{"action":"created","issue":{"url":"https://api.github.com/repos/dokan-dev/dokany/issues/391","repository_url":"https://api.github.com/repos/dokan-dev/dokany","labels_url":"https://api.github.com/repos/dokan-dev/dokany/issues/391/labels{/name}","comments_url":"https://api.github.com/repos/dokan-dev/dokany/issues/391/comments","events_url":"https://api.github.com/repos/dokan-dev/dokany/issues/391/events","html_url":"https://github.com/dokan-dev/dokany/issues/391","id":187503371,"number":391,"title":"mirror.exe without administrative privileges, running executables","user":{"login":"Nekotekina","id":6028184,"avatar_url":"https://avatars.githubusercontent.com/u/6028184?v=3","gravatar_id":"","url":"https://api.github.com/users/Nekotekina","html_url":"https://github.com/Nekotekina","followers_url":"https://api.github.com/users/Nekotekina/followers","following_url":"https://api.github.com/users/Nekotekina/following{/other_user}","gists_url":"https://api.github.com/users/Nekotekina/gists{/gist_id}","starred_url":"https://api.github.com/users/Nekotekina/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Nekotekina/subscriptions","organizations_url":"https://api.github.com/users/Nekotekina/orgs","repos_url":"https://api.github.com/users/Nekotekina/repos","events_url":"https://api.github.com/users/Nekotekina/events{/privacy}","received_events_url":"https://api.github.com/users/Nekotekina/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-11-05T15:28:49Z","updated_at":"2016-11-05T16:18:34Z","closed_at":null,"body":"Hi, I'm experimenting with Dokan. If I run mirror.exe without administrator privileges, trying to run any simple executable from the mounted drive fails with the error 0xC000000D (STATUS_INVALID_PARAMETER). OS: Windows 7 SP1 x64. Executables I tried don't require any privileges.\r\n\r\nThe questions are (not strictly related to mirror.exe):\r\n1) Why this happens and is it possible to modify mirror sample to fix it?\r\n2) Is it generally possible to run unprivileged executables from virtual filesystems without NTFS features?\r\n#132 seems very related but I failed to find exact answers."},"comment":{"url":"https://api.github.com/repos/dokan-dev/dokany/issues/comments/258621934","html_url":"https://github.com/dokan-dev/dokany/issues/391#issuecomment-258621934","issue_url":"https://api.github.com/repos/dokan-dev/dokany/issues/391","id":258621934,"user":{"login":"Nekotekina","id":6028184,"avatar_url":"https://avatars.githubusercontent.com/u/6028184?v=3","gravatar_id":"","url":"https://api.github.com/users/Nekotekina","html_url":"https://github.com/Nekotekina","followers_url":"https://api.github.com/users/Nekotekina/followers","following_url":"https://api.github.com/users/Nekotekina/following{/other_user}","gists_url":"https://api.github.com/users/Nekotekina/gists{/gist_id}","starred_url":"https://api.github.com/users/Nekotekina/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Nekotekina/subscriptions","organizations_url":"https://api.github.com/users/Nekotekina/orgs","repos_url":"https://api.github.com/users/Nekotekina/repos","events_url":"https://api.github.com/users/Nekotekina/events{/privacy}","received_events_url":"https://api.github.com/users/Nekotekina/received_events","type":"User","site_admin":false},"created_at":"2016-11-05T16:18:34Z","updated_at":"2016-11-05T16:18:34Z","body":"In Dokan logs, there is no such status. This must be process exit status, from Procmon:\r\n\r\n19:05:58,5776677\tClockres.exe\t11908\tProcess Start\t\tSUCCESS\tParent PID: 2408\r\n19:05:58,5776710\tClockres.exe\t11908\tThread Create\t\tSUCCESS\tThread ID: 10940\r\n19:05:58,5916653\tClockres.exe\t11908\tLoad Image\tC:\\Windows\\System32\\ntdll.dll\tSUCCESS\tImage Base: 0x76ec0000, Image Size: 0x1aa000\r\n19:05:58,5919298\tClockres.exe\t11908\tLoad Image\tC:\\Windows\\SysWOW64\\ntdll.dll\tSUCCESS\tImage Base: 0x770a0000, Image Size: 0x180000\r\n19:05:58,5920283\tClockres.exe\t11908\tCreateFile\tC:\\Windows\\Prefetch\\CLOCKRES.EXE-7D8C1BA1.pf\tNAME NOT FOUND\tDesired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: None, AllocationSize: n/a\r\n19:05:58,5920566\tClockres.exe\t11908\tThread Exit\t\tSUCCESS\tThread ID: 10940, User Time: 0.0000000, Kernel Time: 0.0000000\r\n19:05:58,5920710\tClockres.exe\t11908\tQueryNameInformationFile\tC:\\Windows\\System32\\apisetschema.dll\tSUCCESS\tName: \\Windows\\System32\\apisetschema.dll\r\n19:05:58,5920876\tClockres.exe\t11908\tQueryNameInformationFile\t\\Device\\Volume{d6cc17c5-1714-4085-bce7-964f1e9f5de9}\\Clockres.exe\tSUCCESS\tName: \\Clockres.exe\r\n19:05:58,5921033\tClockres.exe\t11908\tQueryNameInformationFile\tC:\\Windows\\System32\\ntdll.dll\tSUCCESS\tName: \\Windows\\System32\\ntdll.dll\r\n19:05:58,5921156\tClockres.exe\t11908\tQueryNameInformationFile\tC:\\Windows\\SysWOW64\\ntdll.dll\tSUCCESS\tName: \\Windows\\SysWOW64\\ntdll.dll\r\n19:05:58,5924243\tClockres.exe\t11908\tProcess Exit\t\tSUCCESS\tExit Status: -1073741811, User Time: 0.0000000 seconds, Kernel Time: 0.0000000 seconds, Private Bytes: 397 312, Peak Private Bytes: 397 312, Working Set: 245 760, Peak Working Set: 245 760\r\n"}}
{"actor":{"display_login":"Nekotekina"}}