Well, I made the modification to the source code. This time the program
got past opening the file after it was written to. The program then
deleted the file, and then tried to do a DeviceIoControl on it:
0806b0a8:Ret kernel32.CreateFileA() retval=00000038 ret=00761731
0806b0a8:Call kernel32.DeleteFileA(40606d3c "C:\\WINDOWS\\000e914.tmp")
ret=00761911
0806b0a8:trace:file:DeleteFileA 'C:\WINDOWS\000e914.tmp'
0806b0a8:trace:dosfs:DOSFS_GetFullName C:\WINDOWS\000e914.tmp (last=1)
0806b0a8:trace:string:lstrcpynA (0x40602380, "/mnt/dos", 1024)
0806b0a8:trace:dosfs:DOSFS_FindUnixName /mnt/dos,WINDOWS\000e914.tmp
0806b0a8:trace:heap:HeapAlloc (403a0000,00000002,0000022c): returning
4041ef38
0806b0a8:trace:dosfs:DOSFS_FindUnixName (/mnt/dos,WINDOWS\000e914.tmp)
-> windows (WINDOWS)
0806b0a8:trace:heap:HeapFree (403a0000,00000002,4041ef38): returning TRUE
0806b0a8:trace:dosfs:DOSFS_FindUnixName /mnt/dos/windows,000e914.tmp
0806b0a8:trace:heap:HeapAlloc (403a0000,00000002,0000022c): returning
4041ef38
0806b0a8:trace:dosfs:DOSFS_FindUnixName (/mnt/dos/windows,000e914.tmp)
-> 000e914.tmp (000E914.TMP)
0806b0a8:trace:heap:HeapFree (403a0000,00000002,4041ef38): returning TRUE
0806b0a8:trace:dosfs:DOSFS_GetFullName returning
/mnt/dos/windows/000e914.tmp =
C:\WINDOWS\000E914.TMP
0806b0a8:Ret kernel32.DeleteFileA() retval=00000001 ret=00761911
0806b0a8:Call
kernel32.DeviceIoControl(00000038,00000001,00000000,00000000,40606e40,00000010,40606e50,00000000)
ret=00761943
0806b0a8:trace:win32:DeviceIoControl
(56,1,(nil),0,0x40606e40,16,0x40606e50,(nil))
0806b0a8: get_file_info( handle=56 )
0806b0a8: get_file_info() = 0 { type=1, attr=32, access_time=1007675668,
write_time=1007675668, size_high=0, size_low=12936, links=0,
index_high=769, index_low=902562, serial=00000000 }
0806b0a8:Ret kernel32.DeviceIoControl() retval=00000000 ret=00761943
0806b0a8:Call kernel32.GetLastError() ret=00760303
0806b0a8:Ret kernel32.GetLastError() retval=00000057 ret=00760303
This last error means "Invalid Parameter".
So I take back my thought that \\.\filename.ext should just open the
file as a regular file. I think it should be opening the file as a VxD,
installing it if it isn't already installed. How that's supposed to work
is beyond me, but I'll see if I can learn about how it should be done.
--Rob
