mem allocation and Native API

NTFSD
1

Hello everyone!

I’ have a problem with allocated memory in Windows Native API. I devided
my code in such a way that i can use Win32 API functions and Native API
functions. I allocate a large buffer with malloc and then i pass the
pointer of the buffer to the native API functions. The problem is that i
always get STATUS_ACCESS_VIOLATION when i use ZwQueryDirectoryFile, but
only if i adress memory larger than 4096 bytes, although the allocated
size is 10MB!

I’m a novice in Native API so are there any limitations that i’m not
aware of, or is anything else i’m doing wrong?

Any help will be much aprichiated.

Best regards

Peter

2

Peter Fiser wrote:

Hello everyone!

I’ have a problem with allocated memory in Windows Native API. I devided
my code in such a way that i can use Win32 API functions and Native API
functions. I allocate a large buffer with malloc and then i pass the
pointer of the buffer to the native API functions. The problem is that i
always get STATUS_ACCESS_VIOLATION when i use ZwQueryDirectoryFile, but
only if i adress memory larger than 4096 bytes, although the allocated
size is 10MB!

So you’re allocating 10MB in userspace, then in your driver using
ZwQueryDirectoryFile? Are you checking that the pointer is valid before
using it?

OTOH it sounds backwards to me… you’d be better allocating in the
driver then passing relevant data back to userspace… what will your
driver do if the userspace app dies in between getting the pointer and
using it for example?

Tony

3

First tnx for the quick reply!

Yes, i do check for a valid pointer, i also manage to use it, but only
the first 4k of allocated memory.
I should also state, that i’m not writing a driver, but i’m just using
some native API function that are suposed to be quicker than win32
counterparts (ZwqueryDirectoryFile in an recursive call, like a
treewalk).

Any ideas?

Peter

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Tony Hoyle
Sent: 24. april 2006 15:14
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] mem allocation and Native API

Peter Fiser wrote:

Hello everyone!

I’ have a problem with allocated memory in Windows Native API. I
devided
my code in such a way that i can use Win32 API functions and Native
API
functions. I allocate a large buffer with malloc and then i pass the
pointer of the buffer to the native API functions. The problem is that
i
always get STATUS_ACCESS_VIOLATION when i use ZwQueryDirectoryFile,
but
only if i adress memory larger than 4096 bytes, although the allocated

size is 10MB!

So you’re allocating 10MB in userspace, then in your driver using
ZwQueryDirectoryFile? Are you checking that the pointer is valid before

using it?

OTOH it sounds backwards to me… you’d be better allocating in the
driver then passing relevant data back to userspace… what will your
driver do if the userspace app dies in between getting the pointer and
using it for example?

Tony

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@hermes.si
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Peter Fiser wrote:

First tnx for the quick reply!

Yes, i do check for a valid pointer, i also manage to use it, but only
the first 4k of allocated memory.
I should also state, that i’m not writing a driver, but i’m just using
some native API function that are suposed to be quicker than win32
counterparts (ZwqueryDirectoryFile in an recursive call, like a
treewalk).

Well since this is the nt filesystem driver list you’re probably asking
in the wrong place.

I don’t see that ZwQueryDirectoryFile would be quicker… just a lot more
complex to setup. If you’re in userspace use FindFirstFile/FindNextFile.

Tony