IoCallDriver on HardDiskVolume1 return INVALID_DEVICE_REQUEST

NTFSD
1

Hello,

Our driver is non FSFD/FSD driver which process some IOCTL.

On recieving a specific IO control; I want to raise a rename IRP. I wrote some test code but call to IoCallDriver returns c0000010, i.e. status_invalid_device_request. Device object for \Device\HarddiskVolume1 should support IRP_MJ_SET_INFORMATION. Isn’t it?

Please suggest me any possible cause for the mentioned error code.

/*code modified for better reading, excluded few error checks, this is running without any BSODs*/

RtlInitUnicodeString( &str, L"\Device\HarddiskVolume1" );
InitializeObjectAttributes(&obj, &str, OBJ_CASE_INSENSITIVE, 0, 0);

status = ZwOpenFile (&hNTFSHandle, STANDARD_RIGHTS_READ, &obj, &IoStatus,
FILE_SHARE_READ, FILE_NON_DIRECTORY_FILE);

if( !NT_SUCCESS(status) ) {
return SOME_ERROR_CODE;//
}

status = ObReferenceObjectByHandle( hNTFSHandle, GENERIC_READ, NULL, KernelMode, &pFileObj, NULL );

pDevicePre = IoGetRelatedDeviceObject( pFileObj );//declared as PFILE_OBJECT

USHORT IrpSize = IoSizeOfIrp( pDevicePre->StackSize+1 );

Irp = ExAllocatePool(NonPagedPool, IrpSize);

if (Irp == NULL)
return STATUS_INSUFFICIENT_RESOURCES;

KeInitializeEvent( &IoEvent, NotificationEvent, FALSE );

IoInitializeIrp(Irp, IrpSize, pDevicePre->StackSize+1);

RtlInitUnicodeString( &TargetStr, L"\Device\HarddiskVolume1\aditya\abc.txt" );

InitializeObjectAttributes( &obj, &TargetStr, OBJ_CASE_INSENSITIVE, 0, 0 );

status = ZwOpenFile (&hFileHandle, STANDARD_RIGHTS_READ|DELETE,
&obj, &IoStatus,FILE_SHARE_READ,FILE_NON_DIRECTORY_FILE);

if( !NT_SUCCESS(status) )
return SOME_ERROR_CODE;

status = ObReferenceObjectByHandle( hFileHandle, GENERIC_READ|DELETE, NULL, KernelMode, &pIrpFileObj, NULL );

Irp->Tail.Overlay.Thread = PsGetCurrentThread();

Irp->RequestorMode = KernelMode;
Irp->UserIosb = &ioStatusBlock;
Irp->UserEvent = NULL;
Irp->Flags = IRP_SYNCHRONOUS_API;
irpSp = IoGetNextIrpStackLocation( Irp );
irpSp->MajorFunction = IRP_MJ_SET_INFORMATION;
irpSp->FileObject = pIrpFileObj /*Set it to soure file object*/;

pRenameInfo = ExAllocatePool( NonPagedPool, sizeof(FILE_RENAME_INFORMATION) +wcslen( L"\Device\HarddiskVolume1\Aditya\abc.txt" )*sizeof(WCHAR) );

if(!pRenameInfo)
return SOME_ERROR_CODE;

pRenameInfo->ReplaceIfExists = FALSE;
pRenameInfo->RootDirectory = NULL;
pRenameInfo->FileNameLength = wcslen( L"\Device\HarddiskVolume1\Aditya\xyz.txt" )*sizeof(WCHAR);
wcscpy( pRenameInfo->FileName, L"\Device\HarddiskVolume1\Aditya\xyz.txt" );
irpSp->Parameters.SetFile.Length = sizeof(FILE_RENAME_INFORMATION)+wcslen( L"\Device\HarddiskVolume1\Aditya\abc.txt" )*sizeof(WCHAR);
irpSp->Parameters.SetFile.FileInformationClass = FileRenameInformation;
irpSp->Parameters.SetFile.FileObject = NULL;
irpSp->Parameters.SetFile.ReplaceIfExists =FALSE;
Irp->AssociatedIrp.SystemBuffer = pRenameInfo /*FileInformation*/;

IoSetCompletionRoutine( Irp, SpyQueryCompletion, &IoEvent,TRUE,TRUE, TRUE );

status = IoCallDriver( pDevicePre, Irp );//This return ERROR

if (STATUS_PENDING == status) {
KeWaitForSingleObject( &IoEvent, Executive, KernelMode, FALSE, NULL );
}
else
DbgPrint(“IoCallDriver returned %x”, status ); //

/*Cleaning code here*/

Thanks for your patience and time.
Aditya

2

if in same code I changed the major function to IRP_MJ_READ than IoCallDriver is returning STATUS_PENDING.

It means that the driver to which I am sending the SET_INFORMATION is not supporting that, but is it not suppose to support this IRP?

Am I getting a pointer to a device object which is in storage stack instead of file system?

Thanks
Aditya

3

> Am I getting a pointer to a device object which is in storage stack instead of file system?

It should be the volume file object of NTFS.

Use L"\Device\HarddiskVolume1\" with a trailing backslash to open the root directory.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

4

Thanks Maxim,

I read the post on similar topic at OSR http://www.osronline.com/showthread.cfm?link=114022 and clarified my doubts.

Thanks
Aditya

5

I modified my code as per the link mentioned in last post. Now the driver is giving me STATUS_OBJECT_NAME_INVALID. I checked and found in my code

irpSp->FileObject = pIrpFileObj /*Set it to soure file object*/;

While the documentation says that it should be a Pointer to the file object that is associated with DeviceObject. So this is the probable mistake, after this I tried but not found the place to put my source file_object pointer.

Where exactly should I place my source file object. as the help for SET_INFO says that
“The RelatedFileObject field of the FILE_OBJECT structure is not valid during the processing of IRP_MJ_SET_INFORMATION and should not be used.”

Thanks
Aditya