@MBond2 thank, for response
let me summarize.
response for my question: When will be queued a packet to the I/O completion port ?
// status - returned by asynchronous api call
// (i.e. NtXxx(HANDLE FileHandle,HANDLE Event,PIO_APC_ROUTINE ApcRoutine,PVOID ApcContext,IO_STATUS_BLOCK IoStatusBlock,..)
// bSkipOnSuccess = FileObject->Flags & FO_SKIP_COMPLETION_PORT i.e are we set FILE_SKIP_COMPLETION_PORT_ON_SUCCESS on file
bool Will_be_IOCP_Notification(NTSTATUS status, BOOLEAN bSkipOnSuccess = FALSE)
{
return (status == STATUS_PENDING) || (!NT_ERROR(status) && !bSkipOnSuccess);
}
I hope there is no objection ?
but i was confused by not fixed bug in NtLockFile and WRK-v1.2 source code. early (including win 7) was bug in IopXxxControlFile too, now fixed
the minimal POC - worked on windows 10
VOID WINAPI IoCompletionNT(
_In_ NTSTATUS status,
_In_ ULONG_PTR dwNumberOfBytesTransfered,
_Inout_ PVOID ApcContext
)
{
WCHAR sz[64];
swprintf_s(sz, L"(%x %p %p)", status, (void*)dwNumberOfBytesTransfered, ApcContext);
MessageBoxW(0, sz, L"IoCompletionNT", MB_OK);
delete ApcContext;
}
void PocLockFile()
{
static UNICODE_STRING ObjectName = RTL_CONSTANT_STRING(L"\\SystemRoot");
static OBJECT_ATTRIBUTES oa = { sizeof(oa), 0, &ObjectName };
HANDLE hFile;
IO_STATUS_BLOCK iosb;
if (0 <= NtOpenFile(&hFile, FILE_READ_DATA, &oa, &iosb, FILE_SHARE_VALID_FLAGS, FILE_DIRECTORY_FILE))
{
if (0 <= RtlSetIoCompletionCallback(hFile, IoCompletionNT, 0))
{
if (IO_STATUS_BLOCK* piosb = new IO_STATUS_BLOCK)
{
LARGE_INTEGER ByteOffset{}, Length {1};
NTSTATUS status = NtLockFile(hFile, 0, 0, piosb, piosb, &ByteOffset, &Length, 'keyX', TRUE, TRUE);
if (!Will_be_IOCP_Notification(status))
{
WCHAR sz[64];
swprintf_s(sz, L"[%x, 0, %p]", status, piosb);
MessageBoxW(0, sz, L"PocLockFile", MB_OK);
//delete piosb;
}
}
}
NtClose(hFile);
}
}
despite NtLockFile return STATUS_INVALID_PARAMETER here and must not be IOCP notification - it was really
of course call Lock on folder no sense, but show POC. more real case, when we do this on file - https://github.com/rbmm/LockFile-Poc/blob/master/NT_Api_poc.cpp
I mentioned also about ZwNotifyChangeDirectoryFile - which can return STATUS_DATATYPE_MISALIGNMENT (this is not NT_ERROR) but we always must avoid this error, by pass correct aligned buffer