Hello everybody. In the upper filter driver of the disk device, after sending the IOCTL_STORAGE_GET_DEVICE_NUMBER request, I get the device type 07, the device number 1 and the partition number 0. Next, I want to read the MBR using the ZwOpenFile function, but I always get the status 0xc0000034(The object name is not found.). As an object name parameter I tried to pass: \Device\Harddisk1\Partition0, \??\ , \??\PhysicalDrive1 , \Device\harddisk1\DR1, \??\F: (The letter of my device).
Is it possible that the sector can not be read by the disk device driver? Or it is necessary to do it with the help of the driver of the partition?
Try to check with winobj if these paths you trying to open actually present in the object manager namespace.
On 15 Aug 2018, at 19:08, xxxxx@gmail.com wrote:
>
> Hello everybody. In the upper filter driver of the disk device, after sending the IOCTL_STORAGE_GET_DEVICE_NUMBER request, I get the device type 07, the device number 1 and the partition number 0. Next, I want to read the MBR using the ZwOpenFile function, but I always get the status 0xc0000034(The object name is not found.). As an object name parameter I tried to pass: \Device\Harddisk1\Partition0, \??\ , \??\PhysicalDrive1 , \Device\harddisk1\DR1, \??\F: (The letter of my device).
>
> Is it possible that the sector can not be read by the disk device driver? Or it is necessary to do it with the help of the driver of the partition?
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at: http:
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at http:</http:></http:></http:>
Also you can do it with windbg’s !object command
On 15 Aug 2018, at 19:47, Sergey Pisarev wrote:
>
> Try to check with winobj if these paths you trying to open actually present in the object manager namespace.
>
>> On 15 Aug 2018, at 19:08, xxxxx@gmail.com wrote:
>>
>> Hello everybody. In the upper filter driver of the disk device, after sending the IOCTL_STORAGE_GET_DEVICE_NUMBER request, I get the device type 07, the device number 1 and the partition number 0. Next, I want to read the MBR using the ZwOpenFile function, but I always get the status 0xc0000034(The object name is not found.). As an object name parameter I tried to pass: \Device\Harddisk1\Partition0, \??\ , \??\PhysicalDrive1 , \Device\harddisk1\DR1, \??\F: (The letter of my device).
>>
>> Is it possible that the sector can not be read by the disk device driver? Or it is necessary to do it with the help of the driver of the partition?
>>
>> —
>> NTDEV is sponsored by OSR
>>
>> Visit the list online at: http:
>>
>> MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
>> Details at http:
>>
>> To unsubscribe, visit the List Server section of OSR Online at http:
></http:></http:></http:>
xxxxx@gmail.com wrote:
Hello everybody. In the upper filter driver of the disk device, after sending the IOCTL_STORAGE_GET_DEVICE_NUMBER request, I get the device type 07, the device number 1 and the partition number 0. Next, I want to read the MBR using the ZwOpenFile function, but I always get the status 0xc0000034(The object name is not found.). As an object name parameter I tried to pass: \Device\Harddisk1\Partition0, \??\ , \??\PhysicalDrive1 , \Device\harddisk1\DR1, \??\F: (The letter of my device).
Is it possible that the sector can not be read by the disk device driver? Or it is necessary to do it with the help of the driver of the partition?
Again, we’re not sure where you are in the disk stack. If you’re really
filtering a disk device, then you are below the level of the partition.Â
You can open \device\harddisk1, but the disk doesn’t know anything about
partitions. That’s a concept that happens above you.
And, if you are a disk filter, then you probably ARE \device\harddisk1.
–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.