Some links on Windows kernel APIs

All categories

December 2024
M	T	W	T	F	S	S
	1
2	3	4	5	6	7	8
9	10	11	12	13	14	15
16	17	18	19	20	21	22
23	24	25	26	27	28	29
30	31

Some links on Windows kernel APIs

Posted by jpluimers on 2024/12/10

Links from a while ago because some crash caught my eye:

[Wayback/Archive] NtCreateFile function (ntifs.h) – Windows drivers | Microsoft Learn

The NtCreateFile routine creates a new file or opens an existing file.
[Wayback/Archive] NtSetInformationFile function (ntifs.h) – Windows drivers | Microsoft Learn

The NtSetInformationFile routine changes various kinds of information about a file object.
- [Wayback/Archive] _FILE_END_OF_FILE_INFORMATION (ntddk.h) – Windows drivers | Microsoft Learn
  
  The FILE_END_OF_FILE_INFORMATION structure is used as an argument to the ZwSetInformationFile routine.
[Wayback/Archive] NtWriteFile function (ntifs.h) – Windows drivers | Microsoft Learn

The ZwWriteFile routine writes data to an open file.
[Wayback/Archive] NtXxx Routines – Windows drivers | Microsoft Learn

This section describes the NtXxx versions of the Windows Native System Services routines. Most native system services routines have two versions, one of which has a name begins with the prefix Nt; the other version has a name that begins with the prefix Zw. For example, calls to NtCreateFile and ZwCreateFile perform similar operations and are, in fact, serviced by the same kernel-mode system routine.

For calls from kernel-mode drivers, the NtXxx and ZwXxx versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the NtXxx and ZwXxx versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.

…
[Wayback/Archive] NtFsControlFile function (ntifs.h) – Windows drivers | Microsoft Learn

The NtFsControlFile routine sends a control code directly to a specified file system or file system filter driver, causing the corresponding driver to perform the specified action.
[Wayback/Archive] ZwCreateFile function (wdm.h) – Windows drivers | Microsoft Learn

The ZwCreateFile routine creates a new file or opens an existing file.
[Wayback/Archive] Kernel-Mode Driver Reference – Win32 apps | Microsoft Learn
[Wayback/Archive] Kernel-Mode Driver Architecture Design Guide – Windows drivers | Microsoft Learn
[Wayback/Archive] Surface Team Driver Development Best Practices – Windows drivers | Microsoft Learn
[Wayback/Archive] Windows Kernel-Mode Object Manager – Windows drivers | Microsoft Learn
[Wayback/Archive] Managing Kernel Objects – Windows drivers | Microsoft Learn
Typical kernel-mode objects include the following objects:
- Device objects (See Device Objects and Device Stacks.)
- File objects.
- Symbolic links.
- Registry keys.
- Threads and processes.
- Kernel dispatcher objects, such as event objects and mutex objects. (See Kernel Dispatcher Objects.)
- Callback objects. (See Callback Objects.)
- Section objects. (See Section Objects and Views.)
[Wayback/Archive] Life Cycle of an Object – Windows drivers | Microsoft Learn
[Wayback/Archive] Wdm.h header – Windows drivers | Microsoft Learn

This header contains reference material that includes specific details about the routines, structures, and data types that you will need to use to write kernel-mode drivers
[Wayback/Archive] Ntifs.h header – Windows drivers | Microsoft Learn

This header file is used by Windows file system and filter driver developers.
[Wayback/Archive] Using Files in a Driver – Windows drivers | Microsoft Learn

The Microsoft Windows executive represents files by file objects, which are executive objects that are managed by the object manager. (Directories are also represented by file objects.)

Kernel-mode components refer to a file by its object name, which is \DosDevices concatenated to the file’s full path. (On Microsoft Windows 2000 and later versions of the operating system, \?? is equivalent to \DosDevices.) For example, the object name of the C:\WINDOWS\example.txt file is \DosDevices\C:\WINDOWS\example.txt. You use the object name to open a handle to a file. For more information about object names, see Object Names.

…
[Wayback/Archive] Persistently write to a file from windows kernel driver – Stack Overflow

Q (thanks [Wayback/Archive] Antonio Rodriguez)

Hi I’m new to kernel level programming and trying to build a simple log writing driver. What I’m trying to achieve is to have a persistent driver will write referred text every predefined interval to a file in system path.

…

C (thanks [Wayback/Archive] Hans Passant)

At least document the Status code. Use L"\\\\??\\C:\\log.txt"
[Wayback/Archive] windows – Ntcreatefile allocationsize – Stack Overflow

Q (thanks [Wayback/Archive] user382591)

what is the purpose of AllocationSize parameter in the function Ntcreatefile ?

When using a non zero value for AllocationSize and closing the file with NtClose, the real file size is not equal to AllocationSize.

Why ?

A (thanks [Wayback/Archive] Hans Passant)

NtCreateFile() doesn’t do anything special with the argument, it simply passes it on to the file system driver in the MJ_CREATE request. You’ll need the WDK to see how it is getting used. A good one to look at is the FAT driver, you’ll find the AllocationSize used in src/filesys/fastfat/w2k/create.c. Follow the call chain into allocsup.c, FatAllocateDiskSpace().

Opportunities abound with knowing the expected allocation size up front. It can allocate the clusters up front with the disk drive head is already in the right spot to update the file allocation table. And it can fail the create call when the volume is running low on space before consuming every available cluster. Conversely, having it not fail will ensure that you can write to the file without running out of disk space. As long as you don’t write more than you asked for anyway.

And sure, when you close the file then the file size will be updated to the actual number of bytes written. AllocationSize is merely a hint.
[Archive] Rajeev Nagar Windows NT File System Internals : Ganesh K : Free Download, Borrow, and Streaming : Internet Archive
- [Archive] [Rajeev_Nagar]_Windows_NT._File_system_internals._(BookZZ.org).pdf
- [Archive] Full text of “Rajeev Nagar Windows NT File System Internals”
[Archive] ZFSin/ZFSin/zfs/module/zfs/zfs_vnops_windows.c at master · openzfsonwindows/ZFSin · GitHub

Queries:

--jeroen

This entry was posted on 2024/12/10 at 18:00 and is filed under Development, Software Development, Windows Development. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

	Lars Fosdal on Security alarm provider Woonve…
	Thomas Mueller on Question got closed in May 202…
	Thaddy de Koning on Formulier voor bewindvoerders…
	Thaddy de Koning on Formulier voor bewindvoerders…
	Thaddy de Koning on Formulier voor bewindvoerders…

The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

Subscribe

Archives

Recent Comments

Recent Posts

Blog Stats

Meta title

Tag Cloud Title

Top Clicks

Top Posts

My badges

Twitter Updates

My Flickr Stream

Pages

All categories

Email Subscription

Some links on Windows kernel APIs

Q (thanks [Wayback/Archive] Antonio Rodriguez)

C (thanks [Wayback/Archive] Hans Passant)

Q (thanks [Wayback/Archive] user382591)

A (thanks [Wayback/Archive] Hans Passant)

Leave a comment Cancel reply

The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

Subscribe

Archives

Recent Comments

Recent Posts

Blog Stats

Meta title

Tag Cloud Title

Top Clicks

Top Posts

My badges

Twitter Updates

My Flickr Stream

Pages

All categories

Email Subscription

Some links on Windows kernel APIs

Q (thanks [Wayback/Archive] Antonio Rodriguez)

C (thanks [Wayback/Archive] Hans Passant)

Q (thanks [Wayback/Archive] user382591)

A (thanks [Wayback/Archive] Hans Passant)

Rate this:

Share this:

Related

Leave a comment Cancel reply