Unable to open volume?

[tt376]

I am facing error unable to open volume in msvcpp console project on windows.
Do you know what is the reason?

Microsoft Visual Studio Community 2022 (64) Version 17.6.4

`
#include
#include <stdlib.h>
#include <stdio.h>
#define LIBFSNTFS_DLL_IMPORT
#include "libfsntfs.h"
using namespace std;

const char* ver = libfsntfs_get_version();
cout << ver << endl;                                                                             ->20230427

libfsntfs_error_t* error = NULL;

int codepage;
libfsntfs_get_codepage(&codepage, &error);
cout << codepage << endl;                                                                   ->1252
libfsntfs_set_codepage(932, &error);
libfsntfs_get_codepage(&codepage, &error);
cout << codepage << endl;                                                                    ->932

libfsntfs_volume_t* volume = NULL;

if (libfsntfs_volume_initialize(&volume, &error) != 1)
{
	cout << "fail ini" << endl;                                                                ->no output
}

const char* volume_path = R"(\\.\C:)";
if (libfsntfs_volume_open(volume, volume_path, LIBFSNTFS_ACCESS_FLAG_READ, &error) != 1)
{
	cout << "fail open" << endl;                                                            ->fail open
	cout << *error << endl;                                                                    ->97
}

`

When I stepped in, I found that I was getting an error in the block below, but nothing more than that.

`
libcpath_path.c

if( libcsplit_narrow_split_string_get_number_of_segments(
     path_split_string,
     &path_number_of_segments,
     error ) != 1 )
{
	libcerror_error_set(
	 error,
	 LIBCERROR_ERROR_DOMAIN_RUNTIME,
	 LIBCERROR_RUNTIME_ERROR_GET_FAILED,
	 "%s: unable to retrieve number of path string segments.",
	 function );

	goto on_error;
}

`

[joachimmetz]

can you provide the error backtrace and conditions of how you are running/using the code?

[tt376]

Thank you for your prompt response.

I opened the 20230427 release sln file in vs2022 and compiled it as is. At that time, dokan was not installed.

Then I created my project with msvcpp in vs2022, targeted win32, linked libfsntfs.lib as an extra library and copied libfsntfs.dll.

When I tried the above code in my project, it failed to open the volume.
I also tried the D drive with the same result. bitlocker is disabled.
Also, when I created a RAW image file of the hard disk and tried to open it, this also failed, but I got another error code "r".

I'm very sorry, but could you tell me how to get the backtrace? I will send whatever I can send.

[joachimmetz]

I'm very sorry, but could you tell me how to get the backtrace? I will send whatever I can send.

what is the actual error message you are seeing?

[tt376]

The libfsntfs_volume_open function worked normally and returned an error code of 97(a) to the libfsntfs_error_t variable.
There are no errors from the debugger. All I see is a return value of 97.

[joachimmetz]

what if you print the error? https://github.com/libyal/libfsntfs/blob/main/include/libfsntfs.h.in#L206

[tt376]

I didn't know that function. Run it and report the results. please wait.

[tt376]

libfsntfs_error_backtrace_fprint(error, stdout);

Running the above code returned the below output

libcsplit_narrow_split_string_get_number_of_segments: invalid split string.

libcpath_path_get_full_path: unable to retrieve number of path string segments.

libbfio_file_set_name: unable to determine full path.

libfsntfs_volume_open: unable to set filename in file IO handle.

Also, by writing the above code, the debugger output the following error when exiting the main function.
Am I doing something fundamentally wrong?

File: minkernel\crts\ucrt\src\appcrt\heap\debug_heap.cpp
Line: 908

Expression: is_block_type_valid(header->_block_use)

Exception thrown at 0x77B44BE4 (ntdll.dll) (in NTFSCopy.exe): 0xC000000D: You passed an invalid parameter to a service or function.
An unhandled exception occurred at 0x77B44BE4 (ntdll.dll) (in NTFSCopy.exe): 0xC000000D: You passed an invalid parameter to a service or function. 

[joachimmetz]

It likely does not like R"(\\.\C:)"; try \\.\C: instead

[tt376]

Thank you for your support.
I tried two patterns, but each output an error.

const char* volume_path = "\\.\C:";
↓
libcfile_file_open_wide_with_error_code: unable to open file: \\?\C:\.C: with error: -1

const char* volume_path = "\\\\.\\C:";
↓
libcsplit_narrow_split_string_get_number_of_segments: invalid split string.
libcpath_path_get_full_path: unable to retrieve number of path string segments.
libbfio_file_set_name: unable to determine full path.
libfsntfs_volume_open: unable to set filename in file IO handle.

[joachimmetz]

libcfile_file_open_wide_with_error_code

wide functions require wchar_t strings, e.g. const wchar_t* volume_path = L"\\.\C:";

Also note that running libfsntfs on a live file system is not recommend. The file system will change under your feet and the library does internal caching.

libcsplit_narrow_split_string_get_number_of_segments: invalid split string.

I'll have a look when time permits see if I can reproduce it, can you provide some details on your build configuration? e.g. which WINVER

[tt376]

wide functions require wchar_t strings, e.g.

I'm also surprised that this error output even though I'm not using the libfsntfs_volume_open_wide function.
I had a suspicion that there might be a bug in the handling of input values for the libfsntfs_volume_open function.
Also, my system uses a CP932, and I've come to the realization that this might be causing some kind of error.

I'll have a look when time permits see if I can reproduce it, can you provide some details on your build configuration? e.g. which WINVER

The preprocessor macro for the debug configuration is below.
WINVER was not specified.

WIN32
_DEBUG
_CONSOLE
_UNICODE
UNICODE

C/C++ command line
/JMC /permissive- /ifcOutput "Debug\" /GS /analyze- /W3 /Zc:wchar_t /I"C:\***\NTFSCopy\lib\libfsntfs-20230427\include" /ZI /Gm- /Od /sdl /Fd"Debug\vc143.pdb" /Zc:inline /fp:precise /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_UNICODE" /D "UNICODE" /errorReport:prompt /WX- /Zc:forScope /RTC1 /Gd /Oy- /MDd /FC /Fa"Debug\" /EHsc /nologo /Fo"Debug\" /Fp"Debug\NTFSCopy.pch" /diagnostics:column 

Linker command line
/OUT:"C:\***\NTFSCopy\Debug\NTFSCopy.exe" /MANIFEST /NXCOMPAT /PDB:"C:\***\NTFSCopy\Debug\NTFSCopy.pdb" /DYNAMICBASE "C:\***\NTFSCopy\lib\libfsntfs-20230427\builtx86\libfsntfs.lib" "kernel32.lib" "user32.lib" "gdi32.lib" "winspool.lib" "comdlg32.lib" "advapi32.lib" "shell32.lib" "ole32.lib" "oleaut32.lib" "uuid.lib" "odbc32.lib" "odbccp32.lib" /DEBUG /MACHINE:X86 /INCREMENTAL /PGD:"C:\***\NTFSCopy\Debug\NTFSCopy.pgd" /SUBSYSTEM:CONSOLE /MANIFESTUAC:"level='requireAdministrator' uiAccess='false'" /ManifestFile:"Debug\NTFSCopy.exe.intermediate.manifest" /LTCGOUT:"Debug\NTFSCopy.iobj" /ERRORREPORT:PROMPT /ILK:"Debug\NTFSCopy.ilk" /NOLOGO /LIBPATH:"C:\***\NTFSCopy\lib\libfsntfs-20230427\builtx86" /TLBID:1 

I'll let you know if I notice anything too. thank you.