SHARE_READ.
ZwQueryInformationFile to get the file size.

B)
IoGetDeviceObjectPointer (&Name, FILE_READ_ATTRIBUTES, &FileObject,
&DeviceObject);

C)
IoBuildSynchronousFsdRequest (IRP_MJ_READ, DeviceObject, Buffer,
PAGE_SIZE, Offset, &Event, &Iosb);

D)
IrpSp = IoGetNextIrpStackLocation (Irp);
IrpSp->FileObject = FileObject;

E)
IoCallDriver (DeviceObject, Irp);
if STATUS_PENDING, KeWaitForSingleObject (&Event, …) + get real status

from Iosb.Status;

F)
Status is STATUS_FILE_CLOSED.

I’ve experimented with variations at A) (leave file open, close file,
etc) and get either STATUS_SHARING_VIOLATION at B) or the status shown
at F).

Any comments on where I’m going wrong will be greatly appreciated.
Mickey.

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@edsiohio.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

I don’t know of any reason that it wouldn’t apart from the usual IRQL
restrictions. That said, I haven’t done any serious legacy filter model
work either :wink:

I’d say give a whirl and see what happens.

~Eric

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mickey Lane
Sent: Tuesday, April 29, 2008 11:34 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] IoBuildSynchronousFsdRequest issues

Eric Diven wrote:

Try using IoCreateFileSpecifyDeviceObjectHint with the
IO_IGNORE_SHARE_ACCESS_CHECK option. FltCreateFile supports that
option too.

~Eric

Thanks for the suggestion.

With the target file locked, changed the driver to the following.
Status from read is the same.

A)
IoGetDeviceObjectPointer (&Name, FILE_READ_ATTRIBUTES, &FileObject,
&DeviceObject);

B)
IoCreateFileSpecifyDeviceObjectHint (
&FileHandle,
GENERIC_READ, // ACCESS_MASK DesiredAccess,
&Oa, // OBJECT_ATTRIBUTES
&Iosb,
NULL, // AllocationSize OPTIONAL,
0, // Needed for open only
0, // ShareAccess ignored (options below)
FILE_OPEN, // Fail if file does not exist
FILE_NON_DIRECTORY_FILE, // CreateOptions (probably ignored)
NULL, // EaBuffer OPTIONAL,
0, // EaLength,
CreateFileTypeNone, // CREATE_FILE_TYPE CreateFileType,
NULL, // NULL for drivers,
IO_IGNORE_SHARE_ACCESS_CHECK, // Options,
DeviceObject);

C)
ZwQueryInformationFile correctly returns the file size

D)
IoBuildSynchronousFsdRequest (IRP_MJ_READ, DeviceObject, Buffer,
PAGE_SIZE, Offset, &Event, &Iosb);

E)
IrpSp = IoGetNextIrpStackLocation (Irp);
IrpSp->FileObject = FileObject;

F)
IoCallDriver (DeviceObject, Irp);
if STATUS_PENDING, KeWaitForSingleObject (&Event, …) + get real status

from Iosb.Status;

G)
Status is STATUS_FILE_CLOSED.

If I removed steps D) - F) and went back to ZwReadFile, would it work?

Thanks,
Mickey.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mickey Lane
Sent: Tuesday, April 29, 2008 10:09 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] IoBuildSynchronousFsdRequest issues

Hello,

Overall objective: Read a file that is open with exclusive access
(locked) by some unknown process.

I have a kernel driver that receives a unicode string w/path & file
name…

If I do ZwOpenFile on an unlocked file followed by ZwReadFile, it
works
as expected.
Do the same on a locked file, I get STATUS_SHARING_VIOLATION as
expected.

If I do ZwOpenFile on a locked file w/DesiredAccess =
FILE_READ_ATTRIBUTES only, I can use ZwQueryInformationFile to get the
size.

