ZwCreateFile error in filter driver at boot time

NTDEV
1

Hello all

I am writing volume filter driver which starts at boot time
it reads configuration data from a file which is stored at “c:\mydata.dat”
i am calling “ZwCreateFile” in “FilterCreate” but it fails 0xC000003A, which says path not found.
this may because all volumes and file systems are yet to mount / start working.

If i delay call to ZwCreateFile then it works properly
but this delay is variying on different machine with different configurration

i want to make sure if file system and mount manager are initialised or not?
is there any mechanism or way i can check this before i call “ZWCreateFile”?

Thanks

2

Why not move the config data in to the registry underneath your
services key ? Then it will be available at boot time.

Mark

At 09:44 15/07/2008, xxxxx@gmail.com wrote:

Hello all

I am writing volume filter driver which starts at boot time
it reads configuration data from a file which is stored at “c:\mydata.dat”
i am calling “ZwCreateFile” in “FilterCreate” but it fails
0xC000003A, which says path not found.
this may because all volumes and file systems are yet to mount /
start working.

If i delay call to ZwCreateFile then it works properly
but this delay is variying on different machine with different configurration

i want to make sure if file system and mount manager are initialised or not?
is there any mechanism or way i can check this before i call “ZWCreateFile”?

Thanks

3

Thank you for your suggestion.
But due to certain design specifications I can’t store the config data file in registry.

4

The store it in a file under the system directory. You cannot be sure there
is a C: on the system, but you can be sure there is no C: entry available at
boot time.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

wrote in message news:xxxxx@ntdev…
> Thank you for your suggestion.
> But due to certain design specifications I can’t store the config data
> file in registry.
>

5

Thanks for your suggestion.
I’ve tried this. But, it is not working out for me.

6

Show us some code, there are limits to the groups mind reading.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

wrote in message news:xxxxx@ntdev…
> Thanks for your suggestion.
> I’ve tried this. But, it is not working out for me.
>

7

Following is snippet from my code

NTSTATUS file_status;
HANDLE dataFileHandle;
OBJECT_ATTRIBUTES initAttrib;
IO_STATUS_BLOCK fileIoStatusBlock;
UNICODE_STRING uStr;
PWCHAR fileName;
ULONG fileNameSize;
PWCHAR pFullPath;
char * myFileBuffer;
fileName = L"System32\myfile.dat";
fileNameSize = sizeof(L"System32\myfile.dat");
pFullPath = (PWCHAR) ExAllocatePoolWithTag(NonPagedPool, 4096, ‘0PWA’);
myFileBuffer = ExAllocatePoolWithTag(NonPagedPool,1024,‘XgaT’);

if(!myFileBuffer)
{
ExFreePool (pFullPath);
return STATUS_INSUFFICIENT_RESOURCES;
}

RtlCopyMemory(pFullPath, fileName, fileNameSize);
RtlInitUnicodeString(&uStr, pFullPath);
InitializeObjectAttributes(&initAttrib, &uStr, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL,NULL);
file_status = ZwCreateFile( &dataFileHandle,
SYNCHRONIZE|FILE_READ_DATA,
&initAttrib,
&fileIoStatusBlock,
NULL,
0,
0,
FILE_OPEN,
FILE_SYNCHRONOUS_IO_NONALERT|FILE_NON_DIRECTORY_FILE,
NULL,
0);

the file_status value is not STATUS_SUCCESS

8

fileName = L"System32\myfile.dat";
is not a valid object path. Possibly you can use SystemRoot symbolic link
(L\SystemRoot\System32\myfile.dat) but not sure if that’s available at
boot time.

If that doesn’t work out, otherwise better than just using an arbitrary
delay is to check is to retry your ZwCreateFile with a delay in a loop if it
fails or otherwise have a startup application signal an event that you wait
for.

//Daniel

wrote in message news:xxxxx@ntdev…
> Following is snippet from my code
> -------------------------------------------------
> NTSTATUS file_status;
> HANDLE dataFileHandle;
> OBJECT_ATTRIBUTES initAttrib;
> IO_STATUS_BLOCK fileIoStatusBlock;
> UNICODE_STRING uStr;
> PWCHAR fileName;
> ULONG fileNameSize;
> PWCHAR pFullPath;
> char * myFileBuffer;
> fileName = L"System32\myfile.dat";
> fileNameSize = sizeof(L"System32\myfile.dat");
> pFullPath = (PWCHAR) ExAllocatePoolWithTag(NonPagedPool, 4096, ‘0PWA’);
> myFileBuffer = ExAllocatePoolWithTag(NonPagedPool,1024,‘XgaT’);
>
> if(!myFileBuffer)
> {
> ExFreePool (pFullPath);
> return STATUS_INSUFFICIENT_RESOURCES;
> }
>
> RtlCopyMemory(pFullPath, fileName, fileNameSize);
> RtlInitUnicodeString(&uStr, pFullPath);
> InitializeObjectAttributes(&initAttrib, &uStr, OBJ_CASE_INSENSITIVE |
> OBJ_KERNEL_HANDLE, NULL,NULL);
> file_status = ZwCreateFile( &dataFileHandle,
> SYNCHRONIZE|FILE_READ_DATA,
> &initAttrib,
> &fileIoStatusBlock,
> NULL,
> 0,
> 0,
> FILE_OPEN,
> FILE_SYNCHRONOUS_IO_NONALERT|FILE_NON_DIRECTORY_FILE,
> NULL,
> 0);
>
>
> -----------------------------------------------------------
>
> the file_status value is not STATUS_SUCCESS
>
>

9

Your original mail stated

“i am calling “ZwCreateFile” in “FilterCreate” but it fails
0xC000003A, which says path not found.”
What is this “FilterCreate”. Is it DriverEntry or is it add_device of
your device ?

