NtDeviceIoControlFile with IOCTL_TCP_QUERY_INFORMATION_EX code

NTDEV
1

Hi all!
I have such a problem - i am doing a request to the \Device\TCP using NtDeviceIoControlFile with IoControlcode=IOCTL_TCP_QUERY_INFORMATION_EX, and this routine returns STATUS_ACCESS_VIOLATION (almost always).
I use next code:
TCP_REQUEST_QUERY_INFORMATION_EX req = {0};

RtlInitUnicodeString(&UnicodeStr, L"\Device"\TCP");

InitializeObjectAttributes(&ObjectAttributes,&UnicodeStr,OBJ_CASE_INSENSITIVE, NULL, NULL );

ntStatus = ZwOpenFile ( &hFile,SYNCHRONIZE, &ObjectAttributes, &IoStatusBlock, 3,0);

KeInitializeEvent(&Event,SynchronizationEvent,TRUE);

req.ID.toi_entity.tei_entity = CO_TL_ENTITY; //tcp

req.ID.toi_entity.tei_instance = 0;

req.ID.toi_class = INFO_CLASS_PROTOCOL;

req.ID.toi_type = INFO_TYPE_PROVIDER;

req.ID.toi_id = IF_MIB_STATS_ID;

ntStatus = NtDeviceIoControlFile(hFile,(HANDLE)&Event,NULL,NULL,&IoStatusBlock,0x00120003,&req,sizeof(req),

&EntryList,sizeof(EntryList));

what is the problem?

Thanks in advance.

2

You cant pass a PKEVENT as a Event handle to NtDeviceIoControlFile. It requires a HANDLE . Dont do fantesist typecast on completly unrealted objects.

Dan

----- Original Message -----
From: Sasha Dolgopolov
To: Windows System Software Devs Interest List
Sent: Friday, June 11, 2004 5:57 PM
Subject: [ntdev] NtDeviceIoControlFile with IOCTL_TCP_QUERY_INFORMATION_EX code

Hi all!
I have such a problem - i am doing a request to the \Device\TCP using NtDeviceIoControlFile with IoControlcode=IOCTL_TCP_QUERY_INFORMATION_EX, and this routine returns STATUS_ACCESS_VIOLATION (almost always).
I use next code:
TCP_REQUEST_QUERY_INFORMATION_EX req = {0};

RtlInitUnicodeString(&UnicodeStr, L"\Device"\TCP");

InitializeObjectAttributes(&ObjectAttributes,&UnicodeStr,OBJ_CASE_INSENSITIVE, NULL, NULL );

ntStatus = ZwOpenFile ( &hFile,SYNCHRONIZE, &ObjectAttributes, &IoStatusBlock, 3,0);

KeInitializeEvent(&Event,SynchronizationEvent,TRUE);

req.ID.toi_entity.tei_entity = CO_TL_ENTITY; //tcp

req.ID.toi_entity.tei_instance = 0;

req.ID.toi_class = INFO_CLASS_PROTOCOL;

req.ID.toi_type = INFO_TYPE_PROVIDER;

req.ID.toi_id = IF_MIB_STATS_ID;

ntStatus = NtDeviceIoControlFile(hFile,(HANDLE)&Event,NULL,NULL,&IoStatusBlock,0x00120003,&req,sizeof(req),

&EntryList,sizeof(EntryList));

what is the problem?

Thanks in advance.

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@rdsor.ro
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

What then have i to pass there? how can i retrieve a handle of this object?
----- Original Message -----
From: Dan Partelly
To: Windows System Software Devs Interest List
Sent: Friday, June 11, 2004 6:08 PM
Subject: Re: [ntdev] NtDeviceIoControlFile with IOCTL_TCP_QUERY_INFORMATION_EX code

You cant pass a PKEVENT as a Event handle to NtDeviceIoControlFile. It requires a HANDLE . Dont do fantesist typecast on completly unrealted objects.

