ZwOpenFile failing with C0000043

Hello,

I’m attempting to read a file (and determine its size) from my Driver, however Im getting the strange error code of C0000043, which seems to indicate my parameters might be wrong. I’ve tried almost every combination that makes sense to my goals, but ZwOpenFile just fails. I am sure the path to the file is correct ( and in correct form)

a snippet is shown below:

if (FilePath == NULL)
return STATUS_INVALID_PARAMETER;

InitializeObjectAttributes(&obFileAttrib, FilePath, (OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE),
NULL, NULL);

// Open the file for reading
status = ZwOpenFile(hFileHandle, GENERIC_READ | SYNCHRONIZE,
&obFileAttrib, &ioStatus, FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT, 0);
if(!NT_SUCCESS(status))
{
DPRINT(“Could not open file for reading:\n\t Information: %X\nNT Status: %X\n”, ioStatus.Information, status);
bReleaseHandle = TRUE;
goto done;
}

I’ve tried with FILE_GENERIC_READ, and in SharedAccess I’ve tried 0, FILE_SYNCHRONOUS_IO_NONALERT alone. But nothing seems to be working.

The FilePath is a global:
UNICODE_STRING g_FileToMap = RTL_CONSTANT_STRING(L"\??\C:\Users\x\Desktop\SimpleFile.dll");

Passed in like:
status = GetFileSize(&g_FileToMap, &szSizeToMap, &hCapturedFileHandle);

The host and target test systems are both Windows 10.
Any help appreciated.

Small correction to the snippet:

status = ZwOpenFile(hFileHandle, GENERIC_READ | SYNCHRONIZE,
&obFileAttrib, &ioStatus, FILE_SHARE_READ, FILE_NON_DIRECTORY_FILE);

IS what Im using and getting the same error.

//
// MessageId: STATUS_SHARING_VIOLATION
//
// MessageText:
//
// A file cannot be opened because the share access flags are incompatible.
//
#define STATUS_SHARING_VIOLATION ((NTSTATUS)0xC0000043L)

If the file is local, you can call IoCreateFileEx and specify
IO_IGNORE_SHARE_ACCESS_CHECK. Note that this doesn’t do anything for a file
on a network share.

Also, the proper way to specify “share all” is FILE_SHARE_VALID_FLAGS, not 0
(which means “share none”).

-scott
OSR
@OSRDrivers

Thanks, IoCreateFileEx worked for me Scott