Thread: Opening a directory with NtCreateFile

I want to get an handle to a directory and query it,via NtCreateFile() and NtQueryDirectoryFile() :

Code:

#include <cstdlib>
#include <windows.h>
#include <cstdio>

// you also need some #defines from Windows DDK,like 
// IO_STATUS_BLOCK,FILE_INFORMATION_CLASS etc.

// this is my definition of OBJECT_ATTRIBUTES,perhaps it's incorrect??


 typedef struct _OBJECT_ATTRIBUTES {
    ULONG uLength;
    HANDLE  RootDirectory;
    PUNICODE_STRING  ObjectName;
    ULONG  Attributes;
    PSECURITY_DESCRIPTOR  SecurityDescriptor;
    PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService;  
 } OBJECT_ATTRIBUTES,*POBJECT_ATTRIBUTES;



int WINAPI WinMain(HINSTANCE,HINSTANCE,LPSTR,int){


 typedef int (WINAPI * NtQueryDirFunc)(HANDLE,HANDLE,PVOID,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS,BOOL,PUNICODE_STRING,BOOL);
 NtQueryDirFunc NtQueryDirectoryFile = (NtQueryDirFunc)GetProcAddress(GetModuleHandle("ntdll.dll"),"NtQueryDirectoryFile");

 PFILE_DIRECTORY_INFORMATION pDirInfo = (PFILE_DIRECTORY_INFORMATION)calloc(1,sizeof(FILE_DIRECTORY_INFORMATION) + MAX_PATH);

 typedef int (WINAPI * NtCreateFileFunc)(PHANDLE,DWORD,POBJECT_ATTRIBUTES,PVOID,PVOID,ULONG,ULONG,ULONG,ULONG,PVOID,ULONG);
 NtCreateFileFunc ntcreatefile = (NtCreateFileFunc)GetProcAddress(GetModuleHandle("ntdll.dll"),"NtCreateFile");

	typedef DWORD (WINAPI *PfRtlAnsiStringToUnicodeString)(PUNICODE_STRING, PANSI_STRING, BOOL);
	typedef DWORD (WINAPI *PfRtlUnicodeStringToAnsiString)(PANSI_STRING, PUNICODE_STRING, BOOL);
	typedef DWORD (WINAPI *PfRtlCompareUnicodeString)(PUNICODE_STRING, PUNICODE_STRING, BOOL);

	PfRtlAnsiStringToUnicodeString MyRtlAnsiStringToUnicodeString;
	PfRtlUnicodeStringToAnsiString MyRtlUnicodeStringToAnsiString;
	PfRtlCompareUnicodeString MyRtlCompareUnicodeString;

 MyRtlAnsiStringToUnicodeString = (PfRtlAnsiStringToUnicodeString)GetProcAddress(LoadLibrary("ntdll.dll"),"RtlAnsiStringToUnicodeString");
 MyRtlUnicodeStringToAnsiString = (PfRtlUnicodeStringToAnsiString)GetProcAddress(LoadLibrary("ntdll.dll"),"RtlUnicodeStringToAnsiString");
 MyRtlCompareUnicodeString = (PfRtlCompareUnicodeString)GetProcAddress(LoadLibrary("ntdll.dll"), "RtlCompareUnicodeString");

 OBJECT_ATTRIBUTES oa;
 UNICODE_STRING us;
 ANSI_STRING as;

 const char szDir[] = "c:\\windows\\";  

 as.Buffer = (char *)malloc(strlen(szDir) + 1);
 strcpy(as.Buffer,szDir);
 as.Length = as.MaximumLength = us.MaximumLength = us.Length = strlen(szDir);

  // convert directory name from ANSI to UNICODE
 MyRtlAnsiStringToUnicodeString(&us, &as, TRUE);  

 MessageBoxW(NULL,us.Buffer,us.Buffer,MB_OK);  // show directory name

 oa.uLength = sizeof(oa);
 oa.RootDirectory = NULL;
 oa.ObjectName = &us;
 oa.Attributes = OBJ_KERNEL_HANDLE ;
 oa.SecurityDescriptor = NULL;
 oa.SecurityQualityOfService = NULL;

 ULONG info;

 PIO_STATUS_BLOCK pIO = (PIO_STATUS_BLOCK)malloc(sizeof(IO_STATUS_BLOCK));
 pIO->Information = &info;

 HANDLE hDir;

 char c[20];
 sprintf(c,"%u", ntcreatefile(&hDir,FILE_TRAVERSE | FILE_LIST_DIRECTORY,&oa,pIO,NULL,0,0,FILE_OPEN,FILE_DIRECTORY_FILE,NULL,0) == STATUS_SUCCESS);
 MessageBox(NULL,c,"",MB_OK);

 sprintf(c,"%u",STATUS_SUCCESS == NtQueryDirectoryFile(hDir,NULL,NULL,NULL,pIO,pDirInfo,sizeof(FILE_DIRECTORY_INFORMATION) + MAX_PATH,FileDirectoryInformation,FALSE,NULL,TRUE));
 
 MessageBox(NULL,c,"",MB_OK);

 CloseHandle(hDir);

 return 0;
}

The output is always 0...why?? perhaps the definition of OBJECT_ATTRIBUTES was wrong?? why does the call to NtCreateFile fails?

what are you trying to do with it? If you want to get a list of the files in a directory then use FindFirstFile() and FindNextFile() (CreateFile will not work on directories either). MS-Windows programs can't read directories like they do in *nix.

Originally Posted by Ancient Dragon

what are you trying to do with it? If you want to get a list of the files in a directory then use FindFirstFile() and FindNextFile() (CreateFile will not work on directories either). MS-Windows programs can't read directories like they do in *nix.

it's possible,instead
you have to use CreateFile with FILE_FLAG_BACKUP_SEMANTICS if SE_BACKUP_NAME and SE_RESTORE_NAME privileges are enabled on your process,otherwise enable them first and then use createfile like above

ok thanks,i've already solved this problem