Hmm, I tried that in user mode (without OBJ_KERNEL_HANDLE of course)
and all worked. SYNCHRONIZE flag is not a problem.
Missing FILE_ATTRIBUTE_NORMAL is not a problem.
Are you sure that the unicode string is OK, and are you sure
you are opening a file (since you specified FILE_NON_DIRECTORY_FILE) ?
What is within “pFilePath” ? Aren’t you passing a DOS name,
like “C:\Dir\File.ext” ?
You can use FileTest utility, available at OSR, for playing with
NtCreateFile, you can interactively set flags in a dialog and
then fire NtCreateFile to see what happens.
L.
At 07:59 10/06/2008, Ayush Gupta wrote:
Hi!
BTW, when exactly are you calling ZwCreateFile? If it is being called very
early in boot phase, then you need to give the path name as
\SystemRoot\System32\pro.dat.
Not sure the OP is up to understanding the namespace
conventions. Doran more or less posted the right string earlier, but
missed something and the OP didn’t spot it. For the OP, it needs to
be stated that the above string converts to
“\\SystemRoot\System32\pro.dat”.
Mark.
BTW, why do you set ShareMode to non-zero value??? Normally drivers set it to zero, because kernel-mode components are supposed to request an exclusive access to the file - once they have specified OBJ_KENEL_HANDLE, all kernel-mode components will be able to use the handle anyway, regardless of process context (because OBJ_KENEL_HANDLE makes the system process a handle owner). Therefore, by setting ShareMode to non-zero value, you tell the system that you are ready to share it with UM components. Therefore, there is a good chance that non-zero ShareMode and OBJ_KENEL_HANDLE get into a conflict with one another…
Anton Bassov
Hi Anton!
Therefore, by setting ShareMode to non-zero value,
you tell the system that you are ready to share it with UM components.
Therefore, there is a good chance that non-zero ShareMode and OBJ_KENEL_HANDLE get into a conflict with one another…
One is allowed to give such a combination. They don’t end up in STATUS_INVALID_PARAMETER.
As far as I know, the inter parameter dependency comes when one gives FILE_SYNCHRONOUS_IO_XXX or FILE_DIRECTORY_FILE or FILE_DELETE_ON_CLOSE in the CreateOptions.
Regards,
Ayush Gupta
> One is allowed to give such a combination. They don???t end up in STATUS_INVALID_PARAMETER.
My suggestion is based upon the idea that this may constitute a security violation. Just to give you an idea, UM code cannot open a handle to a named event that gets created by a driver. This is why you have to resort to opening a handle in the user mode and passing it to a driver so that it can get its KEVENT with ObReferenceObjectByHandle() whenever you want to share an event between KM and UM code. I think that the same logic may, probably, apply to sharing files…
Anton Bassov
> Not sure the OP is up to understanding the namespace conventions.
Yes, but why STATUS_INVALID_PARAMETER??? If the system was unable to resolve the path it would have retruned STATUS_FILE_NOT_FOUND…
Anton Bassov
Thank you!
I tried L"\DosDevices\c:\windows\System32\pro.dat" and ZwCreateFile
return STATUS_INVALID_PARAMETER.
I use VMware and windbg to debug. I don’t know how to attach a debug to find
out which parameter is the problem.
From: “Ayush Gupta”
Sent: Tuesday, June 10, 2008 2:47 PM
To: “Windows File Systems Devs Interest List”
Subject: RE: [ntfsd] Why ZwCreateFile ALWAYS return
STATUS_INVALID_PARAMETER?
> Hi!
>
> Actually, this (FileAttributes) won’t be used anyways because you are just
> opening the file.
> You could also try substituting ?? with \DosDevices in your file path.
> I would suggest that you attach a debugger to find out the exact parameter
> for which the check has failed.
>
> Regards,
> Ayush Gupta
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of cxun
> Sent: Tuesday, June 10, 2008 11:35 AM
> To: Windows File Systems Devs Interest List
> Subject: Re: [ntfsd] Why ZwCreateFile ALWAYS return
> STATUS_INVALID_PARAMETER?
