Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

Restore fileobject from deviceobject

Aleksey_GAleksey_G Member - All Emails Posts: 11

Hello, everyone.

Into DriverEntry(...) function I can get DRIVER_OBJECT and DEVICE_OBJECT structures. But I need to get FILE_OBJECT to retrieve full path from started driver. Yes, I can read registry of my driver and I can read ImagePath key to get full path, but I want do it by another way. If someone faced this challenge, could you get me a hint to solve it?

Comments

  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,112

    What do you want to do if your driver has been started before there is a filesystem?

  • Aleksey_GAleksey_G Member - All Emails Posts: 11
    edited March 2

    It is a good question! I think it is a callback where I can get file object. But I don`t know it, while... For example InstanceSetupCallback, but it fires always then a volume is mounted. But I need fill my struct once (full path of started driver). I can process first call of InstanceSetupCallback, is it correct?

    Post edited by Aleksey_G on
  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,112

    I can process first call of InstanceSetupCallback, is it correct?

    Right. It might get a wee bit incestuous since the first instance set up is often MUP and your create might cause you to be called up again.

    I also have a vague memory that there is a standard callback that you register for in driver entry which will call you back once everything is "up and running" (for some definition of 'up and running'). I'm hoping that someone else will remind me.

    So winding back, to be honest what I would do would be to ask the registry about ImagePath and then open that. Why is that not possible?

  • Don_BurnDon_Burn Member - All Emails Posts: 1,677

    Rod is thinking of IoRegisterBootDriverReinitialization this allows a boot driver to get called when all devices have been initialized.

  • Aleksey_GAleksey_G Member - All Emails Posts: 11

    I agree with rod, I will try to get driver full path throw registry ImagePath key. But could you explain, please, if I will use IoRegisterBootDriverReinitialization function, how can I get driver path? I read description of IoRegisterBootDriverReinitialization function and callback function. Just DRIVER_OBJECT struct is available, no FILE_OBJECT...

  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,112

    If it were me I’d save the path away somewhere during driver init.

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 20 Apr 2020 LIVE ONLINE
Writing WDF Drivers 11 May 2020 LIVE ONLINE
Internals & Software Drivers 28 Sept 2020 Dulles, VA