NtFsControlFile and IOCTL_DISK_GET_DRIVE_LAYOUT

NTFSD
1

Hi all,

I’m trying to obtain partitioning information on a physical hard disk in
a Windows NT native application (linking to ntdll.lib). I’m trying to
open a hard disk volume via NtCreateFile() and then use
NtFsControlFile() to issue a IOCTL_DISK_GET_DRIVE_LAYOUT.

First, I can’t seem to get NtFsControlFile() to open a hard disk volume.
I’m always getting back an “invalid handle” error. That’s what I’m
using:

…

InitializeObjectAttributes (&ObjectAttributes,
&Device, /* \Device\HardDisk0 */
OBJ_CASE_INSENSITIVE,
NULL,
NULL);
…

ntStatus = NtCreateFile(&hDisk,
FILE_READ_DATA | SYNCHRONIZE,
&ObjectAttributes,
&IoStatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ | FILE_SHARE_WRITE,
FILE_OPEN,
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0);

I think I’ve tried all possible parameter combinations for
NtCreateFile(), but I’m always getting the same error. Can anybody help?

Second, how do I issue the IOCTL_DISK_GET_DRIVE_LAYOUT control code in a
native application? Will it work with NtFsControlFile()? Somehow I doubt
it because IIRC NtFsControlFile() wants FSCTL_* control codes that are
defined differently from IOCTL_* codes.

Thanks!

Ralf.

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

Try to search in ntfsd archive list (www.osr.com -> List Server -> ntfsd)
for “PARTITION_INFORMATION IOCTL_DISK_GET_DRIVE_GEOMETRY
IOCTL_DISK_GET_DRIVE_LAYOUT …” and you will find a lot of useful hints and
information there.
I think that you are sending your IOCTL requests to a wrong device
(HardDisk0).
Wbr Primoz

-----Original Message-----
From: Ralf Buschmann [mailto:xxxxx@backmagic.de]
Sent: Friday, January 04, 2002 12:16 PM
To: File Systems Developers
Subject: [ntfsd] NtFsControlFile and IOCTL_DISK_GET_DRIVE_LAYOUT

Hi all,

I’m trying to obtain partitioning information on a physical hard disk in
a Windows NT native application (linking to ntdll.lib). I’m trying to
open a hard disk volume via NtCreateFile() and then use
NtFsControlFile() to issue a IOCTL_DISK_GET_DRIVE_LAYOUT.

First, I can’t seem to get NtFsControlFile() to open a hard disk volume.
I’m always getting back an “invalid handle” error. That’s what I’m
using:

…

InitializeObjectAttributes (&ObjectAttributes,
&Device, /* \Device\HardDisk0 */
OBJ_CASE_INSENSITIVE,
NULL,
NULL);
…

ntStatus = NtCreateFile(&hDisk,
FILE_READ_DATA | SYNCHRONIZE,
&ObjectAttributes,
&IoStatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ | FILE_SHARE_WRITE,
FILE_OPEN,
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0);

I think I’ve tried all possible parameter combinations for
NtCreateFile(), but I’m always getting the same error. Can anybody help?

Second, how do I issue the IOCTL_DISK_GET_DRIVE_LAYOUT control code in a
native application? Will it work with NtFsControlFile()? Somehow I doubt
it because IIRC NtFsControlFile() wants FSCTL_* control codes that are
defined differently from IOCTL_* codes.

Thanks!

Ralf.

You are currently subscribed to ntfsd as: xxxxx@hermes.si
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

3

Hi there!

First of all, you must use NtDeviceIoControlFile instead of NtFsControlFile
to issue IOCTL_XXX codes. NtFsControlFile is used with FSCTL_XXX codes only!
(They generate different IRP_MJ_XXX requests). If you’re missing function
prototypes or a header, try searching the web for ntifs.h - I think Bo Branten
has put up a public-domain header…
Maybe, you’ve opened a wrong device: if you have opened e.g. ??\C:, try
opening ??\C: instead (without trailing backslash). If a trailing backslash is
present, the filesystem currently mounted on a drive is opened. If it’s not
present, the underlying partition is opened. You may also try
GENERIC_READ|GENERIC_EXECUTE|SYNCHRONIZE instead of FILE_READ_DATA|SYNCHRONIZE…

Greetings (I hope I could help),
Alex

Hi all,

I’m trying to obtain partitioning information on a physical hard disk in
a Windows NT native application (linking to ntdll.lib). I’m trying to
open a hard disk volume via NtCreateFile() and then use
NtFsControlFile() to issue a IOCTL_DISK_GET_DRIVE_LAYOUT.

First, I can’t seem to get NtFsControlFile() to open a hard disk volume.
I’m always getting back an “invalid handle” error. That’s what I’m
using:

…

InitializeObjectAttributes (&ObjectAttributes,
&Device, /* \Device\HardDisk0 */
OBJ_CASE_INSENSITIVE,
NULL,
NULL);
…

ntStatus = NtCreateFile(&hDisk,
FILE_READ_DATA | SYNCHRONIZE,
&ObjectAttributes,
&IoStatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ | FILE_SHARE_WRITE,
FILE_OPEN,
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0);

I think I’ve tried all possible parameter combinations for
NtCreateFile(), but I’m always getting the same error. Can anybody help?

