rebooting to windows special mode... disk operations

NTDEV
1

I’ve seen a program, ParitionMagic actually reboots into a special mode
to do disk operations… I’ve searched too many ours before getting to
know how to schedule my program to start at that time.

I know what Acronis are using a linux kernel to reboot for their disk
operations… just wondering if this is possible.

Daher

2

Take a look at
http://www.sysinternals.com/ntw2k/info/native.shtml

Ciao,
RoMa

“Daher” schrieb im Newsbeitrag news:xxxxx@ntdev…
> I’ve seen a program, ParitionMagic actually reboots into a special mode to do disk operations… I’ve searched too many ours before getting to know how to schedule my program to start at that time.
>
> I know what Acronis are using a linux kernel to reboot for their disk operations… just wondering if this is possible.
>
>
> Daher
>

3

Actually, be very careful about this. The native API’s will do a reboot, of
course there is no orderly shutdown of applications, so your customer will
screaming when you do this (if you are lucky not too many will sue).

The real question is (as always) “What are you trying to do that makes you
think you need a reboot?” Microsoft has been working hard to eliminate
reboots so a design that needs one is questionable.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply

“poltrone” wrote in message news:xxxxx@ntdev…
> Take a look at
> http://www.sysinternals.com/ntw2k/info/native.shtml
>
> Ciao,
> RoMa
>
> “Daher” schrieb im Newsbeitrag
> news:xxxxx@ntdev…
>> I’ve seen a program, ParitionMagic actually reboots into a special mode
>> to do disk operations… I’ve searched too many ours before getting to
>> know how to schedule my program to start at that time.
>>
>> I know what Acronis are using a linux kernel to reboot for their disk
>> operations… just wondering if this is possible.
>>
>>
>> Daher
>>
>
>
>

4

I’ve just read my email, and noted that it doesn’t make sense…

Here is the question, I want to be able to start my application and have
write access to the disk directly… also what libraries will be loaded
at that time… how to find these informaiton.

Thanks for your time

Daher

Daher wrote:

I’ve seen a program, ParitionMagic actually reboots into a special
mode to do disk operations… I’ve searched too many ours before
getting to know how to schedule my program to start at that time.

I know what Acronis are using a linux kernel to reboot for their disk
operations… just wondering if this is possible.

Daher

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@genie-soft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

Hello,
If you are talking to start when the SMSS starts (native applications) then
you will have access to only NTDLL. Since no subsystem is up at the time you
will have to only use the native apis. Also, smss waits for all the native
applications to complete before it proceeds with the boot. So you need to be
fast in your native application.
-Kiran

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Daher
Sent: Thursday, May 05, 2005 8:38 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] rebooting to windows special mode… disk operations

I’ve just read my email, and noted that it doesn’t make sense…

Here is the question, I want to be able to start my application and have
write access to the disk directly… also what libraries will be loaded at
that time… how to find these informaiton.

Thanks for your time

Daher

Daher wrote:

I’ve seen a program, ParitionMagic actually reboots into a special
mode to do disk operations… I’ve searched too many ours before
getting to know how to schedule my program to start at that time.

I know what Acronis are using a linux kernel to reboot for their disk
operations… just wondering if this is possible.

Daher

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@genie-soft.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@calsoftinc.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

6

You can access the disk directly in the system account, take a look at the
CreateFile documentation on how to do this.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply

“Daher” wrote in message news:xxxxx@ntdev…
> I’ve just read my email, and noted that it doesn’t make sense…
>
> Here is the question, I want to be able to start my application and have
> write access to the disk directly… also what libraries will be loaded at
> that time… how to find these informaiton.
>
> Thanks for your time
>
> Daher
>
>
>
> Daher wrote:
>
>> I’ve seen a program, ParitionMagic actually reboots into a special mode
>> to do disk operations… I’ve searched too many ours before getting to
>> know how to schedule my program to start at that time.
>>
>> I know what Acronis are using a linux kernel to reboot for their disk
>> operations… just wondering if this is possible.
>>
>>
>> Daher
>>
>> —
>> Questions? First check the Kernel Driver FAQ at
>> http://www.osronline.com/article.cfm?id=256
>>
>> You are currently subscribed to ntdev as: xxxxx@genie-soft.com
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>

7

Yes but the applications mentioned, like partition magic and acronis
whatever are using standalone boot mechanisms to access partitions while
being sure that no other programs are modifying the contents, so my guess is
that the OP wants some sort of similar functionality. Once again our OPs are
posing questions without stating their actual requirement or objectives,
leaving us guessing about what it is that they really want to do.

