How to obtain drive letter from a device object?

NTFSD
1

I use a Rajeev Nagar’s like Filter and in SFilterAttachTarget I want to get
the drive letter (if possible ) which corresponds to
PtrTargetDeviceObject.How can I do that?(In fact how can I obtain a name
for a DEVICE_OBJECT?I use IoGetDeviceObjectPointer but it beheave
strange.Do u know other ways?)

2

To get object Name, somebody told me to use ObQueryNameString, but I
couldn’t link my driver to that function and to get drive letter you could
use ZwOpenSymbolicLinkObject and ZwQuerySymbolicLinkObject, but I
couldn’t link link to them neither. So by this way I am asking whether
somebody knows why I can’t link to this functions?

On Mon, 15 May 2000 xxxxx@excite.com wrote:

I use a Rajeev Nagar’s like Filter and in SFilterAttachTarget I want to get
the drive letter (if possible ) which corresponds to
PtrTargetDeviceObject.How can I do that?(In fact how can I obtain a name
for a DEVICE_OBJECT?I use IoGetDeviceObjectPointer but it beheave
strange.Do u know other ways?)

You are currently subscribed to ntfsd as: xxxxx@ghost.matcom.uh.cu
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

3

Hello,

There shouldn’t be any problem linking to these
functions.
They are all exported by NTOSKRNL.EXE. Just declare
the
prototypes as follows and you can use it.

typedef struct ObjectNameInfo_t {
UNICODE_STRING ObjectName;
WCHAR ObjectNameBuffer[1];
} OBJECT_NAME_INFO, *POBJECT_NAME_INFO;

NTSYSAPI
NTSTATUS
NTAPI
ObQueryNameString(PVOID pObject,
POBJECT_NAME_INFO pObjectNameBuffer,
ULONG pObjectNameBufferSize,
PULONG BytesReturned);

NTSYSAPI
NTSTATUS
NTAPI
ZwOpenSymbolicLinkObject(
OUT PHANDLE hSymbolicLink,
IN ACCESS_MASK AccessMask,
IN POBJECT_ATTRIBUTES ObjectAttributes
);

NTSYSAPI
NTSTATUS
NTAPI
ZwQuerySymbolicLinkObject(
IN HANDLE hSymbolicLink,
IN OUT PUNICODE_STRING ObjectName,
OUT PULONG BytesReturned
);

Note: For using ObQueryNameString function.

Make sure that you pass sufficient size buffer.

e.g

char Buffer[1024];
NTSTATUS rc;
ULONG BytesReturned;
POBJECT_NAME_INFO pObjectNameBuffer;

pObjectNameBuffer=(POBJECT_NAME_INFO)Buffer;
rc=ObQueryNameString(pObject,
pObjectNameBuffer,
sizeof(Buffer),
&BytesReturned);

If the size of the buffer is insufficient, the
function will
return STATUS_INFO_LENGTH_MISMATCH and BytesReturned
will
contain size of the buffer required to hold the name.
You
can pass pObjectNameBufferSize value of 0 to find out
the
buffer size requirements dynamically.

Alternatively, if you have handle to the object
instead of
pointer to object, you can use NtQueryObject function
with
information class 1.

-Prasad

— Ratmil Torres Vargas
wrote:
> To get object Name, somebody told me to use
> ObQueryNameString, but I
> couldn’t link my driver to that function and to get
> drive letter you could
> use ZwOpenSymbolicLinkObject and
> ZwQuerySymbolicLinkObject, but I
> couldn’t link link to them neither. So by this way I
> am asking whether
> somebody knows why I can’t link to this functions?
>
>
> On Mon, 15 May 2000 xxxxx@excite.com wrote:
>
> > I use a Rajeev Nagar’s like Filter and in
> SFilterAttachTarget I want to get
> > the drive letter (if possible ) which corresponds
> to
> > PtrTargetDeviceObject.How can I do that?(In fact
> how can I obtain a name
> > for a DEVICE_OBJECT?I use IoGetDeviceObjectPointer
> but it beheave
> > strange.Do u know other ways?)
> >
> > —
> > You are currently subscribed to ntfsd as:
> xxxxx@ghost.matcom.uh.cu
> > To unsubscribe send a blank email to
> $subst(‘Email.Unsub’)
> >
>
>
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
> $subst(‘Email.Unsub’)
>

=====
Prasad S. Dabak
Director of Engineering, Windows NT/2000 Division
Cybermedia Software Private Limited
http://www.cybermedia.co.in
Co-author of the book “Undocumented Windows NT”
ISBN 0764545698

__________________________________________________
Do You Yahoo!?
Send instant messages & get email alerts with Yahoo! Messenger.
http://im.yahoo.com/