Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:

Is there a way of getting CWD from a process without needing to deal with PEB?

__rs__rs Member Posts: 7

Hi there!

I am dealing with a requirement that I need to get the current working directory of a running process from the context of a pre operation callback of a minifilter, so I was thinking if there is a way of getting this information without using PEB stuff maybe just by using documented and no opaque things. By using PEB is complicated because of the lack of backward compatibility, in my state of things, for example, my winternl.h does not define DLCurrentDirectory as people expects on their proposed solutions out there.

My feeling with this initial incompatibility even at compile time is something like the compiler screaming "do not use opaque stuff, avoid future headaches, find a better general solution". Thus, I would appreciate any tip, clue or help. Have anyone ever faced this kind of requirement? Here goes one more general/philosophical question: when facing this kind of requirement, that push us to use undocumented or opaque stuff, how we could keep the code sane, stable, compatible and general? how can we proceed to get the thing done? Personally, I do not see a way of doing this in a (really) right way, opaque and undocumented stuff is kernel developers business, maybe device drivers developers should keep it alone. Thanks in advance!


  • MBond2MBond2 Member Posts: 601

    I think that this is one of those 'what larger problem are you trying to solve' questions because I don't think that anyone can help you very much without more context. It is highly unusual for any KM component to care about the current directory of the process that is making any kind of call.

  • __rs__rs Member Posts: 7

    Well, it is for AV stuff.

  • MBond2MBond2 Member Posts: 601

    Well, in my opinion, most AV software is worse that the malware that they pretend to protect against but anyways.

    In your case, I would not worry about getting data from undocumented fields in the PEB. You are going to do a whole bunch of highly questionable things anyways, and this structure is partially documented by MSFT. That makes it impossible that the opaque parts will change in size because then the documented parts would move - violating the ABI. This structure has also been extensively studied and reversed engineered - which also makes it unlikely that the usage of the opaque members will change much. It has happened before - CRITICAL_SECTION is a great example - but it is rare

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 16-20 October 2023 Live, Online
Developing Minifilters 13-17 November 2023 Live, Online
Internals & Software Drivers 4-8 Dec 2023 Live, Online
Writing WDF Drivers 10-14 July 2023 Live, Online