So you can read data directly from a disk partition using the SDK and
sufficient privilege, but the problem with this might be (depending on what
you are really trying to do) that your reads are not a coherent snapshot of
the partition. Microsoft has a volume snapshot service which does provide a
mechanism for getting coherent images of disk volumes while the system is up
and running and more or less doing useful work. The VSS SDK is I think still
not fully public, so you have to go find the appropriate authorities to get
access to it. You can read up on VSS functionality, as there are various
public white papers that explain what it does and how it works and see if
VSS might be what you are really looking for.

=====================
Mark Roddy

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Don Burn
Sent: Thursday, May 05, 2005 10:54 AM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] rebooting to windows special mode… disk operations

You can access the disk directly in the system account, take a look at the
CreateFile documentation on how to do this.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply

“Daher” wrote in message news:xxxxx@ntdev…
> I’ve just read my email, and noted that it doesn’t make sense…
>
> Here is the question, I want to be able to start my application and have
> write access to the disk directly… also what libraries will be loaded at

> that time… how to find these informaiton.
>
> Thanks for your time
>
> Daher
>
>
>
> Daher wrote:
>
>> I’ve seen a program, ParitionMagic actually reboots into a special mode
>> to do disk operations… I’ve searched too many ours before getting to
>> know how to schedule my program to start at that time.
>>
>> I know what Acronis are using a linux kernel to reboot for their disk
>> operations… just wondering if this is possible.
>>
>>
>> Daher
>>
>> —
>> Questions? First check the Kernel Driver FAQ at
>> http://www.osronline.com/article.cfm?id=256
>>
>> You are currently subscribed to ntdev as: xxxxx@genie-soft.com
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@stratus.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

8

Thank you, and sorry for not explaining what I’m actually trying to
do… I want to be able to restore backed up files to the system
directory, this needs to actually modify the filesystem manually. I was
thinking if there are any special mode for windows to load the
filesystem driver without locking anything. or give me disk access at
least…

I’ll try and check the VSS SDK and see if what I’m looking for is there.

Daher

Roddy, Mark wrote:

Yes but the applications mentioned, like partition magic and acronis
whatever are using standalone boot mechanisms to access partitions while
being sure that no other programs are modifying the contents, so my guess is
that the OP wants some sort of similar functionality. Once again our OPs are
posing questions without stating their actual requirement or objectives,
leaving us guessing about what it is that they really want to do.

So you can read data directly from a disk partition using the SDK and
sufficient privilege, but the problem with this might be (depending on what
you are really trying to do) that your reads are not a coherent snapshot of
the partition. Microsoft has a volume snapshot service which does provide a
mechanism for getting coherent images of disk volumes while the system is up
and running and more or less doing useful work. The VSS SDK is I think still
not fully public, so you have to go find the appropriate authorities to get
access to it. You can read up on VSS functionality, as there are various
public white papers that explain what it does and how it works and see if
VSS might be what you are really looking for.

=====================
Mark Roddy

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Don Burn
Sent: Thursday, May 05, 2005 10:54 AM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] rebooting to windows special mode… disk operations

You can access the disk directly in the system account, take a look at the
CreateFile documentation on how to do this.

9

Daher wrote:

Thank you, and sorry for not explaining what I’m actually trying to
do… I want to be able to restore backed up files to the system
directory, this needs to actually modify the filesystem manually. I was
thinking if there are any special mode for windows to load the
filesystem driver without locking anything. or give me disk access at
least…

Why doesn’t somebody just answer this dude’s question? It’s not
unreasonable or unusual.

Apps can be run at “blue-screen startup time” using the BootExecute key
in the registry. This is how off-line check-disk works, etc, etc.

For a complete description of the key:

http://www.microsoft.com/resources/documentation/Windows/2000/server/reskit/en-us/regentry/46697.asp

Have fun,

Peter
OSR

10

This is possible from any admin account, not only LocalSystem.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Don Burn”
Newsgroups: ntdev
To: “Windows System Software Devs Interest List”
Sent: Thursday, May 05, 2005 6:53 PM
Subject: Re:[ntdev] rebooting to windows special mode… disk operations

> You can access the disk directly in the system account, take a look at the
> CreateFile documentation on how to do this.
>
>
> –
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> Remove StopSpam from the email to reply
>
>
> “Daher” wrote in message news:xxxxx@ntdev…
> > I’ve just read my email, and noted that it doesn’t make sense…
> >
> > Here is the question, I want to be able to start my application and have
> > write access to the disk directly… also what libraries will be loaded at
> > that time… how to find these informaiton.
> >
> > Thanks for your time
> >
> > Daher
> >
> >
> >
> > Daher wrote:
> >
> >> I’ve seen a program, ParitionMagic actually reboots into a special mode
> >> to do disk operations… I’ve searched too many ours before getting to
> >> know how to schedule my program to start at that time.
> >>
> >> I know what Acronis are using a linux kernel to reboot for their disk
> >> operations… just wondering if this is possible.
> >>
> >>
> >> Daher
> >>
> >> —
> >> Questions? First check the Kernel Driver FAQ at
> >> http://www.osronline.com/article.cfm?id=256
> >>
> >> You are currently subscribed to ntdev as: xxxxx@genie-soft.com
> >> To unsubscribe send a blank email to xxxxx@lists.osr.com
> >>
> >>
> >
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

11

Thanks for your time,

I’ve edited this registry key with the following program:

#include
int main(){ system(“pause”); }

but nothing happened when I next rebooted the system. is there any other
settings that I had to do for it to have worked?

