Re: How to get drive letter from device object/ device name in kernel mode

Hi All,

That will teach to me never reply when you’re in a hurry.
I missed crucial the “from kernel” bit :frowning:

Said that, on my windows 2000 machine most of the ??\X:
symbolic links have disappeared. I’ve got drives C till F
but only D: shows up in ??

cheers,
Peter

Prasad Dabak wrote:

Hello,

QueryDosDevice is a user mode WIN32 API function and
is not callable from kernel mode.

One needs to query the symbolic link objects ??\A:,
??\C:, ??\D: and so on using the Native APIs
ZwOpenSymbolicLinkObject and
ZwQuerySymbolicLinkObject.

-Prasad

— Peter van Sebille
> wrote:
> > Hi,
> >
> > Given a dos drive letter, QueryDosDevice returns the
> > NT device
> > name. Call it for the 26 possible dos drives and
> > search for a match.
> >
> > cheers,
> > Peter
> >
> > ssreejit@in.ibm.com wrote:
> > >
> > > Hi folks,
> > > Could anybody tell me how to get the drive
> > letter from device object
> > > or device name from the kernel mode.
> > > Regards,
> > > Sreejith S R
> > > IBM Global Services Pvt. Ltd.
> > > Golden Enclave, Airport Road,
> > > Bangalore -17
> > >
> > > Phone : 91-80-526 2355/7117 ext: 3024
> > > Fax : 91-80-527 7374
> > >
> > > —
> > > You are currently subscribed to ntfsd as:
> > xxxxx@yipton.demon.co.uk
> > > To unsubscribe send a blank email to
> > $subst(‘Email.Unsub’)
> >
> > —
> > You are currently subscribed to ntfsd as:
> > xxxxx@yahoo.com
> > To unsubscribe send a blank email to
> > $subst(‘Email.Unsub’)
> >
> >
>
> =====
> Prasad S. Dabak
> Director of Engineering, Windows NT/2000 Division
> Cybermedia Software Private Limited
> http://www.cybermedia.co.in
> Co-author of the book “Undocumented Windows NT”
> ISBN 0764545698
>
> __________________________________________________
> Do You Yahoo!?
> Talk to your friends online with Yahoo! Messenger.
> http://im.yahoo.com
>
> —
> You are currently subscribed to ntfsd as: xxxxx@yipton.demon.co.uk
> To unsubscribe send a blank email to $subst(‘Email.Unsub’)