>
> Thank you for replying.
> I tried it, using FILE_ATTRIBUTE_NORMAL, but it the same result.
>
> cxun
>
> --------------------------------------------------
> From: “Ayush Gupta”
> Sent: Tuesday, June 10, 2008 1:56 PM
> To: “Windows File Systems Devs Interest List”
> Subject: RE: [ntfsd] Why ZwCreateFile ALWAYS return
> STATUS_INVALID_PARAMETER?
>
>> Hi!
>>
>> You have passed 0 in the FileAttributes parameter. This is incorrect. You
>> should be using FILE_ATTRIBUTE_NORMAL, etc. Since none of them has a
>> value
>> 0, this might be causing the problem.
>>
>> Regards,
>> Ayush Gupta
>>
>> -----Original Message-----
>> From: xxxxx@lists.osr.com
>> [mailto:xxxxx@lists.osr.com] On Behalf Of cxun
>> Sent: Tuesday, June 10, 2008 9:09 AM
>> To: Windows File Systems Devs Interest List
>> Subject: [ntfsd] Why ZwCreateFile ALWAYS return STATUS_INVALID_PARAMETER?
>>
>> Why ZwCreateFile ALWAYS return STATUS_INVALID_PARAMETER?
>>
>> I just added sth on the sample of DDK, sfilter. Now I faced the problem:
>> When I used ZwCreateFile, the function always return 0xC000000D, which is
>> STATUS_INVALID_PARAMETER. No matter where I put the source, at the
>> beginning
>>
>> of the DriverEntry, or in other .c file, it’s the same result.
>>
>> The source is below:
>>
>> HANDLE hFileHandle;
>> NTSTATUS ntStatus;
>> UNICODE_STRING uszFileName;
>> OBJECT_ATTRIBUTES objAttributes;
>> IO_STATUS_BLOCK isbCreateReadStatus;
>>
>> if(KeGetCurrentIrql() >= DISPATCH_LEVEL)
>> return STATUS_UNSUCCESSFUL;
>> RtlInitUnicodeString(&uszFileName,
>> pFilePath);
>> InitializeObjectAttributes(&objAttributes,
>> &uszFileName,
>> OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,
>> NULL,
>> NULL);
>> ntStatus = ZwCreateFile(&hFileHandle,
>> SYNCHRONIZE|FILE_READ_DATA,
>> &objAttributes,
>> &isbCreateReadStatus,
>> NULL,
>> 0,
>> FILE_SHARE_READ|FILE_SHARE_WRITE,
>> FILE_OPEN,
>>
>> FILE_SYNCHRONOUS_IO_NONALERT|FILE_NON_DIRECTORY_FILE,
>> NULL,
>> 0); // always return STATUS_INVALID_PARAMETER
>> if(!NT_SUCCESS(ntStatus))
>> {
>> KdPrint((“KmdReadWholeFile: Failed to open %ws. Error Code:
>> 0x%xL\n”, pFilePath, ntStatus));
>> return ntStatus;
>> }
>>
>> pFilePath is: L"\??\c:\windows\system32\pro.dat"
>>
>> Please help me… Thank you…
>>
>>
>>
>>
>>
>>
>> —
>> NTFSD is sponsored by OSR
>>
>> For our schedule debugging and file system seminars
>> (including our new fs mini-filter seminar) visit:
>> http://www.osr.com/seminars
>>
>> You are currently subscribed to ntfsd as: xxxxx@yahoo.co.in
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>> —
>> NTFSD is sponsored by OSR
>>
>> For our schedule debugging and file system seminars
>> (including our new fs mini-filter seminar) visit:
>> http://www.osr.com/seminars
>>
>> You are currently subscribed to ntfsd as: xxxxx@live.com
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@yahoo.co.in
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@live.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
Thank you~
I tried L"\\SystemRoot\System32\pro.dat" but it returned:
STATUS_OBJECT_NAME_INVALID
And when I used L"\SystemRoot\System32\pro.dat" it returned:
STATUS_OBJECT_PATH_NOT_FOUND
I called ZwCreateFile at the beginning of DriverEntry in sfilter sample.
cxun
From: “Ayush Gupta”
Sent: Tuesday, June 10, 2008 2:59 PM
To: “Windows File Systems Devs Interest List”
Subject: RE: [ntfsd] Why ZwCreateFile ALWAYS return
STATUS_INVALID_PARAMETER?
