1. Use the FSCTL_GET_VOLUME_BITMAP control code to find a place on the volume that is large enough to accept an entire file.
Note If necessary, move other files to make a place that is large enough. Ideally, there is enough unallocated clusters after the first extent of the file that you can move subsequent extents into the space after the first extent.
2. Use the FSCTL_GET_RETRIEVAL_POINTERS control code to get a map of the current layout of the file on the disk.
3. Walk the RETRIEVAL_POINTERS_BUFFER structure returned by FSCTL_GET_RETRIEVAL_POINTERS.
4. Use the FSCTL_MOVE_FILE control code to move each cluster as you walk the structure.
Note You may need to renew either the bitmap or the retrieval structure, or both at various times as other processes write to the disk.
"
Right before that crash, terminal output shows:
fixme:ntdll:server_ioctl_file Unsupported ioctl 90073 (device=9 access=0 func=1c method=3)
...
fixme:ntdll:server_ioctl_file Unsupported ioctl 90073 (device=9 access=0 func=1c method=3)
90073 is FSCTL_GET_RETRIEVAL_POINTERS.
Looking at a +file, it seems Adobe Reader is installing a file, then trying to defrag it:
trace:file:CreateFileW L"C:\\Program Files\\Adobe\\Reader 9.0\\Reader\\acrord32.dll" GENERIC_READ FILE_SHARE_READ FILE_SHARE_WRITE creation 3 attributes 0x20000000
...
trace:file:CreateFileW returning 0xb8
trace:file:DeviceIoControl (0xb8,90073,0xb3e35c,8,0xb47448,8204,0xb3e348,(nil))
fixme:ntdll:server_ioctl_file Unsupported ioctl 90073 (device=9 access=0 func=1c method=3)
It seems it's trying to defragment. Looking at MSDN: msdn.microsoft. com/en- us/library/ aa363911% 28VS.85% 29.asp
http://
"
To defragment a file
1. Use the FSCTL_GET_ VOLUME_ BITMAP control code to find a place on the volume that is large enough to accept an entire file.
Note If necessary, move other files to make a place that is large enough. Ideally, there is enough unallocated clusters after the first extent of the file that you can move subsequent extents into the space after the first extent. RETRIEVAL_ POINTERS control code to get a map of the current layout of the file on the disk. POINTERS_ BUFFER structure returned by FSCTL_GET_ RETRIEVAL_ POINTERS.
2. Use the FSCTL_GET_
3. Walk the RETRIEVAL_
4. Use the FSCTL_MOVE_FILE control code to move each cluster as you walk the structure.
Note You may need to renew either the bitmap or the retrieval structure, or both at various times as other processes write to the disk.
"
Right before that crash, terminal output shows: server_ ioctl_file Unsupported ioctl 90073 (device=9 access=0 func=1c method=3) server_ ioctl_file Unsupported ioctl 90073 (device=9 access=0 func=1c method=3)
fixme:ntdll:
...
fixme:ntdll:
90073 is FSCTL_GET_ RETRIEVAL_ POINTERS.
Looking at a +file, it seems Adobe Reader is installing a file, then trying to defrag it: CreateFileW L"C:\\Program Files\\ Adobe\\ Reader 9.0\\Reader\ \acrord32. dll" GENERIC_READ FILE_SHARE_READ FILE_SHARE_WRITE creation 3 attributes 0x20000000 CreateFileW returning 0xb8 DeviceIoControl (0xb8,90073, 0xb3e35c, 8,0xb47448, 8204,0xb3e348, (nil)) server_ ioctl_file Unsupported ioctl 90073 (device=9 access=0 func=1c method=3)
trace:file:
...
trace:file:
trace:file:
fixme:ntdll:
More info on FSCTL_GET_ RETRIEVAL_ POINTERS here: www.wd- 3.com/archive/ luserland. htm
http://
I tried a quick hack: END_REQ;
diff --git a/dlls/ntdll/file.c b/dlls/ntdll/file.c
index b5d1c14..393bd4d 100644
--- a/dlls/ntdll/file.c
+++ b/dlls/ntdll/file.c
@@ -1243,6 +1243,12 @@ static NTSTATUS server_ioctl_file( HANDLE handle, HANDLE event,
}
SERVER_
+ if (code == FSCTL_GET_ RETRIEVAL_ POINTERS) FSCTL_GET_ RETRIEVAL_ POINTERS is a stub.\n"); NOT_SUPPORTED)
FIXME( "Unsupported ioctl %x (device=%x access=%x func=%x method=%x)\n",
code, code >> 16, (code >> 14) & 3, (code >> 2) & 0xfff, code & 3);
+ {
+ FIXME("
+ return STATUS_SUCCESS;
+ }
+
if (status == STATUS_
returning different statuses (NOT_IMPLEMENTED, ACCESS_DENIED, etc.), but no luck. Seems it'll need something with a bit more meat.