why IoCreateSymbolicLink() fails with error 0xC000003A

1
#include <ntddk.h>
#include <wdmsec.h>

#define control_device_object_symbol L"\\?\\cdosym_ssdt"

const GUID ssdt_hook_uuid = { 0xd47bf014L,0x7b37,0x11e7,{0xba,0x6f,0x00,0x0c,0x29,0xf3,0x4e,0xca} };
PDEVICE_OBJECT gdo = NULL;//for IoCreateDeviceSecure use<global device object>
ULONG g_index = 0;

NTSTATUS DriverEntry(PDRIVER_OBJECT driver, PUNICODE_STRING regPath)
{
    DbgBreakPoint();
    NTSTATUS status;
    ULONG i;
    ULONG index;

    UNICODE_STRING sddl = RTL_CONSTANT_STRING(L"D:P(A;;GA;;;WD)");
    UNICODE_STRING control_device_object = RTL_CONSTANT_STRING(L"\\Device\\cdo_ssdt");
    UNICODE_STRING control_device_symbol = RTL_CONSTANT_STRING(control_device_object_symbol);

    status = IoCreateDeviceSecure(driver, 0, &control_device_object, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE, &sddl, (LPCGUID)&ssdt_hook_uuid, &gdo);
    if (!NT_SUCCESS(status))
    {
        DbgPrint("    [-] IoCreateDeviceSecure error.\n");
        return status;
    }

    status = IoDeleteSymbolicLink(&control_device_symbol);
    status = IoCreateSymbolicLink(&control_device_symbol, &control_device_object);
    if (!NT_SUCCESS(status))
    {
        DbgPrint("    [-] IoCreateSymbolicLink error while status=0x%X.\n",status);
        IoDeleteDevice(gdo);
        return status;
    }
}

Here are parts of the code.

Each time when i debug it in windbg, status was set to 0xC000003A after IoCreateSymbolicLink(which means path not found).

I've checked IoCreateDeviceSecure() and IoDeleteSymbolicLink()'s return value,they're STATUS_SUCCESS)

Since i delete the symbolic name before i create the same one ,why kernel still tells me path not found?

By the way,does the "path" refers to the symbolic name path or others?

Thanks for any help :)

windows
driver
asked on Stack Overflow Aug 9, 2017 by Pawn Pod

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0