The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
I am working on a driver component which will take a DOS path (i.e.
C:\Windows\foo.exe) and convert it to the NT/Device path (i.e.
\Device\HardDiskVolume3\Windows\foo.exe). To do this, I am trying to use the standard
ZwQuerySymbolicLinkObject flow. When calling
ZwOpenSymbolicLinkObject, I am getting a
I have minimized the issue to demonstrate what is going on in the following code snippet. Please note that this is not my production code so there is no error checking, etc.
NTSTATUS status; UNICODE_STRING symlinkName; OBJECT_ATTRIBUTES attributes; HANDLE hSymlink; // Initialize the name with some value RtlInitUnicodeString(&symlinkName, L"\??\C:\Windows\explorer.exe"); InitializeObjectAttributes(&attributes, &symlinkName, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, NULL); status = ZwOpenSymbolicLinkObject(&hSymlink, GENERIC_READ, &attributes); // At this point, status is 0xC0000024 < snip >
This seems like the correct way to call this API based on public examples and other posts on this forum, but I can't seem to figure out what is going on. Any help or pointers would be much appreciated.
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!|
|Internals & Software Drivers||15 November 2021||Live, Online|
|Writing WDF Drivers||24 January 2022||Live, Online|
|Developing Minifilters||7 February 2022||Live, Online|
|Kernel Debugging||21 March 2022||Live, Online|