Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Hi there!
I am dealing with a requirement that I need to get the current working directory of a running process from the context of a pre operation callback of a minifilter, so I was thinking if there is a way of getting this information without using PEB
stuff maybe just by using documented and no opaque things. By using PEB
is complicated because of the lack of backward compatibility, in my state of things, for example, my winternl.h
does not define DLCurrentDirectory
as people expects on their proposed solutions out there.
My feeling with this initial incompatibility even at compile time is something like the compiler screaming "do not use opaque stuff, avoid future headaches, find a better general solution". Thus, I would appreciate any tip, clue or help. Have anyone ever faced this kind of requirement? Here goes one more general/philosophical question: when facing this kind of requirement, that push us to use undocumented or opaque stuff, how we could keep the code sane, stable, compatible and general? how can we proceed to get the thing done? Personally, I do not see a way of doing this in a (really) right way, opaque and undocumented stuff is kernel developers business, maybe device drivers developers should keep it alone. Thanks in advance!
Upcoming OSR Seminars | ||
---|---|---|
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
Kernel Debugging | 16-20 October 2023 | Live, Online |
Developing Minifilters | 13-17 November 2023 | Live, Online |
Internals & Software Drivers | 4-8 Dec 2023 | Live, Online |
Writing WDF Drivers | 10-14 July 2023 | Live, Online |
Comments
I think that this is one of those 'what larger problem are you trying to solve' questions because I don't think that anyone can help you very much without more context. It is highly unusual for any KM component to care about the current directory of the process that is making any kind of call.
Well, it is for AV stuff.
Well, in my opinion, most AV software is worse that the malware that they pretend to protect against but anyways.
In your case, I would not worry about getting data from undocumented fields in the PEB. You are going to do a whole bunch of highly questionable things anyways, and this structure is partially documented by MSFT. That makes it impossible that the opaque parts will change in size because then the documented parts would move - violating the ABI. This structure has also been extensively studied and reversed engineered - which also makes it unlikely that the usage of the opaque members will change much. It has happened before - CRITICAL_SECTION is a great example - but it is rare