CODEWITHSUNDEEP
winapi
Noitidart
Noitidart

Reputation: 37238

RmGetList consistently returning 0x5 ERROR_ACCESS_DNIED

I am getting consistently a return value of 5 from RmGetList, any possible reasons?

I am following this tutorial: http://blogs.msdn.com/b/oldnewthing/archive/2012/02/17/10268840.aspx

My RmStartSession and RmRegstierResources both return 0 which means success. A note though, after RmStartSession the dwSession is always 0, and my szSessionKey stays a string in the form of 0ea790d06656a54f84645b5755f7b6d6 null terminated. Is this a problem?

My code is js-ctypes so I'm reluctant to share this in winapi but ill share it: https://github.com/Noitidart/_scratchpad/blob/master/_WinAPI-RstrtMgr.js#L293

Edit: I learned that dwSession of 0 is a valid. However I still can't figure out why I'm getting access denied on RmGetList, anyone any ideas?

Upvotes: 3

Views: 840

Answers (2)

Kirill Osenkov
Kirill Osenkov

Reputation: 8976

I've learned that the restart manager doesn't support folders, and the error 5 is returned when you're trying to pass a folder: https://blog.yaakov.online/failed-experiment-what-processes-have-a-lock-on-this-folder/

Update: here's some sample code of how to use the restart manager API: https://github.com/dotnet/msbuild/blob/main/src/Utilities/LockCheck.cs

Upvotes: 4

emaditaj
emaditaj

Reputation: 177

RmGetList will return error 5 if any higher level thing like a file system fillter block the file the driver filter denies access to file xxx from any process and function whether windows kernel or user code tries to access it it does the same with restart manager , restart manger tries to access the file , the driver throws error 5 , the restart manager wont know what to do with it ,and rethrows it back to calling function ,so you'll get a access denied

if you are trying it for all files in windows volume, there will be much files with throwing error 5, including 3rd parity antivirus files or ms defender or ...

simply use a try catch and ignore them because even if you know what pid is locking them you couldn't do anything about it, other than watching

it also happens if you don't have even read access to the locked file ,in this case try fixing security permotions and trying again

Upvotes: 2

Related Questions