Hi,
This is a query regarding the function ZwQueryVolumeInformationFile.
The FileSystem Filter driver calls the function ZwQueryVolumeInformationFile to get the volume statistics for C:. The FS_INFORMATION_CLASS is FileFsSizeInformation.
A variable of type FILE_FS_SIZE_INFORMATION is allocated locally in the function. The handle passed to the function is the handle to the drive c:.
The driver runs on a Windows 2003 SP1 system. The file system installed is NTFS.
The problem:
The function returns a value of 0 in either FsInformation.SectorsPerAllocationUnit or
FsInformation.BytesPerSector. We need the bytes per unit value and so we multiply the
above mentioned two fields. The bytes per unit is used as a divisor in a division instruction later in the driver. Because bytes per unit comes out to be 0, the system crashes with 0x7f (1st argument is EXCEPTION_DIVIDED_BY_ZERO).
MSDN says “ZwQueryVolumeInformationFile returns zero in any member of a FILE_XXX_INFORMATION structure that is not supported by the file system.”.
I am not sure why ZwQueryVolumeInformationFile returns a zero value for either
FsInformation.SectorsPerAllocationUnit or FsInformation.BytesPerSector. Could you please help me find the answer?
Thanks and kind regards,
Amol