how to get current process image path from mini-filter kernel driver?

NTFSD
1

I want to get current process path in my mini-filter kernel driver.I can get current process with PEPROCESS peProcess = IoGetCurrentProcess() and can get process full filename(that include path) with ZwQueryInformationProcess. But i want just get path (without filename). I use visualstudio 2019 & latest SDK/WDK.Could anyone get me some working code for getting current process path?

2

Could you perhaps parse the name yourself? Work back from the end until you get a back slash? Is that too obvious?

1 Like
3

Try FltParseFileName https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/fltkernel/nf-fltkernel-fltparsefilename

2 Likes