Daher

PeterGV (OSR) wrote:

> Daher wrote:
>
>> Thank you, and sorry for not explaining what I’m actually trying to
>> do… I want to be able to restore backed up files to the system
>> directory, this needs to actually modify the filesystem manually. I
>> was thinking if there are any special mode for windows to load the
>> filesystem driver without locking anything. or give me disk access at
>> least…
>>
>
> Why doesn’t somebody just answer this dude’s question? It’s not
> unreasonable or unusual.
>
> Apps can be run at “blue-screen startup time” using the BootExecute
> key in the registry. This is how off-line check-disk works, etc, etc.
>
> For a complete description of the key:
>
> http://www.microsoft.com/resources/documentation/Windows/2000/server/reskit/en-us/regentry/46697.asp
>
>
> Have fun,
>
> Peter
> OSR
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@genie-soft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

12

If I remember correctly, and I’m sure somebody will correct
me if not, “blue=screen startup time” programs MUST be
nt native applications. (No Win32, no C runtime, stick
to undocumented(1) Nt* and Rtl* functions, set special linker
flag, I can’t remember all the details.

I think there was a pretty good description of writing one
on sysinternals at one point, but again, my memory may
be failing.

Thanks,

Joseph

(1) At least for user mode applications; maybe unsupported
would be a better word.

Daher wrote:

Thanks for your time,

I’ve edited this registry key with the following program:

#include
> int main(){ system(“pause”); }
>
> but nothing happened when I next rebooted the system. is there any other
> settings that I had to do for it to have worked?
>
>
> Daher
>
> PeterGV (OSR) wrote:
>
>> Daher wrote:
>>
>>> Thank you, and sorry for not explaining what I’m actually trying to
>>> do… I want to be able to restore backed up files to the system
>>> directory, this needs to actually modify the filesystem manually. I
>>> was thinking if there are any special mode for windows to load the
>>> filesystem driver without locking anything. or give me disk access at
>>> least…
>>>
>>
>> Why doesn’t somebody just answer this dude’s question? It’s not
>> unreasonable or unusual.
>>
>> Apps can be run at “blue-screen startup time” using the BootExecute
>> key in the registry. This is how off-line check-disk works, etc, etc.
>>
>> For a complete description of the key:
>>
>> http://www.microsoft.com/resources/documentation/Windows/2000/server/reskit/en-us/regentry/46697.asp
>>
>>
>> Have fun,
>>
>> Peter
>> OSR
>>
>> —
>> Questions? First check the Kernel Driver FAQ at
>> http://www.osronline.com/article.cfm?id=256
>>
>> You are currently subscribed to ntdev as: xxxxx@genie-soft.com
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@vandyke.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

13

I thought this was answered long back… Anyways you need to write a native
application. This application does not run under any subsystem. It can only
use NTDLL to do all of its stuff so code like system(“pause”) will never
work. You can only use Native APIs. The details along with sample code can
be found at :
http://www.sysinternals.com/ntw2k/info/native.shtml
Also since these applications don’t run under any subsystem, don’t expect
any window to popup when your application starts.

-Kiran

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Daher
Sent: Wednesday, May 11, 2005 12:24 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] rebooting to windows special mode… disk operations

Thanks for your time,

I’ve edited this registry key with the following program:

#include
int main(){ system(“pause”); }

but nothing happened when I next rebooted the system. is there any other
settings that I had to do for it to have worked?

Daher

PeterGV (OSR) wrote:

> Daher wrote:
>
>> Thank you, and sorry for not explaining what I’m actually trying to
>> do… I want to be able to restore backed up files to the system
>> directory, this needs to actually modify the filesystem manually. I
>> was thinking if there are any special mode for windows to load the
>> filesystem driver without locking anything. or give me disk access at
>> least…
>>
>
> Why doesn’t somebody just answer this dude’s question? It’s not
> unreasonable or unusual.
>
> Apps can be run at “blue-screen startup time” using the BootExecute
> key in the registry. This is how off-line check-disk works, etc, etc.
>
> For a complete description of the key:
>
>
http://www.microsoft.com/resources/documentation/Windows/2000/server/reskit/
en-us/regentry/46697.asp
>
>
> Have fun,
>
> Peter
> OSR
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@genie-soft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@calsoftinc.com
To unsubscribe send a blank email to xxxxx@lists.osr.com