We encountered a issue while attempting to retrieve the file object's
path name associated with process section object after renaming the
folder that contains the executable image.
File System: NTFS
OS: seems like all x32 NT based (2000, XP, 2003 & their SP)
Steps to reproduce:
1. Create a new folder named "1" on disk (for example, C:)
2. Copy any executable file (e.g., "test.exe") to the created folder.
3. Execute this application.
4. Exit from this application (e.g., "test.exe").
5. Rename folder "1" to another name (for example, "2").
6. Execute the application located in this folder ("2\test.exe") that
was executed at step 3.
What did we get?
The new process is successfully running, however we can't get the
correct path name for the section object associated with this process,
and also we got the incorrect path name in the
PsSetLoadImageNotifyRoutine callback routine (see below example #4).
As a result of querying the path name of process section we got:
Instead of expected:
We tried the different methods of getting the path name for the
section object associated with the process. All methods, except the
reading PEB give the incorrect path name:(
get section for process executable image
PFILE_OBJECT pSectionFile =
Use IoQueryFileInformation for file object associated with process
use ObOpenObjectByName AND ZwQueryInformationFile for this file object
Direct scan file object fields and get file path name.
IN PUNICODE_STRING FullImageName,
IN HANDLE ProcessId,
IN PIMAGE_INFO ImageInfo)
KdPrint(("Load image: %ws\n", FullImageName->Buffer));
IN PDRIVER_OBJECT pDriverObject,
IN PUNICODE_STRING pRegistryPath)
Basing on PDB information (ntoskrnl.exe) the unexported function
MmGetFileNameForSection that is called
before executing load-image callback routine got the invalid path name
What can anybody say on this matter?
ISV System Safety Ltd.http://www.syssafety.com