> Hi!
>
> BTW, when exactly are you calling ZwCreateFile? If it is being called very
> early in boot phase, then you need to give the path name as
> \SystemRoot\System32\pro.dat.
> I think this should work.
>
> Regards,
> Ayush Gupta
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@live.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
“cxun” wrote in message news:xxxxx@ntfsd…
> pFilePath is: L"\??\c:\windows\system32\pro.dat"
>
> Please help me… Thank you…
>
That’s one slash too little, make that
L"\\??\c:\windows\system32\pro.dat"
>>BTW, when exactly are you calling ZwCreateFile? If it is being called very
>>early in boot phase, then you need to give the path name as
>>\SystemRoot\System32\pro.dat.
That’s one slash too many at the beginning.
//Daniel
“cxun” wrote in message news:xxxxx@ntfsd…
> Why ZwCreateFile ALWAYS return STATUS_INVALID_PARAMETER?
>
> I just added sth on the sample of DDK, sfilter. Now I faced the problem:
> When I used ZwCreateFile, the function always return 0xC000000D, which is
> STATUS_INVALID_PARAMETER. No matter where I put the source, at the
> beginning of the DriverEntry, or in other .c file, it’s the same result.
>
> The source is below:
>
> HANDLE hFileHandle;
> NTSTATUS ntStatus;
> UNICODE_STRING uszFileName;
> OBJECT_ATTRIBUTES objAttributes;
> IO_STATUS_BLOCK isbCreateReadStatus;
>
> if(KeGetCurrentIrql() >= DISPATCH_LEVEL)
> return STATUS_UNSUCCESSFUL;
> RtlInitUnicodeString(&uszFileName,
> pFilePath);
> InitializeObjectAttributes(&objAttributes,
> &uszFileName,
> OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,
> NULL,
> NULL);
> ntStatus = ZwCreateFile(&hFileHandle,
> SYNCHRONIZE|FILE_READ_DATA,
> &objAttributes,
> &isbCreateReadStatus,
> NULL,
> 0,
> FILE_SHARE_READ|FILE_SHARE_WRITE,
> FILE_OPEN,
>
> FILE_SYNCHRONOUS_IO_NONALERT|FILE_NON_DIRECTORY_FILE,
> NULL,
> 0); // always return STATUS_INVALID_PARAMETER
> if(!NT_SUCCESS(ntStatus))
> {
> KdPrint((“KmdReadWholeFile: Failed to open %ws. Error Code:
> 0x%xL\n”, pFilePath, ntStatus));
> return ntStatus;
> }
>
>
>
>
>
>
Hi Anton
Thank you very much.
I have set ShareAccess to 0 instead of FILE_SHARE_READ|FILE_SHARE_WRITE, but
it’s the same result.
It’s so strange that the same source used in other’s kernel works well. And
I also have the same file pro.dat in c:\windows\system32, problems appear
again and again. Now I’ll try the user mode first.
Thanks again~
From:
Sent: Tuesday, June 10, 2008 3:17 PM
To: “Windows File Systems Devs Interest List”
Subject: RE:[ntfsd] Why ZwCreateFile ALWAYS return STATUS_INVALID_PARAMETER?
> BTW, why do you set ShareMode to non-zero value??? Normally drivers set it
> to zero, because kernel-mode components are supposed to request an
> exclusive access to the file - once they have specified OBJ_KENEL_HANDLE,
> all kernel-mode components will be able to use the handle anyway,
> regardless of process context (because OBJ_KENEL_HANDLE makes the system
> process a handle owner). Therefore, by setting ShareMode to non-zero
> value, you tell the system that you are ready to share it with UM
> components. Therefore, there is a good chance that non-zero ShareMode and
> OBJ_KENEL_HANDLE get into a conflict with one another…
>
> Anton Bassov
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@live.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>I tried L"\\SystemRoot\System32\pro.dat" but it returned:
STATUS_OBJECT_NAME_INVALID
Why would you use this?