Dan

----- Original Message -----
From: Sasha Dolgopolov
To: Windows System Software Devs Interest List
Sent: Friday, June 11, 2004 5:57 PM
Subject: [ntdev] NtDeviceIoControlFile with IOCTL_TCP_QUERY_INFORMATION_EX code

Hi all!
I have such a problem - i am doing a request to the \Device\TCP using NtDeviceIoControlFile with IoControlcode=IOCTL_TCP_QUERY_INFORMATION_EX, and this routine returns STATUS_ACCESS_VIOLATION (almost always).
I use next code:
TCP_REQUEST_QUERY_INFORMATION_EX req = {0};

RtlInitUnicodeString(&UnicodeStr, L"\Device"\TCP");

InitializeObjectAttributes(&ObjectAttributes,&UnicodeStr,OBJ_CASE_INSENSITIVE, NULL, NULL );

ntStatus = ZwOpenFile ( &hFile,SYNCHRONIZE, &ObjectAttributes, &IoStatusBlock, 3,0);

KeInitializeEvent(&Event,SynchronizationEvent,TRUE);

req.ID.toi_entity.tei_entity = CO_TL_ENTITY; //tcp

req.ID.toi_entity.tei_instance = 0;

req.ID.toi_class = INFO_CLASS_PROTOCOL;

req.ID.toi_type = INFO_TYPE_PROVIDER;

req.ID.toi_id = IF_MIB_STATS_ID;

ntStatus = NtDeviceIoControlFile(hFile,(HANDLE)&Event,NULL,NULL,&IoStatusBlock,0x00120003,&req,sizeof(req),

&EntryList,sizeof(EntryList));

what is the problem?

Thanks in advance.

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@rdsor.ro
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@maus.donetsk.ua
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Either use ZwCreateEvent to create a “real” event object (a little bit
slower), or roll your own IRP with IoBuildDeviceIoControlRequest and send it
with IoCallDriver (a little bit harder).

–htfv

“Sasha Dolgopolov” wrote in message
news:xxxxx@ntdev…
What then have i to pass there? how can i retrieve a handle of this object?
----- Original Message -----
From: Dan Partelly
To: Windows System Software Devs Interest List
Sent: Friday, June 11, 2004 6:08 PM
Subject: Re: [ntdev] NtDeviceIoControlFile with
IOCTL_TCP_QUERY_INFORMATION_EX code

You cant pass a PKEVENT as a Event handle to NtDeviceIoControlFile. It
requires a HANDLE . Dont do fantesist typecast on completly unrealted
objects.

Dan

----- Original Message -----
From: Sasha Dolgopolov
To: Windows System Software Devs Interest List
Sent: Friday, June 11, 2004 5:57 PM
Subject: [ntdev] NtDeviceIoControlFile with
IOCTL_TCP_QUERY_INFORMATION_EX code

Hi all!
I have such a problem - i am doing a request to the \Device\TCP using
NtDeviceIoControlFile with IoControlcode=IOCTL_TCP_QUERY_INFORMATION_EX, and
this routine returns STATUS_ACCESS_VIOLATION (almost always).
I use next code:
TCP_REQUEST_QUERY_INFORMATION_EX req = {0};

RtlInitUnicodeString(&UnicodeStr, L"\Device"\TCP");

InitializeObjectAttributes(&ObjectAttributes,&UnicodeStr,OBJ_CASE_INSENSITIV
E, NULL, NULL );

ntStatus = ZwOpenFile ( &hFile,SYNCHRONIZE, &ObjectAttributes,
&IoStatusBlock, 3,0);

KeInitializeEvent(&Event,SynchronizationEvent,TRUE);

req.ID.toi_entity.tei_entity = CO_TL_ENTITY; //tcp

req.ID.toi_entity.tei_instance = 0;

req.ID.toi_class = INFO_CLASS_PROTOCOL;

req.ID.toi_type = INFO_TYPE_PROVIDER;

req.ID.toi_id = IF_MIB_STATS_ID;

ntStatus =
NtDeviceIoControlFile(hFile,(HANDLE)&Event,NULL,NULL,&IoStatusBlock,0x001200
03,&req,sizeof(req),

&EntryList,sizeof(EntryList));

what is the problem?

Thanks in advance.

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@rdsor.ro
To unsubscribe send a blank email to xxxxx@lists.osr.com
—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@maus.donetsk.ua
To unsubscribe send a blank email to xxxxx@lists.osr.com