I know I have to create my own IRP with the IRP_PAGING_IO flag bit set

to make this work. (At least I think this is true…)

My immediate objective is to create my own IRPs to read an unlocked
file

and then deal with the issues raised by IRP_PAGING_IO.

Currently:

A)
ZwOpenFile with DesiredAccess = FILE_READ_ATTRIBUTES only, ShareAccess
=

FILE_SHARE_READ.
ZwQueryInformationFile to get the file size.

B)
IoGetDeviceObjectPointer (&Name, FILE_READ_ATTRIBUTES, &FileObject,
&DeviceObject);

C)
IoBuildSynchronousFsdRequest (IRP_MJ_READ, DeviceObject, Buffer,
PAGE_SIZE, Offset, &Event, &Iosb);

D)
IrpSp = IoGetNextIrpStackLocation (Irp);
IrpSp->FileObject = FileObject;

E)
IoCallDriver (DeviceObject, Irp);
if STATUS_PENDING, KeWaitForSingleObject (&Event, …) + get real
status

from Iosb.Status;

F)
Status is STATUS_FILE_CLOSED.

I’ve experimented with variations at A) (leave file open, close file,
etc) and get either STATUS_SHARING_VIOLATION at B) or the status shown

at F).

Any comments on where I’m going wrong will be greatly appreciated.
Mickey.

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@edsiohio.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag
argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@edsiohio.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

Eric Diven wrote:

I don’t know of any reason that it wouldn’t apart from the usual IRQL
restrictions. That said, I haven’t done any serious legacy filter model
work either :wink:

I’d say give a whirl and see what happens.

~Eric

re my:
> If I removed steps D) - F) and went back to ZwReadFile, would it work?

Apparently the open at B) gives me an invalid handle for ZwReadFile. It
works for ZwQueryInformationFile though…

B)
IoCreateFileSpecifyDeviceObjectHint (
&FileHandle,
GENERIC_READ, // ACCESS_MASK DesiredAccess,
&Oa, // OBJECT_ATTRIBUTES
&Iosb,
NULL, // AllocationSize OPTIONAL,
0, // Needed for open only
0, // ShareAccess ignored (options below)
FILE_OPEN, // Fail if file does not exist
FILE_NON_DIRECTORY_FILE, // CreateOptions (probably ignored)
NULL, // EaBuffer OPTIONAL,
0, // EaLength,
CreateFileTypeNone, // CREATE_FILE_TYPE CreateFileType,
NULL, // NULL for drivers,
IO_IGNORE_SHARE_ACCESS_CHECK, // Options,
DeviceObject);

I’m still double checking for SPMs.

(SPM = Stupid Programming Mistake :slight_smile:

Mickey.

6

A followup to my own post…

Apparently the handle created by IoCreateFileSpecifyDeviceObjectHint
causes ZwReadFile to return STATUS_PENDING on an 11 byte file.

The 1st time this happened, I pooched the O/S by completing a device
control IRP and returning the STATUS_PENDING without realizing it.

I fixed that by supplying an event to ZwReadFile and attempting to
wait for the completion. ZwReadFile wants a HANDLE to an event, not
a pointer to a KEVENT. This caused the STATUS_INVALID_HANDLE which
I was attributing to IoCreateFileSpecifyDeviceObjectHint.

FYI - There are no samples that show the use of an event and
ZwReadFile…

Anyway, the suggestion made by Eric seems to have done the trick.
More testing is needed but it looks promising.

My sincere thanks,
Mickey.

Mickey Lane wrote:

Eric Diven wrote:
> I don’t know of any reason that it wouldn’t apart from the usual IRQL
> restrictions. That said, I haven’t done any serious legacy filter model
> work either :wink:
>
> I’d say give a whirl and see what happens.
>
> ~Eric
>

re my:
> If I removed steps D) - F) and went back to ZwReadFile, would it work?

