Re[2]: Read Boot Sector with ZwXXX

Hello vartika,

just a quick look at the code, i might be wrong. try to read in sector
aligned sizes. ie not 35 bytes but 512, 1024 bytes.


Best regards,
Ivona Prenosilova

Hello Mark,

Tuesday, August 03, 2004, 12:46:30 PM, you wrote:

MR> I’m not interested in your code.
I’m not interested in your replies like this. if you don’t know or
don’t want to answer, better write nothing.


Best regards,
Ivona Prenosilova

Hi Mark,

In my particular PC’s boot sector i dnt have the
MBR,but my own image file which later on loads the MBR
which is placed in some other sector of C=0,H=0.
Im placing some information in the first sector which
i want my driver to read when it comes up.
Now,my driver is an upper disk filter driver, which
comes up after the disk driver has loaded.
I want to access that information before any read
takes place, because i derive my key from that info.
So, isn’t there any way in which i could read that
particular sector before file system starts
mounting…???

rgds
V.S.


Do you Yahoo!?
Yahoo! Mail - 50x more storage than other providers!
http://promotions.yahoo.com/new_mail

Hey Ivona,

Thanx.Im able to read the sector now.
But a new problem has come up.
Now after Zwreadfile ,second time when the request
comes down from the filesystem for the 1st sector, i
get a bugcheck at …

if( Irp->PendingReturned )
{
IoMarkIrpPending( Irp );
}

in my read completion routine.

But other requests in between requests for other
sectors are working fine.

rgds

V.S.


Do you Yahoo!?
Yahoo! Mail - You care about security. So do we.
http://promotions.yahoo.com/new_mail

Hi Peter,

how safe it would be to use KeLoaderBlock to get loader block
structure and use it in the way you mentioned?
Or is there any other way to get arc names for current boot and system
partitions?

Thanks.

Andrey

PW> You could pull all of this code out of your driver’s read routine and
PW> just read the first sector during IRP_MJ_PNP/IRP_MN_START_DEVICE
PW> processing after the IRP has been completed by the lower driver.

PW> Do you have a single key on the boot disk (whatever that may be) that
PW> you use for all other disks? Or does each disk have its own key.

PW> If it’s the former - how do you know that \device\harddisk0\partition0
PW> is the boot disk? There is no guarantee that the first disk in the
PW> system is the boot disk. You would need to check the loader block to
PW> get the arc name of the boot disk, and then open that in order to read
PW> the value.

PW> -p

Well it’s not documented in the DDK, so I’d have to say “not
particularly safe”.

-p

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Andrey Kolishak
Sent: Wednesday, August 04, 2004 11:30 AM
To: Windows System Software Devs Interest List
Subject: Re[2]: [ntdev] Read Boot Sector with ZwXXX

Hi Peter,

how safe it would be to use KeLoaderBlock to get loader block structure
and use it in the way you mentioned?
Or is there any other way to get arc names for current boot and system
partitions?

Thanks.

Andrey

PW> You could pull all of this code out of your driver’s read routine
PW> and just read the first sector during IRP_MJ_PNP/IRP_MN_START_DEVICE

PW> processing after the IRP has been completed by the lower driver.

PW> Do you have a single key on the boot disk (whatever that may be)
PW> that you use for all other disks? Or does each disk have its own
key.

PW> If it’s the former - how do you know that
PW> \device\harddisk0\partition0 is the boot disk? There is no
PW> guarantee that the first disk in the system is the boot disk. You
PW> would need to check the loader block to get the arc name of the boot

PW> disk, and then open that in order to read the value.

PW> -p


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com