How to obtain drive letter from a device object?

OSR_Community_User

I use a Rajeev Nagar's like Filter and in SFilterAttachTarget I want to get
the drive letter (if possible ) which corresponds to
PtrTargetDeviceObject.How can I do that?(In fact how can I obtain a name
for a DEVICE_OBJECT?I use IoGetDeviceObjectPointer but it beheave
strange.Do u know other ways?)

OSR_Community_User

To get object Name, somebody told me to use ObQueryNameString, but I
couldn't link my driver to that function and to get drive letter you could
use ZwOpenSymbolicLinkObject and ZwQuerySymbolicLinkObject, but I
couldn't link link to them neither. So by this way I am asking whether
somebody knows why I can't link to this functions?

On Mon, 15 May 2000 [email protected] wrote:

> I use a Rajeev Nagar's like Filter and in SFilterAttachTarget I want to get
> the drive letter (if possible ) which corresponds to
> PtrTargetDeviceObject.How can I do that?(In fact how can I obtain a name
> for a DEVICE_OBJECT?I use IoGetDeviceObjectPointer but it beheave
> strange.Do u know other ways?)
>
> ---
> You are currently subscribed to ntfsd as: [email protected]
> To unsubscribe send a blank email to $subst('Email.Unsub')
>

OSR_Community_User

Hello,

There shouldn't be any problem linking to these
functions.
They are all exported by NTOSKRNL.EXE. Just declare
the
prototypes as follows and you can use it.

typedef struct ObjectNameInfo_t {
UNICODE_STRING ObjectName;
WCHAR ObjectNameBuffer[1];
} OBJECT_NAME_INFO, *POBJECT_NAME_INFO;

NTSYSAPI
NTSTATUS
NTAPI
ObQueryNameString(PVOID pObject,
POBJECT_NAME_INFO pObjectNameBuffer,
ULONG pObjectNameBufferSize,
PULONG BytesReturned);

NTSYSAPI
NTSTATUS
NTAPI
ZwOpenSymbolicLinkObject(
OUT PHANDLE hSymbolicLink,
IN ACCESS_MASK AccessMask,
IN POBJECT_ATTRIBUTES ObjectAttributes
);

NTSYSAPI
NTSTATUS
NTAPI
ZwQuerySymbolicLinkObject(
IN HANDLE hSymbolicLink,
IN OUT PUNICODE_STRING ObjectName,
OUT PULONG BytesReturned
);


Note: For using ObQueryNameString function.

Make sure that you pass sufficient size buffer.

e.g

char Buffer[1024];
NTSTATUS rc;
ULONG BytesReturned;
POBJECT_NAME_INFO pObjectNameBuffer;

pObjectNameBuffer=(POBJECT_NAME_INFO)Buffer;
rc=ObQueryNameString(pObject,
pObjectNameBuffer,
sizeof(Buffer),
&BytesReturned);

If the size of the buffer is insufficient, the
function will
return STATUS_INFO_LENGTH_MISMATCH and BytesReturned
will
contain size of the buffer required to hold the name.
You
can pass pObjectNameBufferSize value of 0 to find out
the
buffer size requirements dynamically.

Alternatively, if you have handle to the object
instead of
pointer to object, you can use NtQueryObject function
with
information class 1.

-Prasad



--- Ratmil Torres Vargas <[email protected]>
wrote:
> To get object Name, somebody told me to use
> ObQueryNameString, but I
> couldn't link my driver to that function and to get
> drive letter you could
> use ZwOpenSymbolicLinkObject and
> ZwQuerySymbolicLinkObject, but I
> couldn't link link to them neither. So by this way I
> am asking whether
> somebody knows why I can't link to this functions?
>
>
> On Mon, 15 May 2000 [email protected] wrote:
>
> > I use a Rajeev Nagar's like Filter and in
> SFilterAttachTarget I want to get
> > the drive letter (if possible ) which corresponds
> to
> > PtrTargetDeviceObject.How can I do that?(In fact
> how can I obtain a name
> > for a DEVICE_OBJECT?I use IoGetDeviceObjectPointer
> but it beheave
> > strange.Do u know other ways?)
> >
> > ---
> > You are currently subscribed to ntfsd as:
> [email protected]
> > To unsubscribe send a blank email to
> $subst('Email.Unsub')
> >
>
>
>
> ---
> You are currently subscribed to ntfsd as:
> [email protected]
> To unsubscribe send a blank email to
> $subst('Email.Unsub')
>


=====
Prasad S. Dabak
Director of Engineering, Windows NT/2000 Division
Cybermedia Software Private Limited
http://www.cybermedia.co.in
Co-author of the book "Undocumented Windows NT"
ISBN 0764545698

__________________________________________________
Do You Yahoo!?
Send instant messages & get email alerts with Yahoo! Messenger.
http://im.yahoo.com/