2,789 questions
CreateFile / CreatefileA getlasterror returns 5, even after driver sddl settings reduced
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(60.8, 64%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EH%3C/text%3E%3C/svg%3E)
Hari
21
Reputation points
We have developed a c++ application tool to interact with one of the inhouse driver. we are suppose to use IOCTL's to communicate with driver. Initially the driver SDDL information was D:P(A;;GA;;;SY), and understood only the system account privilege is required from the app side to communicate / open the device.
later the driver updated the security to SECURITY_STRING = "D:P(A;;GA;;;SY)(A;;GA;;;LA)" and still it fails sometimes.
I would like to know if you have any sample code / reference that can have system account access privilege. please help much appreciated.
Windows development | Windows API - Win32
{count} votes
-
RLWA32 49,636 Reputation points2022-09-23T08:06:23.727+00:00 ...the driver updated the security to SECURITY_STRING = "D:P(A;;GA;;;SY)(A;;GA;;;LA)" and still it fails sometimes.
So what is the difference between the security context of the accounts under which CreateFile succeeds and when it fails?
If your intent was to grant Full Control to members of the Administrators group on the local system then the SDDL string should use BA for the SID string.
-
Hari 21 Reputation points
2022-09-23T10:41:36.34+00:00 So already another set of software is using this particular driver. and that software is having the system account access.
I do not have access to that software code to understand how it was built. Now after the driver changed the settings to D:P(A;;GA;;;SY)(A;;GA;;;LA), the code which I built works, that means it is able to access the driver and all the IOCTls works.
But, once the other software has used the this device driver, and after usage once it is released. The code / app which I have built fails to connect to the device.
Because of this reason, I thought of adding system account privilage to the code and I need reference for the same.to access again, I need to restart the machine.
-
RLWA32 49,636 Reputation points
2022-09-23T11:19:13.24+00:00 When your code is not running as SYSTEM but succeeds what account is being used?
Are you suggesting that the driver's security descriptor is being changed by some other in-house application that uses the driver?
Since you said that you are dealing with an in-house driver you should work with the developers that coded the driver and established its security descriptor to solve this problem. I mentioned various ways to run as SYSTEM when I answered your question here - createfile-createfilea-getlasterror-returns-5.html.
Solving the security descriptor issue with the driver developers is, in my opinion, a much better solution. Maybe there is a better alternative to allow access to accounts other than SYSTEM without giving them Full Control so that no driver user needs to run as SYSTEM.
-
Hari 21 Reputation points
2022-09-24T01:25:32.543+00:00 My code is running from administrator account.
the drivers security code is changed based on my request to support my application.
As mentioned previous method using psExec, is not suitable / does not fit the requirement. Also stealing another process privilege, I believe MSFT should have better way instead of workaround.
I experimented a lot on getting the system account privilege but none of them worked..
Can you share some reference code / guidance on how to get the system account privilege. -
RLWA32 49,636 Reputation points
2022-09-24T09:39:08.727+00:00 ...the code which I built works, that means it is able to access the driver and all the IOCTls works. But, once the other software has used the this device driver, and after usage once it is released. The code / app which I have built fails to connect to the device.
to access again, I need to restart the machine
The above comments that you made and your focus on running as SYSTEM lead me to question whether the other software is changing the security descriptor at runtime.
Can you verify that after the other software has executed that the security descriptor used in access checks has not been changed from its initial settings at system start-up?
If this other software is not executed can your application call CreateFile successfully more than once without needing to restart the machine?
If your application only fails after the other software has executed then maybe the other software is causing the problem. Perhaps this unknown problem is unrelated to account privileges.
Have you tested your application with PsExec to see if running as SYSTEM after the other software has executed is always successful?
-
Hari 21 Reputation points
2022-09-27T03:08:02.867+00:00 The other Software is not changing the security descriptor, its the same.
Yes, if the other software is not executed, the application I built runs successfull multiple times without restart.
Yes, the unknown problem is related to account privileges, because after this If I use psExec tool, the application works.
-
RLWA32 49,636 Reputation points
2022-09-27T08:10:02.23+00:00 Is there some other security/antivirus/antimalware software that could be interfering with your application? Have you tried disabling any such software and then testing?
From what you describe running as SYSTEM seems like a workaround to an unknown problem. My recommendation is to identify and solve the problem.
In addition to the other methods that I have described to you to run an application in an interactive user's session under the SYSTEM account you can also use a Windows service to accomplish this objective. The service (running as SYSTEM) can duplicate its own token, set the session id of the duplicated token to the id of the interactive user's session and then use CreateProcessAsUser with the duplicated token.
-
RLWA32 49,636 Reputation points
2022-09-30T11:14:27.197+00:00 Just checking if there are any new developments or updates?
Sign in to comment
Sign in to answer