Read Boot Sector with ZwXXX

NTDEV
1

How do we directly read (boot) sector with the
ZwCreateFile/ZwReadFile.
Im able to create the file handle with the name string
as L"\Device\Harddisk0\Partition0", but im not
able to read it.
Both the routines are called from the first call of my
read dispatch routine of my upper disk partition
filter driver.

V.S.

Do you Yahoo!?
Yahoo! Mail - 50x more storage than other providers!
http://promotions.yahoo.com/new_mail

2

Use CreateFile/ReadFile ( with admin permission ).

Regards,
Satish K.S

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of vartika Singh
Sent: Tuesday, August 03, 2004 1:17 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Read Boot Sector with ZwXXX

How do we directly read (boot) sector with the
ZwCreateFile/ZwReadFile.
Im able to create the file handle with the name string
as L"\Device\Harddisk0\Partition0", but im not
able to read it.
Both the routines are called from the first call of my
read dispatch routine of my upper disk partition
filter driver.

V.S.

Do you Yahoo!?
Yahoo! Mail - 50x more storage than other providers!
http://promotions.yahoo.com/new_mail

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@liqwidkrystal.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Thanx.

But I want to read the sector from within my
driver.And my driver comes up at the boot time.I read
somewhere back in this list that we can directly read
the physical sectors with ZwReadFile.But im not able
to do it.

V.S.

Do you Yahoo!?
Yahoo! Mail Address AutoComplete - You start. We finish.
http://promotions.yahoo.com/new_mail

4

Hi all!

Following is my source code which im calling only once
from the dispatch read routine.Im getting a success
msg in the ZwCreateFile but not so in the ZwreadFile.
Please,can anybody tell what’ wrong…
…This is an upper disk filter driver attaching to
some specific partition.

ReadDispatch(…)
{

My read sector routine…

if ( ObtainKey == 0 )
{

InterlockedIncrement( & ObtainKey );
if( KeGetCurrentIrql() == PASSIVE_LEVEL )
{

RtlInitUnicodeString(
&fileName,
L"\Device\Harddisk0\Partition0");

InitializeObjectAttributes(

&initializedAttributes,
&fileName ,
OBJ_CASE_INSENSITIVE,
NULL,
NULL );
Status =
ZwCreateFile
(
&fileHandle,
SYNCHRONIZE|GENERIC_READ,
&initializedAttributes,
&IoStatusBlock,
0,
FILE_ATTRIBUTE_NORMAL,
0,
FILE_OPEN,
FILE_SYNCHRONOUS_IO_NONALERT |
FILE_NON_DIRECTORY_FILE,
NULL,
0
);

if( NT_SUCCESS( Status ))
{
DbgPrint( “Zw Create file was successful\n” );
}
else
{
DbgPrint( “Zw Create file was NOT
successful\n” );
}

KeyBufTemp = ExAllocatePoolWithTag(
NonPagedPool,35,‘cnED’);
RtlZeroMemory( KeyBufTemp , 35);

BufLen = 35;

Status =
ZwReadFile
(
fileHandle,
NULL,
NULL,
NULL,
&IoStatusBlock,
KeyBufTemp,
BufLen,
NULL,
NULL
);
if( NT_SUCCESS( Status ))
{
DbgPrint(“ZwRead file was successful\n”);
for( Cnt = 0 ; Cnt < 35 ; Cnt++ )
DbgPrint(" %c",KeyBufTemp[Cnt]);
DbgPrint(“\n”);
}
else
{
DbgPrint(“ZwRead file was NOT successful\n”);
}

ExFreePool( KeyBufTemp );
Status = ZwClose( fileHandle );
}
}

Do you Yahoo!?
Take Yahoo! Mail with you! Get it on your mobile phone.
http://mobile.yahoo.com/maildemo

5

I’m not interested in your code.

You can’t read the disk this way at boot time. You have to wait until things
have progressed far enough for there to be a harddisk0\partitionWhatever.
You might be able to register for device interface arrival notification and
learn when harddisk0 actually gets setup, or you can search this list to see
the recent set of other programmers who have assumed that everything is all
tidy whenever their driver gets loaded during the boot process. On the other
hand, you generally should not be reading the boot sector at all, as its
contents are none of your business.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of vartika Singh
Sent: Tuesday, August 03, 2004 5:41 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Read Boot Sector with ZwXXX

Hi all!

Following is my source code which im calling only once from
the dispatch read routine.Im getting a success msg in the
ZwCreateFile but not so in the ZwreadFile.
Please,can anybody tell what’ wrong…
…This is an upper disk filter driver attaching to some
specific partition.

ReadDispatch(…)
{

My read sector routine…

if ( ObtainKey == 0 )
{

InterlockedIncrement( & ObtainKey );
if( KeGetCurrentIrql() == PASSIVE_LEVEL )
{

RtlInitUnicodeString(
&fileName,
L"\Device\Harddisk0\Partition0");

InitializeObjectAttributes(

&initializedAttributes,
&fileName ,
OBJ_CASE_INSENSITIVE,
NULL,
NULL );
Status =
ZwCreateFile
(
&fileHandle,
SYNCHRONIZE|GENERIC_READ,
&initializedAttributes,
&IoStatusBlock,
0,
FILE_ATTRIBUTE_NORMAL,
0,
FILE_OPEN,
FILE_SYNCHRONOUS_IO_NONALERT |
FILE_NON_DIRECTORY_FILE,
NULL,
0
);

if( NT_SUCCESS( Status ))
{
DbgPrint( “Zw Create file was successful\n” );
}
else
{
DbgPrint( “Zw Create file was NOT successful\n” );
}

KeyBufTemp = ExAllocatePoolWithTag(
NonPagedPool,35,‘cnED’);
RtlZeroMemory( KeyBufTemp , 35);

BufLen = 35;

Status =
ZwReadFile
(
fileHandle,
NULL,
NULL,
NULL,
&IoStatusBlock,
KeyBufTemp,
BufLen,
NULL,
NULL
);
if( NT_SUCCESS( Status ))
{
DbgPrint(“ZwRead file was successful\n”);
for( Cnt = 0 ; Cnt < 35 ; Cnt++ )
DbgPrint(" %c",KeyBufTemp[Cnt]);
DbgPrint(“\n”);
}
else
{
DbgPrint(“ZwRead file was NOT successful\n”);
}

ExFreePool( KeyBufTemp );
Status = ZwClose( fileHandle );
}
}

Do you Yahoo!?
Take Yahoo! Mail with you! Get it on your mobile phone.
http://mobile.yahoo.com/maildemo

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as:
xxxxx@hollistech.com To unsubscribe send a blank email to
xxxxx@lists.osr.com