I am writing a volume filter driver and need to read data from a file in DriverEntry at system boot.
As the file system wont be up during this time, i will use extents to read the file.
I was able to save the extents for file in registry before shutdown, but facing issues reading this file in DriverEntry.
To read data, I will create IRP_MJ_READ using IoBuildSynchronousFsdRequest and will need device object and file object.
I tried to get the device object using IoGetDeviceObjectPointer for my volume (\Device\HarddiskVolumeX) but this keeps failing with STATUS_SHARING_VIOLATION.
I tried using various access rights (FILE_READ_DATA, FILE_GENERIC_READ) but keep getting the same error.
So my question is
Can i fetch device object and file object in Driver Entry?
Or is there an other way to read file in DriverEntry?
IoGetDeviceObjectPointer calls zwopenfile with exclusive access
You can try to call zwopenfile directly with share read|write|delete
On Wednesday, 21 October 2015, wrote:
> Hi, > > I am writing a volume filter driver and need to read data from a file in > DriverEntry at system boot. > As the file system wont be up during this time, i will use extents to read > the file. > I was able to save the extents for file in registry before shutdown, but > facing issues reading this file in DriverEntry. > > I found the following post which suggests this can be done. > http://www.osronline.com/cf.cfm?PageURL=showThread.CFM?link=269070 > > To read data, I will create IRP_MJ_READ using IoBuildSynchronousFsdRequest > and will need device object and file object. > I tried to get the device object using IoGetDeviceObjectPointer for my > volume (\Device\HarddiskVolumeX) but this keeps failing with > STATUS_SHARING_VIOLATION. > I tried using various access rights (FILE_READ_DATA, FILE_GENERIC_READ) > but keep getting the same error. > > So my question is > Can i fetch device object and file object in Driver Entry? > Or is there an other way to read file in DriverEntry? > > — > NTFSD is sponsored by OSR > > OSR is hiring!! Info at http://www.osr.com/careers > > For our schedule of debugging and file system seminars visit: > http://www.osr.com/seminars > > To unsubscribe, visit the List Server section of OSR Online at > http://www.osronline.com/page.cfm?name=ListServer >
Sergey Pisarev,
I tried with ZwOpenFile, this also failed with STATUS_OBJECT_PATH_NOT_FOUND from DriverEntry.
STATUS_SHARING_VIOLATION i mentioned was from a Reinitialization routine i had registered. Forgot to mention this. Here it succeeded with ZwOpenFile, but this callback comes after i get AddDevice. I need to read data before i get AddDevice, to as to decide which device to attach to.
Uptill now all my calls IoGetDeviceObjectPointer, ZwOpenFile, ZwCreateFile, IoCreateFile are failing from DriverEntry with error code STATUS_OBJECT_PATH_NOT_FOUND.
Maxim S. Shatskih
So there is no way to read directly from volume, before file system is up?
I was able to read volume blockwise in EVT_WDF_DEVICE_PREPARE_HARDWARE.
I guess that’s the earliest one can go. Let me know if otherwise.
Thanks for your help…
You should access file this early in the boot sequence.
Instead store the data you need in your driver’s registry key which you will be able to access.