Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.More Info on Driver Writing and Debugging
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Object paths
Don_Burn_1
Member Posts: 4,311
in NTDEV
Is there anyway given an object pointer or handle to resolve
it to the path to the object? I know about NtQueryObject
which will get the name, but I am looking for the full path,
or at least an indication of the directory it resides in so that
the path can be resolved.
Don Burn
it to the path to the object? I know about NtQueryObject
which will get the name, but I am looking for the full path,
or at least an indication of the directory it resides in so that
the path can be resolved.
Don Burn
Howdy, Stranger!
| Upcoming OSR Seminars | ||
|---|---|---|
| OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
| Kernel Debugging | 30 January 2023 | Live, Online |
| Developing Minifilters | 20 March 2023 | Live, Online |
| Internals & Software Drivers | 17 April 2023 | Live, Online |
| Writing WDF Drivers | 22 May 2023 | Live, Online |
Comments
I believe NtQueryObject information class 1 returns
complete path of the object.
-Prasad
--- Don Burn <[email protected]> wrote:
> Is there anyway given an object pointer or handle to
> resolve
> it to the path to the object? I know about
> NtQueryObject
> which will get the name, but I am looking for the
> full path,
> or at least an indication of the directory it
> resides in so that
> the path can be resolved.
>
> Don Burn
>
>
>
> ---
> You are currently subscribed to ntdev as:
> [email protected]
> To unsubscribe send a blank email to
> $subst('Email.Unsub')
>
>
=====
Prasad S. Dabak
Director of Engineering, Windows NT/2000 Division
Cybermedia Software Private Limited
http://www.cybermedia.co.in
Co-author of the book "Undocumented Windows NT"
ISBN 0764545698
__________________________________________________
Do You Yahoo!?
Talk to your friends online with Yahoo! Messenger.
http://im.yahoo.com
ObQueryNameString should do what you want, Documented in the 2000 DDK.
Duncan
> -----Original Message-----
> From: Don Burn [mailto:[email protected]]
> Sent: 09 March 2000 18:46
> To: NT Developers Interest List
> Subject: [ntdev] Object paths
>
>
> Is there anyway given an object pointer or handle to resolve
> it to the path to the object? I know about NtQueryObject
> which will get the name, but I am looking for the full path,
> or at least an indication of the directory it resides in so that
> the path can be resolved.
>
> Don Burn
>
>
>
> ---
> You are currently subscribed to ntdev as: [email protected]
> To unsubscribe send a blank email to $subst('Email.Unsub')
>
Sent: Friday, March 10, 2000 4:46 AM
> Don,
>
> ObQueryNameString should do what you want, Documented in the 2000 DDK.
[snip]
Hmm, I too am interested in this function, but cannot find it documented in
my copy of the Windows 2000 DDK, nor online at Microsoft's site.
Are you sure your naming is correct? I tried looking for other variations,
but still couldn't find anything. Can you point me to pricisely where you
saw this function documented?
Alternately, can anybody provide with another technique for retreiving a
DEVICE_OBJECT's name given a pointer to the DEVICE_OBJECT?
Regards,
Matt Arnold
Professional Music Products
Mark of the Unicorn, Inc.
http://www.motu.com
NTSTATUS
ObQueryNameString (
IN PVOID Object,
OUT POBJECT_NAME_INFORMATION ObjectNameInfo,
IN ULONG Length,
OUT PULONG ReturnLength
);
typedef struct _OBJECT_NAME_INFORMATION {
UNICODE_STRING Name;
} OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;
It is defined in NTIFS.H. I am using it in my filter driver and it does
exactly what you want. It is exported from NTOSKRNL.EXE in both Windows NT
4.0 and Windows 2000. It works fine in both, although I have not done much
testing yet.
Duncan
> Hmm, I too am interested in this function, but cannot find it
> documented in
> my copy of the Windows 2000 DDK, nor online at Microsoft's site.
>
> Are you sure your naming is correct? I tried looking for
> other variations,
> but still couldn't find anything. Can you point me to
> pricisely where you
> saw this function documented?
>
> Alternately, can anybody provide with another technique for
> retreiving a
> DEVICE_OBJECT's name given a pointer to the DEVICE_OBJECT?
>
>
> Regards,
>
> Matt Arnold
> Professional Music Products
> Mark of the Unicorn, Inc.
> http://www.motu.com
kit.
BTW, I know ObQueryNameString() is not in "wdm.h", but do you happen to know
if ObQueryNameString() can be used by WDM drivers running on Windows 98?
ObQueryNameString() is listed in the NtOsKrnl.lib import library that comes
with the Windows 98 DDK, but perhaps that means nothing.
Regards,
Matt Arnold
Professional Music Products
Mark of the Unicorn, Inc.
http://www.motu.com
To: "NT Developers Interest List" <[email protected]>
Sent: Wednesday, March 15, 2000 3:50 AM
> This comes from the Win 2000 DDK that comes on the Win 2000 IFS Kit CD.
[snip]
> DDK, not the IFS
> kit.
Sounds like it.. But you can still use it.. using the function def and the
lib that comes with the DDK.
> BTW, I know ObQueryNameString() is not in "wdm.h", but do you
> happen to know
> if ObQueryNameString() can be used by WDM drivers running on
> Windows 98?
There is no mention of ObQueryNameString in any file on Windows 98.. Anyway
I didn't think there was an object directory on Windows 98..
> ObQueryNameString() is listed in the NtOsKrnl.lib import
> library that comes with the Windows 98 DDK, but perhaps that means
nothing.
You never know, most of the things you need to build a useful filter driver
on NT are undoc. and the same goes for a lot of other things
Duncan
> not the IFS
> kit.
You can use ObQueryNameString() when you're using the ntifs.h
header that can be found on http://www.acc.umu.se/~bosse/ntifs.h
or you query the address via name with MmGetSystemRoutineAddress.
> BTW, I know ObQueryNameString() is not in "wdm.h", but do you
> happen to know
> if ObQueryNameString() can be used by WDM drivers running on Windows 98?
AFAIK, it is not possible to use ObQueryNameString() under Win98.
Beside that MmGetSystemRoutineAddress isn't neither availabe under Win98 :-(
> ObQueryNameString() is listed in the NtOsKrnl.lib import library
> that comes
> with the Windows 98 DDK, but perhaps that means nothing.
It possibly is in NtOsKrnl.lib, because you could use this lib also to
build NT KMDs.
Regards,
Carsten