STATUS_SHARING_VIOLATION when open file for the second time

NTDEV
1

Hi,

I’m developing a driver for Windows 8.1, that needs to open and map a file from kernel mode (ie: ntdll.dll or notepad.exe). I’m using the following code:

success = ZwOpenFile(
fileHandle,
GENERIC_READ,
&objAttr,
&ioStatusBlock,
0,
FILE_NON_DIRECTORY_FILE
);

After opening the file as above, I use the handle to create a Section and map it via ZwMapViewOfSection.

At the first run, everything works fine, but after stopping and restarting driver I get the following error code: 0xC0000043 which stands for STATUS_SHARING_VIOLATION, even if I take care to close all handles with ZwClose.

The weird stuff is that also by shutting down the whole system the error persists.

Do you have any idea about why this happens and how to fix?

Thanks for your time,
Julio

2

I don’t think that mmap to the kernel is supported.

You can try using MDL-based read/write calls to the FSD instead.

wrote in message news:xxxxx@ntdev…
> Hi,
>
> I’m developing a driver for Windows 8.1, that needs to open and map a file from kernel mode (ie: ntdll.dll or notepad.exe). I’m using the following code:
>
> success = ZwOpenFile(
> fileHandle,
> GENERIC_READ,
> &objAttr,
> &ioStatusBlock,
> 0,
> FILE_NON_DIRECTORY_FILE
> );
>
> After opening the file as above, I use the handle to create a Section and map it via ZwMapViewOfSection.
>
> At the first run, everything works fine, but after stopping and restarting driver I get the following error code: 0xC0000043 which stands for STATUS_SHARING_VIOLATION, even if I take care to close all handles with ZwClose.
>
> The weird stuff is that also by shutting down the whole system the error persists.
>
> Do you have any idea about why this happens and how to fix?
>
> Thanks for your time,
> Julio
>
>
>

3

I can successfully mmap and parse the file from the kernel driver.
The STATUS_SHARING_VIOLATION only happens after stopping the driver (having closed all the handles) and starting it again.

4

You need to also close the memory mapping handle, not only the file handle. It keeps a reference to the file object.

To allow the file to be open for read by other programs, use FILE_SHARE_READ in the fifth parameter, or FILE_SHARE_READ|FILE_SHARE_WRITE, if you don’t care about it modified.