IoCreateFile returns C0000005 on shadow device object

NTFSD
1

Hi guys,

Another question, just before the start of the weekend.

In order to prevent reentrancy in my driver, I use shadow device
objects. Whenever my driver needs to access files that it has previously
“intercepted”, the IoCreateFile is directed to the shadow device object.
So instead of using the “??\C:\My Documents” object name, it uses
“\Device\MyShadowDeviceC\My Documents”. This all works fine (I’m talking
Windows 2000 by the way).

However, when I need to open a directory file in order to do a query for
a filename, the IoCreateFile function returns 0xC0000005 (access
violation). This is true for each and every directory file. This is the
way I’m calling IoCreateFile:

InitializeObjectAttributes(&ObjectAttributes,
&FileName,
OBJ_CASE_INSENSITIVE,
NULL,
NULL);
ntStatus = IoCreateFile(&NtFileHandle,
SYNCHRONIZE | FILE_LIST_DIRECTORY,
&ObjectAttributes,
&IoStatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_OPEN,

FILE_SYNCHRONOUS_IO_ALERT|FILE_DIRECTORY_FILE,
NULL,
0,
CreateFileTypeNone,
0,
IO_CHECK_CREATE_PARAMETERS);

In this case, the filename looks like "\Device\MyShadowDeviceC", or
“\Device\MyShadowDeviceC\My Documents”.

Does anybody of you know why IoCreateFile is returning 0xC0000005 ?

By the way, the call never gets send to the device object, because I
don’t see it in my dispatch handler.

Thanks in advance, have a good weekend.

Bartjan.

2

One of the pointer parameters you pass is most likely invalid. C0000005
translates to an access violation. You dont see a IRP send down because most
likely the call fails when ZwCreateFile validates the parameters.

----- Original Message -----
From: “Bartjan Wattel”
To: “File Systems Developers”
Sent: Friday, August 16, 2002 7:44 PM
Subject: [ntfsd] IoCreateFile returns C0000005 on shadow device object

> Hi guys,
>
> Another question, just before the start of the weekend.
>
> In order to prevent reentrancy in my driver, I use shadow device
> objects. Whenever my driver needs to access files that it has previously
> “intercepted”, the IoCreateFile is directed to the shadow device object.
> So instead of using the “??\C:\My Documents” object name, it uses
> “\Device\MyShadowDeviceC\My Documents”. This all works fine (I’m talking
> Windows 2000 by the way).
>
> However, when I need to open a directory file in order to do a query for
> a filename, the IoCreateFile function returns 0xC0000005 (access
> violation). This is true for each and every directory file. This is the
> way I’m calling IoCreateFile:
>
> InitializeObjectAttributes(&ObjectAttributes,
> &FileName,
> OBJ_CASE_INSENSITIVE,
> NULL,
> NULL);
> ntStatus = IoCreateFile(&NtFileHandle,
> SYNCHRONIZE | FILE_LIST_DIRECTORY,
> &ObjectAttributes,
> &IoStatus,
> NULL,
> FILE_ATTRIBUTE_NORMAL,
> FILE_SHARE_READ,
> FILE_OPEN,
>
> FILE_SYNCHRONOUS_IO_ALERT|FILE_DIRECTORY_FILE,
> NULL,
> 0,
> CreateFileTypeNone,
> 0,
> IO_CHECK_CREATE_PARAMETERS);
>
> In this case, the filename looks like "\Device\MyShadowDeviceC", or
> “\Device\MyShadowDeviceC\My Documents”.
>
> Does anybody of you know why IoCreateFile is returning 0xC0000005 ?
>
> By the way, the call never gets send to the device object, because I
> don’t see it in my dispatch handler.
>
> Thanks in advance, have a good weekend.
>
> Bartjan.
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to %%email.unsub%%
>