Apparently the open at B) gives me an invalid handle for ZwReadFile. It
works for ZwQueryInformationFile though…

> B)
> IoCreateFileSpecifyDeviceObjectHint (
> &FileHandle,
> GENERIC_READ, // ACCESS_MASK DesiredAccess,
> &Oa, // OBJECT_ATTRIBUTES
> &Iosb,
> NULL, // AllocationSize OPTIONAL,
> 0, // Needed for open only
> 0, // ShareAccess ignored (options below)
> FILE_OPEN, // Fail if file does not exist
> FILE_NON_DIRECTORY_FILE, // CreateOptions (probably ignored)
> NULL, // EaBuffer OPTIONAL,
> 0, // EaLength,
> CreateFileTypeNone, // CREATE_FILE_TYPE CreateFileType,
> NULL, // NULL for drivers,
> IO_IGNORE_SHARE_ACCESS_CHECK, // Options,
> DeviceObject);
>

I’m still double checking for SPMs.

(SPM = Stupid Programming Mistake :slight_smile:

Mickey.

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@earthlink.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

7

Use IoBuildAsynchronousFsdRequest+IoCallDriver instead of ZwReadFile.

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

“Mickey Lane” wrote in message news:xxxxx@ntfsd…
> A followup to my own post…
>
> Apparently the handle created by IoCreateFileSpecifyDeviceObjectHint
> causes ZwReadFile to return STATUS_PENDING on an 11 byte file.
>
> The 1st time this happened, I pooched the O/S by completing a device
> control IRP and returning the STATUS_PENDING without realizing it.
>
> I fixed that by supplying an event to ZwReadFile and attempting to
> wait for the completion. ZwReadFile wants a HANDLE to an event, not
> a pointer to a KEVENT. This caused the STATUS_INVALID_HANDLE which
> I was attributing to IoCreateFileSpecifyDeviceObjectHint.
>
> FYI - There are no samples that show the use of an event and
> ZwReadFile…
>
> Anyway, the suggestion made by Eric seems to have done the trick.
> More testing is needed but it looks promising.
>
> My sincere thanks,
> Mickey.
>
>
> Mickey Lane wrote:
> > Eric Diven wrote:
> >> I don’t know of any reason that it wouldn’t apart from the usual IRQL
> >> restrictions. That said, I haven’t done any serious legacy filter model
> >> work either :wink:
> >>
> >> I’d say give a whirl and see what happens.
> >>
> >> ~Eric
> >>
> >
> > re my:
> > > If I removed steps D) - F) and went back to ZwReadFile, would it work?
> >
> > Apparently the open at B) gives me an invalid handle for ZwReadFile. It
> > works for ZwQueryInformationFile though…
> >
> >> B)
> >> IoCreateFileSpecifyDeviceObjectHint (
> >> &FileHandle,
> >> GENERIC_READ, // ACCESS_MASK DesiredAccess,
> >> &Oa, // OBJECT_ATTRIBUTES
> >> &Iosb,
> >> NULL, // AllocationSize OPTIONAL,
> >> 0, // Needed for open only
> >> 0, // ShareAccess ignored (options below)
> >> FILE_OPEN, // Fail if file does not exist
> >> FILE_NON_DIRECTORY_FILE, // CreateOptions (probably ignored)
> >> NULL, // EaBuffer OPTIONAL,
> >> 0, // EaLength,
> >> CreateFileTypeNone, // CREATE_FILE_TYPE CreateFileType,
> >> NULL, // NULL for drivers,
> >> IO_IGNORE_SHARE_ACCESS_CHECK, // Options,
> >> DeviceObject);
> >>
> >
> >
> > I’m still double checking for SPMs.
> >
> > (SPM = Stupid Programming Mistake :slight_smile:
> >
> > Mickey.
> >
> > —
> > NTFSD is sponsored by OSR
> >
> > For our schedule debugging and file system seminars
> > (including our new fs mini-filter seminar) visit:
> > http://www.osr.com/seminars
> >
> > You are currently subscribed to ntfsd as: xxxxx@earthlink.net
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
>