And when I used L"\SystemRoot\System32\pro.dat" it returned:
STATUS_OBJECT_PATH_NOT_FOUND
Is the file ACTUALLY present there?
Regards,
Ayush Gupta
Yes, the file “pro.dat” is in here: c:\windows\system32\
And I call ZwCreateFile at the beginning of DriverEntry function.
Thank you for the patience. I really appreciate it.
cxun
From: “Ayush Gupta”
Sent: Tuesday, June 10, 2008 4:29 PM
To: “Windows File Systems Devs Interest List”
Subject: RE: [ntfsd] Why ZwCreateFile ALWAYS return
STATUS_INVALID_PARAMETER?
>>I tried L"\\SystemRoot\System32\pro.dat" but it returned:
>>STATUS_OBJECT_NAME_INVALID
>
> Why would you use this?
>
>>And when I used L"\SystemRoot\System32\pro.dat" it returned:
>>STATUS_OBJECT_PATH_NOT_FOUND
>
> Is the file ACTUALLY present there?
>
> Regards,
> Ayush Gupta
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@live.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>>>And when I used L"\SystemRoot\System32\pro.dat" it returned:
>>STATUS_OBJECT_PATH_NOT_FOUND
L"\SystemRoot\System32\pro.dat" translates into
“C:\Windows\System32\System32\pro.dat”, right ?
L.
Is the file system up when you are making this call?
Since you are making this call from DriverEntry, there is a good chance that
the volume has actually not been mounted by any FSD.
And if there is no FSD to service your request, you will get this error.
Regards,
Ayush Gupta
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of cxun
Sent: Tuesday, June 10, 2008 2:19 PM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] Why ZwCreateFile ALWAYS return
STATUS_INVALID_PARAMETER?
Yes, the file “pro.dat” is in here: c:\windows\system32\
And I call ZwCreateFile at the beginning of DriverEntry function.
Thank you for the patience. I really appreciate it.
cxun
From: “Ayush Gupta”
Sent: Tuesday, June 10, 2008 4:29 PM
To: “Windows File Systems Devs Interest List”
Subject: RE: [ntfsd] Why ZwCreateFile ALWAYS return
STATUS_INVALID_PARAMETER?
>>I tried L"\\SystemRoot\System32\pro.dat" but it returned:
>>STATUS_OBJECT_NAME_INVALID
>
> Why would you use this?
>
>>And when I used L"\SystemRoot\System32\pro.dat" it returned:
>>STATUS_OBJECT_PATH_NOT_FOUND
>
> Is the file ACTUALLY present there?
>
> Regards,
> Ayush Gupta
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@live.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
—
NTFSD is sponsored by OSR
For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars
You are currently subscribed to ntfsd as: xxxxx@yahoo.co.in
To unsubscribe send a blank email to xxxxx@lists.osr.com
Hi Daniel
When I used L"\\??\c:\Windows\System32\pro.dat" ZwCreate returned
STATUS_OBJECT_NAME_INVALID
Thank you!
cxun
From:
Sent: Tuesday, June 10, 2008 4:16 PM
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Subject: Re:[ntfsd] Why ZwCreateFile ALWAYS return STATUS_INVALID_PARAMETER?
> “cxun” wrote in message news:xxxxx@ntfsd…
>> pFilePath is: L"\??\c:\windows\system32\pro.dat"
>>
>> Please help me… Thank you…
>>
>
> That’s one slash too little, make that
> L"\\??\c:\windows\system32\pro.dat"
>
>
>>>BTW, when exactly are you calling ZwCreateFile? If it is being called
>>>very
>>>early in boot phase, then you need to give the path name as
>>>\SystemRoot\System32\pro.dat.
>
> That’s one slash too many at the beginning.
