Restore fileobject from deviceobject

Hello, everyone.

Into DriverEntry(…) function I can get DRIVER_OBJECT and DEVICE_OBJECT structures. But I need to get FILE_OBJECT to retrieve full path from started driver. Yes, I can read registry of my driver and I can read ImagePath key to get full path, but I want do it by another way. If someone faced this challenge, could you get me a hint to solve it?

What do you want to do if your driver has been started before there is a filesystem?

It is a good question! I think it is a callback where I can get file object. But I don`t know it, while… For example InstanceSetupCallback, but it fires always then a volume is mounted. But I need fill my struct once (full path of started driver). I can process first call of InstanceSetupCallback, is it correct?

I can process first call of InstanceSetupCallback, is it correct?

Right. It might get a wee bit incestuous since the first instance set up is often MUP and your create might cause you to be called up again.

I also have a vague memory that there is a standard callback that you register for in driver entry which will call you back once everything is “up and running” (for some definition of ‘up and running’). I’m hoping that someone else will remind me.

So winding back, to be honest what I would do would be to ask the registry about ImagePath and then open that. Why is that not possible?

1 Like

Rod is thinking of IoRegisterBootDriverReinitialization this allows a boot driver to get called when all devices have been initialized.

1 Like

I agree with rod, I will try to get driver full path throw registry ImagePath key. But could you explain, please, if I will use IoRegisterBootDriverReinitialization function, how can I get driver path? I read description of IoRegisterBootDriverReinitialization function and callback function. Just DRIVER_OBJECT struct is available, no FILE_OBJECT…

If it were me I’d save the path away somewhere during driver init.