Access Violation When Calling RtlCreateSystemVolumeInformationFolder

[SavvyDeveloper]

Hi. I'm new to this forum.

My problem is, I can't call RtlCreateSystemVolumeInformationFolder from my console application written in C++. You see, doing so results in an access violation exception when I run my app. I get the following error:

Unhandled exception at 0x013c8245 in myProgram.exe: 0xC0000005: Access violation writing location 0x000025b8.

When I click on break button on the error message, I see that the exception occurs at the line where the aforementioned function is called. And about my code:

Before calling RtlCreateSystemVolumeInformationFolder , I call RtlInitUnicodeString to obtain a UNICODE_STRING structure. Then I pass a pointer to this structure to RtlCreateSystemVolumeInformationFolder.

And I don't want to list the import library "ntoskrnl.lib" in my project settings because I have some problems with this library. Instead, I want to use LoadLibrary and GetProcAddress to dynamically link to "NtosKrnl.exe".

Here is my code:

#include <Windows.h>
#include <winternl.h>

typedef NTSTATUS (NTAPI *PROC_C_SVI_FOLDER)(PCUNICODE_STRING);
typedef VOID (NTAPI *PROC_I_UNC_STR)(PUNICODE_STRING, PCWSTR);

#define STATUS_SUCCESS 0

void main()
{
HMODULE lib = LoadLibrary("ntoskrnl.exe");
if (lib != NULL)
{
PROC_C_SVI_FOLDER CreateSystemVolumeInformation = (PROC_C_SVI_FOLDER) GetProcAddress(lib, "RtlCreateSystemVolumeInformationFolder");
PROC_I_UNC_STR InitUnicodeString = (PROC_I_UNC_STR) GetProcAddress(lib, "RtlInitUnicodeString");

UNICODE_STRING volRootPath;
InitUnicodeString(&volRootPath, L"E:");

if (CreateSystemVolumeInformation(&volRootPath) != STATUS_SUCCESS)
MessageBox(NULL, "RtlCreateSystemVolumeInformation failed.", "Error", MB_OK | MB_ICONSTOP);

FreeLibrary(lib);
}
}


Note: I also tried adding a trailing backslash to the string "E:" which is passed as the second parameter in the call to RtlInitUnicodeString. But it didn't solve the problem.

Continue reading...