The Wiert Corner – irregular stream of stuff

Links from a while ago because some crash caught my eye:

• [Wayback/Archive] NtCreateFile function (ntifs.h) – Windows drivers | Microsoft Learn
  

  The NtCreateFile routine creates a new file or opens an existing file.

• [Wayback/Archive] NtSetInformationFile function (ntifs.h) – Windows drivers | Microsoft Learn
  

  The NtSetInformationFile routine changes various kinds of information about a file object.

  • [Wayback/Archive] _FILE_END_OF_FILE_INFORMATION (ntddk.h) – Windows drivers | Microsoft Learn
    

    The FILE_END_OF_FILE_INFORMATION structure is used as an argument to the ZwSetInformationFile routine.

• [Wayback/Archive] NtWriteFile function (ntifs.h) – Windows drivers | Microsoft Learn
  

  The ZwWriteFile routine writes data to an open file.

• [Wayback/Archive] NtXxx Routines – Windows drivers | Microsoft Learn
  

  This section describes the NtXxx versions of the Windows Native System Services routines. Most native system services routines have two versions, one of which has a name begins with the prefix Nt; the other version has a name that begins with the prefix Zw. For example, calls to NtCreateFile and ZwCreateFile perform similar operations and are, in fact, serviced by the same kernel-mode system routine.

  For calls from kernel-mode drivers, the NtXxx and ZwXxx versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the NtXxx and ZwXxx versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.

  …

• [Wayback/Archive] NtFsControlFile function (ntifs.h) – Windows drivers | Microsoft Learn
  

  The NtFsControlFile routine sends a control code directly to a specified file system or file system filter driver, causing the corresponding driver to perform the specified action.

• [Wayback/Archive] ZwCreateFile function (wdm.h) – Windows drivers | Microsoft Learn
  

  The ZwCreateFile routine creates a new file or opens an existing file.

• [Wayback/Archive] Kernel-Mode Driver Reference – Win32 apps | Microsoft Learn
• [Wayback/Archive] Kernel-Mode Driver Architecture Design Guide – Windows drivers | Microsoft Learn
• [Wayback/Archive] Surface Team Driver Development Best Practices – Windows drivers | Microsoft Learn
• [Wayback/Archive] Windows Kernel-Mode Object Manager – Windows drivers | Microsoft Learn
• [Wayback/Archive] Managing Kernel Objects – Windows drivers | Microsoft Learn
  

  Typical kernel-mode objects include the following objects:

  • Device objects (See Device Objects and Device Stacks.)
  • File objects.
  • Symbolic links.
  • Registry keys.
  • Threads and processes.
  • Kernel dispatcher objects, such as event objects and mutex objects. (See Kernel Dispatcher Objects.)
  • Callback objects. (See Callback Objects.)
  • Section objects. (See Section Objects and Views.)

• [Wayback/Archive] Life Cycle of an Object – Windows drivers | Microsoft Learn
• [Wayback/Archive] Wdm.h header – Windows drivers | Microsoft Learn
  

  This header contains reference material that includes specific details about the routines, structures, and data types that you will need to use to write kernel-mode drivers

• [Wayback/Archive] Ntifs.h header – Windows drivers | Microsoft Learn
  

  This header file is used by Windows file system and filter driver developers.

• [Wayback/Archive] Using Files in a Driver – Windows drivers | Microsoft Learn
  

  The Microsoft Windows executive represents files by file objects, which are executive objects that are managed by the object manager. (Directories are also represented by file objects.)

  Kernel-mode components refer to a file by its object name, which is \DosDevices concatenated to the file’s full path. (On Microsoft Windows 2000 and later versions of the operating system, \?? is equivalent to \DosDevices.) For example, the object name of the C:\WINDOWS\example.txt file is \DosDevices\C:\WINDOWS\example.txt. You use the object name to open a handle to a file. For more information about object names, see Object Names.

  …

• [Wayback/Archive] Persistently write to a file from windows kernel driver – Stack Overflow
  

  Q (thanks [Wayback/Archive] Antonio Rodriguez)

  Hi I’m new to kernel level programming and trying to build a simple log writing driver. What I’m trying to achieve is to have a persistent driver will write referred text every predefined interval to a file in system path.

  …

  C (thanks [Wayback/Archive] Hans Passant)

  At least document the Status code. Use L"\\\\??\\C:\\log.txt"

• [Wayback/Archive] windows – Ntcreatefile allocationsize – Stack Overflow
  

  Q (thanks [Wayback/Archive] user382591)

  what is the purpose of AllocationSize parameter in the function Ntcreatefile ?

  When using a non zero value for AllocationSize and closing the file with NtClose, the real file size is not equal to AllocationSize.

  Why ?

  A (thanks [Wayback/Archive] Hans Passant)

  NtCreateFile() doesn’t do anything special with the argument, it simply passes it on to the file system driver in the MJ_CREATE request. You’ll need the WDK to see how it is getting used. A good one to look at is the FAT driver, you’ll find the AllocationSize used in src/filesys/fastfat/w2k/create.c. Follow the call chain into allocsup.c, FatAllocateDiskSpace().

  Opportunities abound with knowing the expected allocation size up front. It can allocate the clusters up front with the disk drive head is already in the right spot to update the file allocation table. And it can fail the create call when the volume is running low on space before consuming every available cluster. Conversely, having it not fail will ensure that you can write to the file without running out of disk space. As long as you don’t write more than you asked for anyway.

  And sure, when you close the file then the file size will be updated to the actual number of bytes written. AllocationSize is merely a hint.

• [Archive] Rajeev Nagar Windows NT File System Internals : Ganesh K : Free Download, Borrow, and Streaming : Internet Archive
  • [Archive] [Rajeev_Nagar]_Windows_NT._File_system_internals._(BookZZ.org).pdf
  • [Archive] Full text of “Rajeev Nagar Windows NT File System Internals”
• [Archive] ZFSin/ZFSin/zfs/module/zfs/zfs_vnops_windows.c at master · openzfsonwindows/ZFSin · GitHub

Queries:

• [Wayback/Archive] windows kernel api documentation – Google Search
• [Wayback/Archive] “windows kernel driver” allocate file – Google Search
• [Wayback/Archive] “MJ_CREATE” “AllocationSize” – Google Search

--jeroen