-1

I want read MFT table with Windows API, but ReadFile API retrns ERROR_ACCESS_DENIED. I already run as admin. Here is my code:

invoke CreateFileA,addr MFT,FILE_READ_ATTRIBUTES,FILE_SHARE_READ,0,3,FILE_FLAG_RANDOM_ACCESS or FILE_FLAG_NO_BUFFERING,0
invoke ReadFile,eax,ADDR buf1,512,AddR readed,0
ret

Why ReadFile returns access denied error?

Marc
  • 19,394
  • 6
  • 47
  • 51
Bruno G. S.
  • 1
  • 3
  • there's no `invoke` instruction in x86 assembly. Probably you want .NET? – phuclv Jan 15 '18 at 10:41
  • THERE IS INVOKE on MASM x86 assembly. Don't say what you don't have knowledge! – Bruno G. S. Jan 15 '18 at 10:45
  • 1
    hey you're the one that's being wrong here. You didn't tag the correct necessary tags and `invoke` is **not an x86 instruction** in any sense, go looking at the Intel manual. It's an [MASM-specific directive](https://support.microsoft.com/en-us/help/73407/using-proto-and-invoke-to-call-a-c-function-from-masm) – phuclv Jan 15 '18 at 10:49
  • 1
    I already said that INVOKE is a MASM directive but you misunderstood me! – Bruno G. S. Jan 15 '18 at 11:11
  • 1
    Possible duplicate of [Opening $MFT file causes Access denied even if run as administrator](https://stackoverflow.com/questions/19499257/opening-mft-file-causes-access-denied-even-if-run-as-administrator) – RbMm Jan 15 '18 at 19:39

1 Answers1

0

You have opened the file with FILE_READ_ATTRIBUTES, when ReadFile needs at least FILE_READ_DATA. Maybe try FILE_GENERIC_READ in CreateFile.

Cheers,
Gabriel

Gabriel Bercea
  • 1,191
  • 1
  • 10
  • 21