Second, how do I issue the IOCTL_DISK_GET_DRIVE_LAYOUT control code in a
native application? Will it work with NtFsControlFile()? Somehow I doubt
it because IIRC NtFsControlFile() wants FSCTL_* control codes that are
defined differently from IOCTL_* codes.

Thanks!

Ralf.

You are currently subscribed to ntfsd as: xxxxx@gmx.net
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

–
GMX - Die Kommunikationsplattform im Internet.
http://www.gmx.net

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

4

> open a hard disk volume via NtCreateFile() and then use

NtFsControlFile() to issue a IOCTL_DISK_GET_DRIVE_LAYOUT.

Try NtDeviceIoControlFile instead. Usual Win32 DeviceIoControl works fine for this.

Max

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

5

Maxim,

you wrote on Friday, January 04, 2002, 15:45:32:

> open a hard disk volume via NtCreateFile() and then use
> NtFsControlFile() to issue a IOCTL_DISK_GET_DRIVE_LAYOUT.

MSS> Try NtDeviceIoControlFile instead. Usual Win32 DeviceIoControl works fine for this.

Thanks to all who replied. I didn’t know there was
NtDeviceIoControlFile(). Now if I only could figure out how to call
NtCreateFile() to open \Device\HardDisk0. It just won’t let me. Grr.
Of course, CreateFile() in Win32 mode works just fine.

Ralf.

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

6

\Device\Harddisk0 is not a device; it is an object manager directory.
If you want to open the entire disk, use \Device\Harddisk0\Partition0.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ralf Buschmann
Sent: Friday, January 04, 2002 8:27 AM
To: File Systems Developers
Subject: [ntfsd] Re: NtFsControlFile and IOCTL_DISK_GET_DRIVE_LAYOUT

Maxim,

you wrote on Friday, January 04, 2002, 15:45:32:

>> open a hard disk volume via NtCreateFile() and then use
>> NtFsControlFile() to issue a IOCTL_DISK_GET_DRIVE_LAYOUT.

MSS> Try NtDeviceIoControlFile instead. Usual Win32 DeviceIoControl
MSS> works fine for this.

Thanks to all who replied. I didn’t know there was
NtDeviceIoControlFile(). Now if I only could figure out how to call
NtCreateFile() to open \Device\HardDisk0. It just won’t let
me. Grr. Of course, CreateFile() in Win32 mode works just fine.

Ralf.

You are currently subscribed to ntfsd as: xxxxx@privtek.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

7

Maybe you can try to open ??\PhysicalDrive0 symbolic link, because
this is exactly what you can successfully open by Win32 CreateFile,
moreover it should work on all NT platforms from 4.0 to XP.

Also I reccomend to use only FILE_READ_ATTRIBUTES as the file
specific access right in the DesiredAccess (of course you can combine
it with the following generic access rights: READ_CONTROL, WRITE_DAC,
WRITE_OWNER, SYNCHRONIZE and ACCESS_SYSTEM_SECURITY).
This thechnique tells the Io Manager that you want to open the physical
device instead of mounted FSD, thus preventing to mount the Partition0.

Finally you don’t have to use the NtCreateFile routine, NtOpenFile is enough
and it takes significantly less arguments - the minimum required.

Hope this helps
Paul

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Ralf Buschmann
Sent: Friday, January 04, 2002 4:27 PM
To: File Systems Developers
Subject: [ntfsd] Re: NtFsControlFile and IOCTL_DISK_GET_DRIVE_LAYOUT

Maxim,

you wrote on Friday, January 04, 2002, 15:45:32:

> open a hard disk volume via NtCreateFile() and then use
> NtFsControlFile() to issue a IOCTL_DISK_GET_DRIVE_LAYOUT.

MSS> Try NtDeviceIoControlFile instead. Usual Win32 DeviceIoControl works
fine for this.

Thanks to all who replied. I didn’t know there was
NtDeviceIoControlFile(). Now if I only could figure out how to call
NtCreateFile() to open \Device\HardDisk0. It just won’t let me. Grr.
Of course, CreateFile() in Win32 mode works just fine.

Ralf.

You are currently subscribed to ntfsd as: xxxxx@compelson.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

8

Dear Dan,

you wrote on Friday, January 04, 2002, 16:51:47:

DK> \Device\Harddisk0 is not a device; it is an object manager directory.
DK> If you want to open the entire disk, use \Device\Harddisk0\Partition0.

Many thanks, that solved it!

Now I need to figure out why the returned array of PARTITION_INFORMATION
structures appears to contain nonsense.

Ralf.

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

9

I wrote on Monday, January 07, 2002, 17:07:02:

DK>> \Device\Harddisk0 is not a device; it is an object manager directory.
DK>> If you want to open the entire disk, use \Device\Harddisk0\Partition0.

RB> Many thanks, that solved it!

RB> Now I need to figure out why the returned array of PARTITION_INFORMATION
RB> structures appears to contain nonsense.

In case anyone is interested in the solution: it’s documented nowhere,
but the system definitely pads each returned PARTITION_INFORMATION
structure by four extra bytes. If you account for that in the code,
things fall into place.

Ralf.

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com