[PATCH 1/4] Handle FSCTL in NtDeviceIoControlFile.

[Zebediah Figura (she/her)]

On 7/26/21 9:13 AM, Alex Xu (Hello71) wrote:
> Excerpts from Chip Davis's message of July 25, 2021 4:06 pm:
>> Needs tests showing that FSCTLs do indeed work with NtDeviceIoControlFile().
>>
>>
>> Chip
>>
> 
> Yes, I see your point.
> 
> It looks like it should be simple to add NtDeviceIoControlFile in
> dlls/ntdll/tests/file.c, but I was wondering: there don't seem to be any
> tests already, and it seems like it should make more sense to add a test
> for DeviceIoControl instead (since that is what most applications will
> care about).
> 
> However, looking at that, there are two implementations of
> DeviceIoControl, in kernelbase and kernel32. Why doesn't the kernel32
> one forward to kernelbase like most kernel32 functions? Also, why is the
> kernelbase function different from the kernel32 function? I don't know
> anything about VxDs, but it seems odd that the kernel32 one uses
> Information only for non-overlapped IO, but kernelbase uses it for
> overlapped too. Actually, looking at dlls/ntdll, it doesn't seem like
> InternalHigh is actually used for anything? It seems like it might
> happen to work on little-endian machines by chance due to alignment of
> OVERLAPPED and IO_STATUS_BLOCK, but this doesn't seem like a reliable
> method.
> 
> I checked git history, seems like InternalHigh should actually be
> Information everywhere? Thoughts?

No, this was done intentionally by Microsoft. OVERLAPPED is a documented 
user API; IO_STATUS_BLOCK is not (although now it is a documented kernel 
API). The fields of IO_STATUS_BLOCK are handled at the 
kernel32/kernelbase level but this handling is obscured in the user API 
by calling them "Internal" and "InternalHigh". The fields in the two 
structures match regardless of endianness.

I'm not sure why we don't load VXD drivers in kernelbase; there doesn't 
seem to be any obvious reason why we can't, but we don't anyway.

There aren't any generic tests for NtDeviceIoControlFile and 
NtFsControlFile because all of the tests are rather specific to the 
different ioctls used. I'd recommend finding any place in the tests 
where one is used and testing the other as well. It wouldn't surprise me 
if both are identical nowadays.

ἔρρωσο,
Zebediah