Problem With FltGetVolumeFromName

NTFSD
1

Hi,

I am using the API FltGetVolumeFromName for getting the volume opaque pointer from the volume name.

But the API is returning a status c0000005L which corresponds to STATUS_ACCESS_DENIED.

The specified volume exists on the disk, so that is not an error.

Following is a snippet of the code that i am using.

ReadFile()
{

HANDLE fileHandle;
OBJECT_ATTRIBUTES oa;
UNICODE_STRING fileName;
IO_STATUS_BLOCK iosb;
NTSTATUS status;
PVOID pFileObject = NULL ;
PFLT_VOLUME pE;
PFLT_INSTANCE RetInstance;

status = FltBuildDefaultSecurityDescriptor( &sd,FLT_PORT_ALL_ACCESS );

DbgPrint(“Inside ReadFile”);

status = FltGetVolumeFromName(DataCipherData.Filter,
L"\??\E:",
&pE
);

DbgPrint(“Value Returned by FltGetVolumeFromName is %x”,status);

status = FltGetVolumeInstanceFromName(DataCipherData.Filter,
pE,
NULL,
&RetInstance
);

DbgPrint(“Value returned by FltGetVolumeInstanceFromName is %x”,status);

DbgPrint(“Leaving Read File”);

}

The status returned by FltGetVolumeFromName is c0000005 which corresponds to STATUS_ACCESS_VIOLATION.

I want to know how to get over this.

Please help.

Thanks for any replies.

Regards,
Aman.

2

xxxxx@yahoo.co.uk wrote:

status = FltGetVolumeFromName(DataCipherData.Filter,
L"\??\E:",
&pE
The second parameter should be a UNICODE_STRING not a static string.

3

Hi Tony,

It is a UNICODE_STRING. I have that ‘L’ before the path , which makes it a unicode string… ain’t it?

Regards,
Aman.

4

xxxxx@yahoo.co.uk wrote:

Hi Tony,

It is a UNICODE_STRING. I have that ‘L’ before the path , which makes it a unicode string… ain’t it?

Umm… no. (btw. your compiler should have refused to compile this…
the stock makefiles certainly would).

http://www.osronline.com/DDKx/kmarch/k112_401e.htm

Tony