Check This link .

Hello All, I've one application which loads a dll into process using VirtualAllocEx, WriteProcessMemory and CreateRemoteThread, Now when the runtime library is selected as "MultiThreaded Debug /Mtd" it works fine in local computer but i can't run the application in other computer as it gives error regarding the configuration of file, To make this work i change the runtime library as /Mt (Multi Threaded) which actually works in any computer when i stop my antivirus, else the antivirus deletes the exe as soon as i build it.. How can i make this work. Thanks.

Same happen to me when i tried to load "Chinese" string, But changing locale works for me..

Check This

Cool, Thanks... I'm checking :)

Hello All, I am always confused between static, dynamic, and reinterpret casting. I tried to find answers but somehow they all are confusing... Could anyone clears this concept. Thanks.

Hello bob, Yes i gave all the rights to computer but still access denied is coming, Let me explain the scenario again, The service is running on windows XP, The file is in windows server 2003, both are on same domain, By right clicking and sharing security of shared folder i gave all the possible rights to XP machine, But whenever the service(on XP) tries to copy it gives me access denied.. Am i missing any more setting here? Thanks

Hi bob, Thanks for the reply, Yes both the computers on same domain, How do i make sure that that machine which is running service is given explicit rights to the file share and the folder? And do you mean the computer name by resolvable name?

Hello all, I have an application which access files on network share, Now the requirement is that instead of application a service should access the files on network share and the service must be running on "LOCAL SYSTEM ACCOUNT", I guess it's pretty easy when make service as NetworkService Account to access files on network, But the requirement is to make service on "LOCAL SYSTEM ACCOUNT" only. Further research tells me that i need to setup a "null session share" if LSA needs to access network, So i did that with some help from This Page, But It always gives me access denied. Any help will be appreciated.. Thanks..

GetFileInformationByHandleEx gives me "\efgh\a.txt" , I then use GetFileInformationByHandle with handle to get the volume serial number and then GetLogicalDriveStrings and GetVolumeInformation to compare the volume serial number and attach with "\efgh\a.txt" to get "C:\efgh\a.txt".

I think i can't. Let me explain the scenario, I have a empty folder say "abcd" in C: drive and a non-empty folder say "efgh" in C: drive which contains a.txt, b.rar Now when i access empty folder(i.e try to delete) the path i get is "C:\abcd", which is fine and a query for directory in GetFileInformationByHandleEx return TRUE, But when i access non empty folder the path i get is "C:\efgh\a.txt" and "C:\efgh\b.rar" , Please note i did not access the files inside it but folder. So i guess "PathIsDirectory" won't work..

Hello all, I hooked NtSetInformationFile to intercept delete call, This is done, Now i have a file which contains name of files and folder need to be protected, Protecting file is no problem as i get the file name from file handle and using strcmp i decide whether to delete the file or not, But how to determine that the file handle i get in NtSetInformationFile is folder? I tried using GetFileInformationByHandleEx with FileStandardInfo which should give me whether the handle is directory or not, But it always returns TRUE(folder) when there are no files inside and FALSE(not folder) when there are files inside. Thanks all.

I think it's done, I don't know if it's ugly... I used GetFileInformationByHandleEx to get the truncated file name, GetFileInformationByHandle to get the volume serial number, GetLogicalDriveStrings to get all the drives and GetVolumeInformation to get the volume serial number of all the drives, I then compare volume serial number returned by GetVolumeInformation and GetFileInformationByHandle, If it matches then it concatenate the drive letter with the truncated file name returned by GetFileInformationByHandleEx...

As GetFileInformationByHandleEx won't give me the device name, I'm using GetFileInformationByHandle to get the volume number and hopefully compare the number with drive manually.. But the dwVolumeSerialNumber reurns some garbage value..

BY_HANDLE_FILE_INFORMATION info;
DWORD dwSerialNumber = 0;

if(GetFileInformationByHandle(FileHandle, &info) != 0)
{
dwSerialNumber = info.dwVolumeSerialNumber;
swprintf(szTemp, L"The Volume Serial Number = %d", info.dwVolumeSerialNumber);
MessageBox(NULL, szTemp, L"Success", MB_OK);
}
else
{
swprintf(szTemp, L"GetFileInformationByHandle Error = %d", GetLastError());
MessageBox(NULL, szTemp, L"Success", MB_OK);
}

Thanks for the reply, and yes we can call GetFileInformationByHandleEx more than once, But i don't see any value returning the Drive letter or Device name of drive where the file is located in FileInformationClass unless i'm missing something..

Hello all, I am detecting deletion of files on the system and to do this i am hooking the NtSetInformationFile function. this gets passed to it the file handle, and from this i need the file name. so i am using the API GetFileInformationByHandleEx to get the file name, But the problem is that the file name comes like this "\sample\a.txt", Now this doesn't give me device name(\device\volume) with File name, so i cannot assume from where the file has been accessed, It could be "C:\sample\a.txt" or "D:\sample\a.txt". So it's quite clear that i must have "\Device\volume0", "\Device\volume1" etc before the filename, Further googling took me to THIS page where the file name can be retrieved from FileHandle, This uses CreateFileMapping, MapViewOfFile, GetMappedFileName, GetLogicalDriveStrings and QueryDosDevice to retrieve the file name, But when i use it CreateFileMapping fail with error 5 which is "Access Denied", Some more google and i found that the file handle must have GENERIC_READ access else CreateFileMapping will fail. Now i'm not opening the file, explorer is.. So how could i check with which access explorer opens or access the file or how could i change the dwDesiredAccess.. Thanks All..

Yes, Silly Mistake, There shouldn't be &.. Thanks Also how do i get the real path? pFileInfo->FileName gives me "\sample\a.txt"and i need "C:\sample\a.txt"

Hello all, I'm trying to print the filename to Dbgview which i receive from GetFileInformationByHandleEx, But it's getting crashed every time..

PFILE_NAME_INFO pFileNameInfo;
DWORD dwFileNameLength = 1024;
DWORD err;
TCHAR szTemp[MAX_PATH] = "";

pFileNameInfo = (PFILE_NAME_INFO)HeapAlloc(GetProcessHeap(), 0, dwFileNameLength);

if(pFileNameInfo != NULL)
{
if(GetFileInformationByHandleEx(FileHandle, FileNameInfo, &pFileNameInfo, dwFileNameLength) != 0)
{
MessageBox(NULL, L"Before Check", L"Success", MB_OK);
OutputDebugStringW(pFileNameInfo->FileName);
}
else
{
err = GetLastError();
swprintf(szTemp, L"Get info Error = %d", err);
MessageBox(NULL, szTemp, L"Error", MB_OK);
}
HeapFree(GetProcessHeap(), 0, pFileNameInfo);
}
else
{
err = GetLastError();
swprintf(szTemp, L"Heap Error = %d", err);
MessageBox(NULL, szTemp, L"Error", MB_OK);
}

Thanks All..

Who me??

I added msvcrt.lib and it's working :)