http://valinet6l6tq6d5yohaa6gdsf2ho4qcqcxyj2nahp5kd4z7nsa6ycdqd.onion/2022/08/29/Working-with-shadow-copies-is-kind-of-broken-on-Windows-11-22H2.html
Status ; } if ( rv ) { printf ( "NtFsControlFile (NTSTATUS): 0x%x \n " , rv ); return 0 ; } printf ( "%d %d %d \n " , buff2 [ 0 ], buff2 [ 1 ], buff2 [ 2 ]); Okay, so maybe the entire call is broken altogether. Indeed, if we craft a replacement for NtFsControlFile when FsControlCode set to FSCTL_GET_SHADOW_COPY_DATA that uses the Volume Shadow Service APIs instead of this device IO control call and run the program as administrator, we indeed get the...