Object paths

NTDEV
1

Is there anyway given an object pointer or handle to resolve
it to the path to the object? I know about NtQueryObject
which will get the name, but I am looking for the full path,
or at least an indication of the directory it resides in so that
the path can be resolved.

Don Burn

2

Hello,

I believe NtQueryObject information class 1 returns
complete path of the object.

-Prasad

— Don Burn wrote:
> Is there anyway given an object pointer or handle to
> resolve
> it to the path to the object? I know about
> NtQueryObject
> which will get the name, but I am looking for the
> full path,
> or at least an indication of the directory it
> resides in so that
> the path can be resolved.
>
> Don Burn
>
>
>
> —
> You are currently subscribed to ntdev as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
> $subst(‘Email.Unsub’)
>
>

=====
Prasad S. Dabak
Director of Engineering, Windows NT/2000 Division
Cybermedia Software Private Limited
http://www.cybermedia.co.in
Co-author of the book “Undocumented Windows NT”
ISBN 0764545698
__________________________________________________
Do You Yahoo!?
Talk to your friends online with Yahoo! Messenger.
http://im.yahoo.com

3

Don,

ObQueryNameString should do what you want, Documented in the 2000 DDK.

Duncan

-----Original Message-----
From: Don Burn [mailto:xxxxx@acm.org]
Sent: 09 March 2000 18:46
To: NT Developers Interest List
Subject: [ntdev] Object paths

Is there anyway given an object pointer or handle to resolve
it to the path to the object? I know about NtQueryObject
which will get the name, but I am looking for the full path,
or at least an indication of the directory it resides in so that
the path can be resolved.

Don Burn

You are currently subscribed to ntdev as: xxxxx@des.co.uk
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

4

From: “Duncan Hume”
Sent: Friday, March 10, 2000 4:46 AM

> Don,
>
> ObQueryNameString should do what you want, Documented in the 2000 DDK.

[snip]

Hmm, I too am interested in this function, but cannot find it documented in
my copy of the Windows 2000 DDK, nor online at Microsoft’s site.

Are you sure your naming is correct? I tried looking for other variations,
but still couldn’t find anything. Can you point me to pricisely where you
saw this function documented?

Alternately, can anybody provide with another technique for retreiving a
DEVICE_OBJECT’s name given a pointer to the DEVICE_OBJECT?

Regards,

Matt Arnold
Professional Music Products
Mark of the Unicorn, Inc.
http://www.motu.com

5

This comes from the Win 2000 DDK that comes on the Win 2000 IFS Kit CD.

NTSTATUS
ObQueryNameString (
IN PVOID Object,
OUT POBJECT_NAME_INFORMATION ObjectNameInfo,
IN ULONG Length,
OUT PULONG ReturnLength
);

typedef struct _OBJECT_NAME_INFORMATION {
UNICODE_STRING Name;
} OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;

It is defined in NTIFS.H. I am using it in my filter driver and it does
exactly what you want. It is exported from NTOSKRNL.EXE in both Windows NT
4.0 and Windows 2000. It works fine in both, although I have not done much
testing yet.

Duncan

Hmm, I too am interested in this function, but cannot find it
documented in
my copy of the Windows 2000 DDK, nor online at Microsoft’s site.

Are you sure your naming is correct? I tried looking for
other variations,
but still couldn’t find anything. Can you point me to
pricisely where you
saw this function documented?

Alternately, can anybody provide with another technique for
retreiving a
DEVICE_OBJECT’s name given a pointer to the DEVICE_OBJECT?

Regards,

Matt Arnold
Professional Music Products
Mark of the Unicorn, Inc.
http://www.motu.com

6

Thanks. I guess my problem is that I just have the regular DDK, not the IFS
kit.

BTW, I know ObQueryNameString() is not in “wdm.h”, but do you happen to know
if ObQueryNameString() can be used by WDM drivers running on Windows 98?

ObQueryNameString() is listed in the NtOsKrnl.lib import library that comes
with the Windows 98 DDK, but perhaps that means nothing.

Regards,

Matt Arnold
Professional Music Products
Mark of the Unicorn, Inc.
http://www.motu.com

To: “NT Developers Interest List”
Sent: Wednesday, March 15, 2000 3:50 AM

> This comes from the Win 2000 DDK that comes on the Win 2000 IFS Kit CD.

[snip]

7

> Thanks. I guess my problem is that I just have the regular

DDK, not the IFS
kit.

Sounds like it… But you can still use it… using the function def and the
lib that comes with the DDK.

BTW, I know ObQueryNameString() is not in “wdm.h”, but do you
happen to know
if ObQueryNameString() can be used by WDM drivers running on
Windows 98?

There is no mention of ObQueryNameString in any file on Windows 98… Anyway
I didn’t think there was an object directory on Windows 98…

ObQueryNameString() is listed in the NtOsKrnl.lib import
library that comes with the Windows 98 DDK, but perhaps that means
nothing.

You never know, most of the things you need to build a useful filter driver
on NT are undoc. and the same goes for a lot of other things :slight_smile:

Duncan

8

> Thanks. I guess my problem is that I just have the regular DDK,

not the IFS
kit.

You can use ObQueryNameString() when you’re using the ntifs.h
header that can be found on http://www.acc.umu.se/~bosse/ntifs.h
or you query the address via name with MmGetSystemRoutineAddress.

BTW, I know ObQueryNameString() is not in “wdm.h”, but do you
happen to know
if ObQueryNameString() can be used by WDM drivers running on Windows 98?

AFAIK, it is not possible to use ObQueryNameString() under Win98.
Beside that MmGetSystemRoutineAddress isn’t neither availabe under Win98 :frowning:

ObQueryNameString() is listed in the NtOsKrnl.lib import library
that comes
with the Windows 98 DDK, but perhaps that means nothing.

It possibly is in NtOsKrnl.lib, because you could use this lib also to
build NT KMDs.

Regards,

Carsten