On 7/26/21 9:13 AM, Alex Xu (Hello71) wrote:
Excerpts from Chip Davis's message of July 25, 2021 4:06 pm:
Needs tests showing that FSCTLs do indeed work with NtDeviceIoControlFile().
Chip
Yes, I see your point.
It looks like it should be simple to add NtDeviceIoControlFile in dlls/ntdll/tests/file.c, but I was wondering: there don't seem to be any tests already, and it seems like it should make more sense to add a test for DeviceIoControl instead (since that is what most applications will care about).
However, looking at that, there are two implementations of DeviceIoControl, in kernelbase and kernel32. Why doesn't the kernel32 one forward to kernelbase like most kernel32 functions? Also, why is the kernelbase function different from the kernel32 function? I don't know anything about VxDs, but it seems odd that the kernel32 one uses Information only for non-overlapped IO, but kernelbase uses it for overlapped too. Actually, looking at dlls/ntdll, it doesn't seem like InternalHigh is actually used for anything? It seems like it might happen to work on little-endian machines by chance due to alignment of OVERLAPPED and IO_STATUS_BLOCK, but this doesn't seem like a reliable method.
I checked git history, seems like InternalHigh should actually be Information everywhere? Thoughts?
No, this was done intentionally by Microsoft. OVERLAPPED is a documented user API; IO_STATUS_BLOCK is not (although now it is a documented kernel API). The fields of IO_STATUS_BLOCK are handled at the kernel32/kernelbase level but this handling is obscured in the user API by calling them "Internal" and "InternalHigh". The fields in the two structures match regardless of endianness.
I'm not sure why we don't load VXD drivers in kernelbase; there doesn't seem to be any obvious reason why we can't, but we don't anyway.
There aren't any generic tests for NtDeviceIoControlFile and NtFsControlFile because all of the tests are rather specific to the different ioctls used. I'd recommend finding any place in the tests where one is used and testing the other as well. It wouldn't surprise me if both are identical nowadays.
ἔρρωσο, Zebediah