ZwOpen() on a network share: Format?

NTDEV
1

Hello,

Our kernel mode driver uses ZwQueryDirectoryFile() to collect information about files on the computer on which our driver has been installed. The format of the path provided to ZwQueryDirectoryFile() is rooted at \DosDevices (i.e. \DosDevices\c:\temp).

I am wondering whether it is feasible for us to permit the use of network shared folders on local and remote machines (same LAN). I’ve tried formatting a path as \DosDevices\device\sharedfolder, but it didn’t work. I’ve tried using a mapped drive, too, but it failed. Could someone please tell me whether it is possible to query shared folders and what is the correct format of full file spec?

Thank you!

Mike

2

xxxxx@a-bit-of-help.com wrote:

Hello,

Our kernel mode driver uses ZwQueryDirectoryFile() to collect information about files on the computer on which our driver has been installed. The format of the path provided to ZwQueryDirectoryFile() is rooted at \DosDevices (i.e. \DosDevices\c:\temp).

I am wondering whether it is feasible for us to permit the use of network shared folders on local and remote machines (same LAN). I’ve tried formatting a path as \DosDevices\device\sharedfolder, but it didn’t work. I’ve tried using a mapped drive, too, but it failed. Could someone please tell me whether it is possible to query shared folders and what is the correct format of full file spec?

The problem may be that your driver is running in a system process as a
system user, and the system user does not have permission to access
those network shares. The only solution to that is to use something
like SeImpersonateClient.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

3

It’s possible… You need to do two things:

Instead of \??<path> you need to use \Device\Mup<path>

Second, you need to be running in a thread that has a user context that has access to the network resource. You could have a service that runs under a user context other than LocalSystem make the call.

4

Thanks Tim & Steve! I figured that \DosDevices\ wouldn’t be correct, but I couldn’t find anything about other object paths that would apply. I will read up on /Mup and look into impersonation. The good news is that with a little tweaking of our code, we can support both kinds of paths.

Thank you again for your help! :slight_smile:
Mike

5

… Hmmmmmmmm… I need to discuss our design with the team, but I think that we may be better off creating an Agent that is installed on remote systems. The agent would consist of a WCF service (easy/secure access via LAN or WAN) and our kernel driver. Anyway, it is good to know that we have options! Thank you again!

6

Here’s some old code. I don’t quite remember, but I think that if I passed in a UNC path it assumes that it’s a network resource - otherwise it’s assumed to be local.

void VCD_ConvertPathToZwPath(char* szPath)
{
char szTempPath[VCD_PATH_LENGTH];

if (!strnicmp(szPath,“\\”,2))
wsprintf(szTempPath,“\Device\Mup%s”,szPath+1);
else
wsprintf(szTempPath,“\??\%s”,szPath);

strcpy(szPath,szTempPath);
}