Access denied while opening file with FILE_OPEN_BY_FILE_ID, NtCreateFIle, ObjectID

436 views Asked by At

Here I am trying to get a file handle by opening the fine by objectID, this open call is returning in access denied but the calling process has fill write access to the volume. Same call is working on some particular machine and getting access denied always on other.

FILE_OBJECTID_BUFFER *ObjId
UNICODESTRING findstr;
findstr.Buffer = (WCHAR*)&(ObjId->ObjectId);
findstr.Length          = sizeof(ObjId->ObjectId);
findstr.MaximumLength   = sizeof(ObjId->ObjectId);

OBJECT_ATTRIBUTES ObjAttribute = {0};
InitializeObjectAttributes (&ObjAttribute, 
&fidstr, 
OBJ_CASE_INSENSITIVE, 
VolumeHandle,
NULL);

IO_STATUS_BLOCK iosb = {0};

ULONG status = NtCreatefile(&targethandle, 
GENERIC_ALL,
&ObjAttribute,
iosb, 
NULL, 
FILE_ATTRIBUTE_NORMAL, 
FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN, FILE_OPEN_BY_FILE_ID | FILE_NON_DIRECTORY_FILE, 
NULL, 0);

Is some flag is missing here? Or Is there any other way to open the file handle by ObjectID? I am using FSCTL_GET_OBJECT_ID to get the file objectid.

fsutil objectid query <file_path>

0

There are 0 answers