  1. You could keep a small boot time required piece of information in
    registry. Later on you can merge/sync this info with whatever is in the
    file.
  2. you could try to open the file after successful completion of pnp
    start device of the stack below you. You will get pnp start for every
    volume.
  3. As already suggested, registry is propably the right place.

Harish

-----Original Message-----
From: xxxxx@resplendence.com [mailto:xxxxx@resplendence.com]
Sent: Tuesday, July 15, 2008 9:07 AM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] ZwCreateFile error in filter driver at boot time

fileName = L"System32\myfile.dat";
is not a valid object path. Possibly you can use SystemRoot symbolic
link
(L\SystemRoot\System32\myfile.dat) but not sure if that’s available
at boot time.

If that doesn’t work out, otherwise better than just using an arbitrary
delay is to check is to retry your ZwCreateFile with a delay in a loop
if it fails or otherwise have a startup application signal an event that
you wait for.

//Daniel

wrote in message news:xxxxx@ntdev…
> Following is snippet from my code
> -------------------------------------------------
> NTSTATUS file_status;
> HANDLE dataFileHandle;
> OBJECT_ATTRIBUTES initAttrib;
> IO_STATUS_BLOCK fileIoStatusBlock;
> UNICODE_STRING uStr;
> PWCHAR fileName;
> ULONG fileNameSize;
> PWCHAR pFullPath;
> char * myFileBuffer;
> fileName = L"System32\myfile.dat";
> fileNameSize = sizeof(L"System32\myfile.dat"); pFullPath = (PWCHAR)
> ExAllocatePoolWithTag(NonPagedPool, 4096, ‘0PWA’); myFileBuffer =
> ExAllocatePoolWithTag(NonPagedPool,1024,‘XgaT’);
>
> if(!myFileBuffer)
> {
> ExFreePool (pFullPath);
> return STATUS_INSUFFICIENT_RESOURCES;
> }
>
> RtlCopyMemory(pFullPath, fileName, fileNameSize);
> RtlInitUnicodeString(&uStr, pFullPath);
> InitializeObjectAttributes(&initAttrib, &uStr, OBJ_CASE_INSENSITIVE |
> OBJ_KERNEL_HANDLE, NULL,NULL); file_status = ZwCreateFile(
> &dataFileHandle,
> SYNCHRONIZE|FILE_READ_DATA,
> &initAttrib,
> &fileIoStatusBlock,
> NULL,
> 0,
> 0,
> FILE_OPEN,
> FILE_SYNCHRONOUS_IO_NONALERT|FILE_NON_DIRECTORY_FILE,
> NULL,
> 0);
>
>
> -----------------------------------------------------------
>
> the file_status value is not STATUS_SUCCESS
>
>

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

10

A few issues

  1. the path should by be L"\systemroot\system32\myfile.dat"
  2. you are allocating 4K for a small string (which you already have the size in fileNameSize)
  3. you are making a copy of a const string with no purpose, you can just pass the constant string to RtlInitUnicodeString

d
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Tuesday, July 15, 2008 7:34 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] ZwCreateFile error in filter driver at boot time

Following is snippet from my code

NTSTATUS file_status;
HANDLE dataFileHandle;
OBJECT_ATTRIBUTES initAttrib;
IO_STATUS_BLOCK fileIoStatusBlock;
UNICODE_STRING uStr;
PWCHAR fileName;
ULONG fileNameSize;
PWCHAR pFullPath;
char * myFileBuffer;
fileName = L"System32\myfile.dat";
fileNameSize = sizeof(L"System32\myfile.dat");
pFullPath = (PWCHAR) ExAllocatePoolWithTag(NonPagedPool, 4096, ‘0PWA’);
myFileBuffer = ExAllocatePoolWithTag(NonPagedPool,1024,‘XgaT’);

if(!myFileBuffer)
{
ExFreePool (pFullPath);
return STATUS_INSUFFICIENT_RESOURCES;
}

RtlCopyMemory(pFullPath, fileName, fileNameSize);
RtlInitUnicodeString(&uStr, pFullPath);
InitializeObjectAttributes(&initAttrib, &uStr, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL,NULL);
file_status = ZwCreateFile( &dataFileHandle,
SYNCHRONIZE|FILE_READ_DATA,
&initAttrib,
&fileIoStatusBlock,
NULL,
0,
0,
FILE_OPEN,
FILE_SYNCHRONOUS_IO_NONALERT|FILE_NON_DIRECTORY_FILE,
NULL,
0);

the file_status value is not STATUS_SUCCESS

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

11

Thank you all.
I got the solution for this problem.
Instead of calling ZwCreateFile() in FilterCreate(),
I’m calling it in FilterDeviceUsageNotificationCompletionRoutine()
and it is working fine on diffrent machines with diffrent configurations.