>
> //Daniel
>
>
>
>
>
> “cxun” wrote in message news:xxxxx@ntfsd…
>> Why ZwCreateFile ALWAYS return STATUS_INVALID_PARAMETER?
>>
>> I just added sth on the sample of DDK, sfilter. Now I faced the problem:
>> When I used ZwCreateFile, the function always return 0xC000000D, which is
>> STATUS_INVALID_PARAMETER. No matter where I put the source, at the
>> beginning of the DriverEntry, or in other .c file, it’s the same result.
>>
>> The source is below:
>>
>> HANDLE hFileHandle;
>> NTSTATUS ntStatus;
>> UNICODE_STRING uszFileName;
>> OBJECT_ATTRIBUTES objAttributes;
>> IO_STATUS_BLOCK isbCreateReadStatus;
>>
>> if(KeGetCurrentIrql() >= DISPATCH_LEVEL)
>> return STATUS_UNSUCCESSFUL;
>> RtlInitUnicodeString(&uszFileName,
>> pFilePath);
>> InitializeObjectAttributes(&objAttributes,
>> &uszFileName,
>> OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,
>> NULL,
>> NULL);
>> ntStatus = ZwCreateFile(&hFileHandle,
>> SYNCHRONIZE|FILE_READ_DATA,
>> &objAttributes,
>> &isbCreateReadStatus,
>> NULL,
>> 0,
>> FILE_SHARE_READ|FILE_SHARE_WRITE,
>> FILE_OPEN,
>>
>> FILE_SYNCHRONOUS_IO_NONALERT|FILE_NON_DIRECTORY_FILE,
>> NULL,
>> 0); // always return STATUS_INVALID_PARAMETER
>> if(!NT_SUCCESS(ntStatus))
>> {
>> KdPrint((“KmdReadWholeFile: Failed to open %ws. Error Code:
>> 0x%xL\n”, pFilePath, ntStatus));
>> return ntStatus;
>> }
>>
>
>>
>>
>>
>>
>>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@live.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
But when I used “\SystemRoot\pro.dat”, which translates into
“c:\windows\system32\pro.dat”, it returned STATUS_OBJECT_PATH_NOT_FOUND
Thank you~
cxun
From: “Ladislav Zezula”
Sent: Tuesday, June 10, 2008 4:52 PM
To: “Windows File Systems Devs Interest List”
Subject: Re[2]: [ntfsd] Why ZwCreateFile ALWAYS return
STATUS_INVALID_PARAMETER?
>>>>And when I used L"\SystemRoot\System32\pro.dat" it returned:
>>>>STATUS_OBJECT_PATH_NOT_FOUND
>
> L"\SystemRoot\System32\pro.dat" translates into
> “C:\Windows\System32\System32\pro.dat”, right ?
>
> L.
>
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
Right, I suggest stop using these symbolic links but specifying the target
device name instead ("\Device\Harddiskvolume…
//Daniel
“cxun” wrote in message news:xxxxx@ntfsd…
> Hi Daniel
> When I used L"\\??\c:\Windows\System32\pro.dat" ZwCreate returned
> STATUS_OBJECT_NAME_INVALID
>
> Thank you!
>
> cxun
>
> --------------------------------------------------
> From:
> Sent: Tuesday, June 10, 2008 4:16 PM
> Newsgroups: ntfsd
> To: “Windows File Systems Devs Interest List”
> Subject: Re:[ntfsd] Why ZwCreateFile ALWAYS return
> STATUS_INVALID_PARAMETER?
>
>> “cxun” wrote in message news:xxxxx@ntfsd…
>>> pFilePath is: L"\??\c:\windows\system32\pro.dat"
>>>
>>> Please help me… Thank you…
>>>
>>
>> That’s one slash too little, make that
>> L"\\??\c:\windows\system32\pro.dat"
>>
>>
>>>>BTW, when exactly are you calling ZwCreateFile? If it is being called
>>>>very
>>>>early in boot phase, then you need to give the path name as
>>>>\SystemRoot\System32\pro.dat.
