Re: access NTFS ADS from kernel mode driver by kenh59
kenh59
Fri Mar 16 19:49:30 CDT 2007
Thanks and I did the following and found it did work:
UNICODE_STRING fileNameUnicodeString;
OBJECT_ATTRIBUTES objectAttributes;
HANDLE hFileHandle, hStreamHandle;
NTSTATUS rc, rc2;
IO_STATUS_BLOCK IoStatus;
#define BUFFER_SIZE 50
CHAR buffer[BUFFER_SIZE]="test reading NTFS ADS from kernel mode";
size_t cb;
LARGE_INTEGER byteOffset;
RtlInitUnicodeString( &fileNameUnicodeString,
L"\\DosDevices\\C:\\TEST\\test-ads.txt:ads.txt");
InitializeObjectAttributes( &objectAttributes, &fileNameUnicodeString,
OBJ_CASE_INSENSITIVE, NULL, NULL );
rc = ZwCreateFile( &hFileHandle,
GENERIC_READ,
&objectAttributes, &IoStatus, NULL,
FILE_ATTRIBUTE_NORMAL,
0,
FILE_OPEN,
FILE_SYNCHRONOUS_IO_NONALERT,
NULL, 0 );
if ( rc == STATUS_SUCCESS ) {
byteOffset.LowPart = byteOffset.HighPart = 0;
rc2 = ZwReadFile(hFileHandle, NULL, NULL, NULL, &IoStatus,
buffer, BUFFER_SIZE, &byteOffset, NULL);
if(rc2 == STATUS_SUCCESS) {
buffer[BUFFER_SIZE-1] = '\0';
DbgPrint(" %s\n", &buffer[0]);
}
else
DbgPrint("*** fail to ZwReadFile and error code = %x ***\n", rc2);
ZwClose(hFileHandle);
}
else
DbgPrint("*** fail to open %wZ and error code = %x
***\n",&fileNameUnicodeString, rc);
"cristalink" wrote:
> Exactly in the same way - append :stream_name to the file name.
>
>
>
> "kenh59" <kenh59@discussions.microsoft.com> wrote in message
> news:C157A845-434D-4DE3-BCEB-C41EF8AFE961@microsoft.com...
> > Hi,
> >
> > I read some sample codes from MSDN site about NTFS ADS "alternate data
> > stream" but they're for user mode program. I want to access it in a kernel
> > mode driver. Can anyone give me a hint please?
> >
> > Thanks,
> >
> > Ken
>
>
>