Re: Are there any know way to Open(Create) a file fro m DriverEntry, c lose in a different c

This should work as advertised, but I think it’s not supported in NT4
(one of the big deficiencies in the DDK is that Microsoft makes no
effort in the docs to describe what is and is not supported by the
various OS’s. Since when did any of us write a commercial driver that we
could get away with restricting to XP or later?).

  • Nicholas Ryan

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Prokash Sinha
Sent: Thursday, October 31, 2002 3:53 PM
To: File Systems Developers
Subject: [ntfsd] Re: Are there any know way to Open(Create) a file fro m
DriverEntry, c lose in a different context

Have you tried this before?. Or anybody (pls !) . This is a simple
change, otherwise a *loaded gun* approach BI suggested would have to be
followed.

-prokash

-----Original Message-----
From: Alexey Logachyov [mailto:xxxxx@vba.com.by]
Sent: Thursday, October 31, 2002 3:25 PM
To: File Systems Developers
Subject: [ntfsd] Re: Are there any know way to Open(Create) a file from
DriverEntry, c lose in a different context

Try secifying OBJ_KERNEL_HANDLE in InitializeObjectAttributes.

----- Original Message -----
From: Prokash mailto:xxxxx Sinha
To: File Systems mailto:xxxxx Developers
Sent: Friday, November 01, 2002 1:03 AM
Subject: [ntfsd] Are there any know way to Open(Create) a file from
DriverEntry, c lose in a different context

0:
INVALID_KERNEL_HANDLE (93)
This message occurs if kernel code (server, redirector, other driver,
etc.)
attempts to close a handle that is not a valid handle.
Arguments:
Arg1: 00000474, The handle that NtClose was called with.
Arg2: 00000000, means a protected handle was closed.
Arg3: 00000000
Arg4: 00000000

1: The file being created/opened at the DriverEntry(), but trying to
close under a different context.

2: When opening —

<<< In system context - Driver Entry
RtlInitUnicodeString( &fileNameUnicodeString, cwFileName );
InitializeObjectAttributes( &objectAttributes,
&fileNameUnicodeString,
OBJ_CASE_INSENSITIVE |
OBJ_INHERIT, NULL, NULL );
ntStatus = ZwCreateFile( &(pLogCtx->hLogFile), GENERIC_WRITE |
SYNCHRONIZE, &objectAttributes, &ioStatusBlock,
NULL, FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ, FILE_SUPERSEDE,
FILE_NON_DIRECTORY_FILE |
FILE_SEQUENTIAL_ONLY | FILE_SYNCHRONOUS_IO_NONALERT,
NULL, 0 );

Q: Is it enough to use OBJ_INHERIT to let the handle be used under
different context ???

Else How could I get this to work ?

Thx in adv.
prokash


You are currently subscribed to ntfsd as: xxxxx@vba.com.by
To unsubscribe send a blank email to %%email.unsub%%

You are currently subscribed to ntfsd as: xxxxx@zonelabs.com
To unsubscribe send a blank email to %%email.unsub%%

You are currently subscribed to ntfsd as: xxxxx@nryan.com
To unsubscribe send a blank email to %%email.unsub%%</mailto:xxxxx></mailto:xxxxx>

MessageYes, OBJ_KERNEL_HANDLE is not honored on NT4, and thus all ZwCloses are process-specific.

You can end with closing the handle win32k’s RawInputThread uses to consume events from keyboard and mouse - a funny bug I had once.

Max

----- Original Message -----
From: Nicholas Ryan
To: File Systems Developers
Sent: Friday, November 01, 2002 3:30 AM
Subject: [ntfsd] Re: Are there any know way to Open(Create) a file fro m DriverEntry, c lose in a different context

This should work as advertised, but I think it’s not supported in NT4 (one of the big deficiencies in the DDK is that Microsoft makes no effort in the docs to describe what is and is not supported by the various OS’s. Since when did any of us write a commercial driver that we could get away with restricting to XP or later?).

  • Nicholas Ryan

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Prokash Sinha
Sent: Thursday, October 31, 2002 3:53 PM
To: File Systems Developers
Subject: [ntfsd] Re: Are there any know way to Open(Create) a file fro m DriverEntry, c lose in a different context

Have you tried this before?. Or anybody (pls !) . This is a simple change, otherwise a *loaded gun* approach BI suggested would have to be followed.

-prokash

-----Original Message-----
From: Alexey Logachyov [mailto:xxxxx@vba.com.by]
Sent: Thursday, October 31, 2002 3:25 PM
To: File Systems Developers
Subject: [ntfsd] Re: Are there any know way to Open(Create) a file from DriverEntry, c lose in a different context

Try secifying OBJ_KERNEL_HANDLE in InitializeObjectAttributes.

----- Original Message -----

From: Prokash Sinha

To: File Systems Developers

Sent: Friday, November 01, 2002 1:03 AM

Subject: [ntfsd] Are there any know way to Open(Create) a file from DriverEntry, c lose in a different context

0:

INVALID_KERNEL_HANDLE (93)

This message occurs if kernel code (server, redirector, other driver, etc.)

attempts to close a handle that is not a valid handle.

Arguments:

Arg1: 00000474, The handle that NtClose was called with.

Arg2: 00000000, means a protected handle was closed.

Arg3: 00000000

Arg4: 00000000

1: The file being created/opened at the DriverEntry(), but trying to close under a different context.

2: When opening —

<<< In system context - Driver Entry

RtlInitUnicodeString( &fileNameUnicodeString, cwFileName );

InitializeObjectAttributes( &objectAttributes, &fileNameUnicodeString,

OBJ_CASE_INSENSITIVE | OBJ_INHERIT, NULL, NULL );

ntStatus = ZwCreateFile( &(pLogCtx->hLogFile), GENERIC_WRITE | SYNCHRONIZE, &objectAttributes, &ioStatusBlock,

NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ, FILE_SUPERSEDE,

FILE_NON_DIRECTORY_FILE | FILE_SEQUENTIAL_ONLY | FILE_SYNCHRONOUS_IO_NONALERT,

NULL, 0 );

Q: Is it enough to use OBJ_INHERIT to let the handle be used under different context ???

Else How could I get this to work ?

Thx in adv.

prokash


You are currently subscribed to ntfsd as: xxxxx@vba.com.by
To unsubscribe send a blank email to %%email.unsub%%


You are currently subscribed to ntfsd as: xxxxx@zonelabs.com
To unsubscribe send a blank email to %%email.unsub%%


You are currently subscribed to ntfsd as: xxxxx@nryan.com
To unsubscribe send a blank email to %%email.unsub%%

You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to %%email.unsub%%