>>
>> That’s one slash too many at the beginning.
>>
>> //Daniel
>>
>>
>>
>>
>>
>> “cxun” wrote in message news:xxxxx@ntfsd…
>>> Why ZwCreateFile ALWAYS return STATUS_INVALID_PARAMETER?
>>>
>>> I just added sth on the sample of DDK, sfilter. Now I faced the problem:
>>> When I used ZwCreateFile, the function always return 0xC000000D, which
>>> is STATUS_INVALID_PARAMETER. No matter where I put the source, at the
>>> beginning of the DriverEntry, or in other .c file, it’s the same result.
>>>
>>> The source is below:
>>>
>>> HANDLE hFileHandle;
>>> NTSTATUS ntStatus;
>>> UNICODE_STRING uszFileName;
>>> OBJECT_ATTRIBUTES objAttributes;
>>> IO_STATUS_BLOCK isbCreateReadStatus;
>>>
>>> if(KeGetCurrentIrql() >= DISPATCH_LEVEL)
>>> return STATUS_UNSUCCESSFUL;
>>> RtlInitUnicodeString(&uszFileName,
>>> pFilePath);
>>> InitializeObjectAttributes(&objAttributes,
>>> &uszFileName,
>>> OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,
>>> NULL,
>>> NULL);
>>> ntStatus = ZwCreateFile(&hFileHandle,
>>> SYNCHRONIZE|FILE_READ_DATA,
>>> &objAttributes,
>>> &isbCreateReadStatus,
>>> NULL,
>>> 0,
>>> FILE_SHARE_READ|FILE_SHARE_WRITE,
>>> FILE_OPEN,
>>>
>>> FILE_SYNCHRONOUS_IO_NONALERT|FILE_NON_DIRECTORY_FILE,
>>> NULL,
>>> 0); // always return
>>> STATUS_INVALID_PARAMETER
>>> if(!NT_SUCCESS(ntStatus))
>>> {
>>> KdPrint((“KmdReadWholeFile: Failed to open %ws. Error Code:
>>> 0x%xL\n”, pFilePath, ntStatus));
>>> return ntStatus;
>>> }
>>>
>>
>>>
>>>
>>>
>>>
>>>
>>
>> —
>> NTFSD is sponsored by OSR
>>
>> For our schedule debugging and file system seminars
>> (including our new fs mini-filter seminar) visit:
>> http://www.osr.com/seminars
>>
>> You are currently subscribed to ntfsd as: xxxxx@live.com
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>
Hi Ladislav!
Nopes…
Systemroot is a symbolic link to \Device\HarddiskX\PartitionY\Windows.
So \SystemRoot\System32\pro.dat translates to C:\Windows\System32\pro.dat.
Regards,
Ayush Gupta
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ladislav Zezula
Sent: Tuesday, June 10, 2008 2:23 PM
To: Windows File Systems Devs Interest List
Subject: Re[2]: [ntfsd] Why ZwCreateFile ALWAYS return
STATUS_INVALID_PARAMETER?
>>And when I used L"\SystemRoot\System32\pro.dat" it returned:
>>STATUS_OBJECT_PATH_NOT_FOUND
L"\SystemRoot\System32\pro.dat" translates into
“C:\Windows\System32\System32\pro.dat”, right ?
L.
NTFSD is sponsored by OSR
For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars
You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
Hi Daniel
This time I used L"\DEVICE\HARDDISKVOLUME0\windows\system32\pro.dat",
it returned STATUS_OBJECT_PATH_NOT_FOUND, which means “The path %hs does not
exist.” If I tried HARDDISKVOLUME1, it’s the same result…
Thank you so much~
From:
Sent: Tuesday, June 10, 2008 5:05 PM
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Subject: Re:[ntfsd] Re:Why ZwCreateFile ALWAYS return
STATUS_INVALID_PARAMETER?
