ZwQueryDirectoryFile and AdjustTokenPrivileges

NTFSD
1

Hi All,

Please help me in understanding the below beahviour.

I have a program, which scans for file attributes in a given directory.

I am able to get all the files in that directory along with file attributes.
I am getting attribute value of a file as 4640 when i run without calling AdjustTokenPrivileges().

I am getting attribute value of the same file as 4128 when i run calling AdjustTokenPrivileges() API.

I had to call AdjustTokemPrivileges() API to enable the registry back up facility for my program. ( SE_BACKUP_NAME)

I don’t understand why AdjustTokenPrivileges call is affecting the behaviour of my process.

Please help me on why it behaves like that

P.S: I have tested my program on Windows XP machine.

Thanks in advance
Suresh

2

It looks like the system masks out flag FILE_ATTRIBUTE_SPARSE_FILE for backup applications. It is probably because it cannot be restored by SetFileAttributes(), but by IOCTL call.

Does anybody know the real reason?

-bg

3

No, but I’m curious, as that is what I came up with as well.

mm

xxxxx@xythos.com wrote:

It looks like the system masks out flag FILE_ATTRIBUTE_SPARSE_FILE for backup applications. It is probably because it cannot be restored by SetFileAttributes(), but by IOCTL call.

Does anybody know the real reason?

-bg

4

I ran my applcation on two offline and archived file types. Below is the summary

  1. With AdjustTokenPrivileges() I got two values 4128, 8192 respectively.
  2. Without AdjustTokenPrivileges() I got two values 4640, 12800 respectively on the same files

Further debugging shows that The acutal attribute value of my offline,archived file is getting maksed with 4128.

Hence 4640 & 4128 = 4128
and 12800 & 4128 = 8192

I still don’t understand why the file atrribute values are getting masked off.

P.S: FILE_ATTRIBUTE_OFFLINE | FILE_ATTRIBUTE_ARCHIVED = 4128

Thanks,
Suresh