ERROR_FILE_NOT_FOUND with Open/Create-GlobalFileMapping

c++ / delphi package - dll injection and api hooking

ERROR_FILE_NOT_FOUND with Open/Create-GlobalFileMapping

Postby tbrd » Tue Nov 28, 2017 1:16 pm

Hi Madshi!
When a "global file mapping" is created within a console session (e.g. 1), my system process within session 0 cannot open that mapping. Last error equals 2. The same file mapping can be opened from within the console session by other processes.
"Global file mappings" created by my session 0 system process can be accessed from all sessions (except from Edge browser...).

Does OpenGlobalFileMapping not search for session objects, when it is called from session 0?

Installer 2.8.3.0 and also 2.8.3.10, 32 and 64 Bit Windows 7 and Windows 8 tested...

Thanks
tbrd
 
Posts: 16
Joined: Thu Dec 15, 2016 8:45 am

Re: ERROR_FILE_NOT_FOUND with Open/Create-GlobalFileMapping

Postby iconic » Tue Nov 28, 2017 3:12 pm

Madshi means "Global" as in the Global\ prefix which you prepend to the file mapping name allowing it to be accessible in any session. Global\MappingName prefix is GLOBAL and no session numeric is ever prepended. At the system level it becomes \BaseNamedObjects\MappingName (in the case of NtCreateSection). Without the Global\ prefix MappingName is then session specific, whichever session CreateFileMapping or NtCreateSection is called in will have that session # prepended to the name like this \Sessions\1\BaseNamedObjects\MappingName

So no, OpenGlobalFileMapping is just opening whichever mapping name you specify and prepending the Global\ prefix before opening it. It is not looping through any open sessions to search for non-Global session specific objects and trying to open them. What if you had "MappingName" created in 2 different sessions, which one would be the correct one to return? This doesn't happen with truly Global session objects ;)

P.S: Just ran a quick test with OpenGlobalFileMapping and it calls OpenFileMappingW() first with Global\MappingName then if it doesn't exist it tries without the Global\ prefix which would return the calling process' session object, if the name exists of course.

--Iconic
iconic
 
Posts: 811
Joined: Wed Jun 08, 2005 5:08 am

Re: ERROR_FILE_NOT_FOUND with Open/Create-GlobalFileMapping

Postby madshi » Thu Nov 30, 2017 2:37 pm

Iconic is right, of course, as always.

My best guess right now is that your CreateGlobalFileMapping() call might be failing when called within the console session, due to insufficient rights? In that case madCodeHook create a local file mapping instead. You can check this in detail by using "Process Explorer". In the menu choose "View -> Lower Pane View -> Handles". Then you can see exactly which kind of mapping your console application created.

In order to create global file mappings, your process needs to be the SeCreateGlobalPrivilege privilege, and it must also be enabled.
madshi
Site Admin
 
Posts: 9469
Joined: Sun Mar 21, 2004 5:25 pm

Re: ERROR_FILE_NOT_FOUND with Open/Create-GlobalFileMapping

Postby tbrd » Fri Dec 01, 2017 9:16 am

Hi Madshi!

That explains it. What I did not expect was, that you open a session specific mapping instead of failing and setting LastError.

Thanks :)
tbrd
 
Posts: 16
Joined: Thu Dec 15, 2016 8:45 am

Re: ERROR_FILE_NOT_FOUND with Open/Create-GlobalFileMapping

Postby iconic » Fri Dec 01, 2017 7:49 pm

tbrd,

Same here. The function name is a bit ambiguous to a degree since it will attempt to open a local namespace file mapping object if the Global one doesn't exist or can't be opened for whatever reason. Maybe something like this would be more clear to the developer with slightly modified control over the local functionality?

Code: Select all
function OpenGlobalFileMapping(Name: PAnsiChar; Write: BOOL; OpenLocalNamespaceOnFail: BOOL = True): THandle; stdcall;
var
   dwAccess: DWORD;
begin
   result := 0;
   if (Write) then
   dwAccess := FILE_MAP_WRITE
else
   dwAccess := FILE_MAP_READ;
   result := OpenFileMappingW(dwAccess,
                              False,
                              PWChar('Global\' + WideString(AnsiString(Name))));
   if (result = 0) and (OpenLocalNamespaceOnFail) then
   result := OpenFileMappingW(dwAccess,
                              False,
                              PWChar(WideString(AnsiString(Name))));
end;


Personally though, I've used MCH for a long time and actually use these APIs in several commercial software products. To date I don't recall any issues with these particular functions, which of course is a great thing since Madshi does a tremendous job maintaining his package after all of these years.

--Iconic
iconic
 
Posts: 811
Joined: Wed Jun 08, 2005 5:08 am

Re: ERROR_FILE_NOT_FOUND with Open/Create-GlobalFileMapping

Postby madshi » Fri Dec 01, 2017 9:46 pm

Yes, such a "OpenLocalNamespaceOnFail" would definitely make sense, and that without breaking compatability, thanks for the suggestion. I'll add it to my to do list, but it's a bit more work, because I'll have to change all the headers, documentation etc etc, so I'm not sure how quickly I'll get to this.
madshi
Site Admin
 
Posts: 9469
Joined: Sun Mar 21, 2004 5:25 pm

Re: ERROR_FILE_NOT_FOUND with Open/Create-GlobalFileMapping

Postby iconic » Fri Dec 01, 2017 10:20 pm

That would be awesome :D Thanks Mathias!

--Iconic
iconic
 
Posts: 811
Joined: Wed Jun 08, 2005 5:08 am


Return to madCodeHook

Who is online

Users browsing this forum: No registered users and 9 guests

cron