> Right, I suggest stop using these symbolic links but specifying the target
> device name instead (“\Device\Harddiskvolume…
>
> //Daniel
>
>
> “cxun” wrote in message news:xxxxx@ntfsd…
>> Hi Daniel
>> When I used L”\\??\c:\Windows\System32\pro.dat" ZwCreate returned
>> STATUS_OBJECT_NAME_INVALID
>>
>> Thank you!
>>
>> cxun
>>
>> --------------------------------------------------
>> From:
>> Sent: Tuesday, June 10, 2008 4:16 PM
>> Newsgroups: ntfsd
>> To: “Windows File Systems Devs Interest List”
>> Subject: Re:[ntfsd] Why ZwCreateFile ALWAYS return
>> STATUS_INVALID_PARAMETER?
>>
>>> “cxun” wrote in message news:xxxxx@ntfsd…
>>>> pFilePath is: L"\??\c:\windows\system32\pro.dat"
>>>>
>>>> Please help me… Thank you…
>>>>
>>>
>>> That’s one slash too little, make that
>>> L"\\??\c:\windows\system32\pro.dat"
>>>
>>>
>>>>>BTW, when exactly are you calling ZwCreateFile? If it is being called
>>>>>very
>>>>>early in boot phase, then you need to give the path name as
>>>>>\SystemRoot\System32\pro.dat.
>>>
>>> That’s one slash too many at the beginning.
>>>
>>> //Daniel
>>>
>>>
>>>
>>>
>>>
>>> “cxun” wrote in message news:xxxxx@ntfsd…
>>>> Why ZwCreateFile ALWAYS return STATUS_INVALID_PARAMETER?
>>>>
>>>> I just added sth on the sample of DDK, sfilter. Now I faced the
>>>> problem: When I used ZwCreateFile, the function always return
>>>> 0xC000000D, which is STATUS_INVALID_PARAMETER. No matter where I put
>>>> the source, at the beginning of the DriverEntry, or in other .c file,
>>>> it’s the same result.
>>>>
>>>> The source is below:
>>>>
>>>> HANDLE hFileHandle;
>>>> NTSTATUS ntStatus;
>>>> UNICODE_STRING uszFileName;
>>>> OBJECT_ATTRIBUTES objAttributes;
>>>> IO_STATUS_BLOCK isbCreateReadStatus;
>>>>
>>>> if(KeGetCurrentIrql() >= DISPATCH_LEVEL)
>>>> return STATUS_UNSUCCESSFUL;
>>>> RtlInitUnicodeString(&uszFileName,
>>>> pFilePath);
>>>> InitializeObjectAttributes(&objAttributes,
>>>> &uszFileName,
>>>> OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,
>>>> NULL,
>>>> NULL);
>>>> ntStatus = ZwCreateFile(&hFileHandle,
>>>> SYNCHRONIZE|FILE_READ_DATA,
>>>> &objAttributes,
>>>> &isbCreateReadStatus,
>>>> NULL,
>>>> 0,
>>>> FILE_SHARE_READ|FILE_SHARE_WRITE,
>>>> FILE_OPEN,
>>>>
>>>> FILE_SYNCHRONOUS_IO_NONALERT|FILE_NON_DIRECTORY_FILE,
>>>> NULL,
>>>> 0); // always return
>>>> STATUS_INVALID_PARAMETER
>>>> if(!NT_SUCCESS(ntStatus))
>>>> {
>>>> KdPrint((“KmdReadWholeFile: Failed to open %ws. Error Code:
>>>> 0x%xL\n”, pFilePath, ntStatus));
>>>> return ntStatus;
>>>> }
>>>>
>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>
>>> —
>>> NTFSD is sponsored by OSR
>>>
>>> For our schedule debugging and file system seminars
>>> (including our new fs mini-filter seminar) visit:
>>> http://www.osr.com/seminars
>>>
>>> You are currently subscribed to ntfsd as: xxxxx@live.com
>>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>>
>>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@live.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
Hi!
I would suggest that you change the start type of the driver to 1 (system)
or 2 (automatic) and then check if the problem persists.
If I am right, the boot time drivers cannot access files from their
DriverEntry routine.
Regards,
Ayush Gupta