Get device name from device letters

NTDEV
1

Hello,

I can get device names from symbolic link name opening a symbolic link object and querying with ZwQuerySymbolicLinkObject from kernel-mode.

I would like to use the same idea to do this in a small usermode application to show devices names and assigned device letters. Is this possible?
This app compiles and links ntoskrnl.lib with no warnings or errors but gives a 0xC0000005 “memory access violation” when I try to run it.

I should say its for Nt4 and I cant use newer APIs to get it.

Any ideas or suggested lectures?

Thanks

Este mensaje, y en su caso, cualquier fichero anexo al mismo,
puede contener informacion clasificada por su emisor como confidencial
en el marco de su Sistema de Gestion de Seguridad de la
Informacion siendo para uso exclusivo del destinatario, quedando
prohibida su divulgacion copia o distribucion a terceros sin la
autorizacion expresa del remitente. Si Vd. ha recibido este mensaje
erroneamente, se ruega lo notifique al remitente y proceda a su borrado.
Gracias por su colaboracion.

This message including any attachments may contain confidential
information, according to our Information Security Management System,
and intended solely for a specific individual to whom they are addressed.
Any unauthorised copy, disclosure or distribution of this message
is strictly forbidden. If you have received this transmission in error,
please notify the sender immediately and delete it.

2

Have you tried QueryDosDevice?

De: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] En nombre de Juli?n de Navascu?s Melero
Enviado el: martes, 20 de noviembre de 2007 11:43
Para: Windows System Software Devs Interest List
Asunto: [ntdev] Get device name from device letters

Hello,

I can get device names from symbolic link name opening a symbolic link object and querying with ZwQuerySymbolicLinkObject from kernel-mode.

I would like to use the same idea to do this in a small usermode application to show devices names and assigned device letters. Is this possible?

This app compiles and links ntoskrnl.lib with no warnings or errors but gives a 0xC0000005 “memory access violation” when I try to run it.

I should say its for Nt4 and I cant use newer APIs to get it.

Any ideas or suggested lectures?

Thanks

Este mensaje, y en su caso, cualquier fichero anexo al mismo, puede contener informaci?n clasificada por su emisor como confidencial en el marco de su Sistema de Gesti?n de Seguridad de la Informaci?n siendo para uso exclusivo del destinatario, quedando prohibida su divulgaci?n copia o distribuci?n a terceros sin la autorizaci?n expresa del remitente. Si Vd. ha recibido este mensaje err?neamente, se ruega lo notifique al remitente y proceda a su borrado. Gracias por su colaboraci?n.

This message including any attachments may contain confidential information, according to our Information Security Management System, and intended solely for a specific individual to whom they are addressed. Any unauthorised copy, disclosure or distribution of this message is strictly forbidden. If you have received this transmission in error, please notify the sender immediately and delete it.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

Maybe you’ve used wrong calling convention. How does your prototype looks like?

“Juli?n de Navascu?s Melero” wrote news:xxxxx@ntdev…
Hello,

I can get device names from symbolic link name opening a symbolic link object and querying with ZwQuerySymbolicLinkObject from kernel-mode.

I would like to use the same idea to do this in a small usermode application to show devices names and assigned device letters. Is this possible?
This app compiles and links ntoskrnl.lib with no warnings or errors but gives a 0xC0000005 “memory access violation” when I try to run it.

I should say its for Nt4 and I cant use newer APIs to get it.

Any ideas or suggested lectures?

Thanks

------------------------------------------------------------------------------
Este mensaje, y en su caso, cualquier fichero anexo al mismo, puede contener informaci?n clasificada por su emisor como confidencial en el marco de su Sistema de Gesti?n de Seguridad de la Informaci?n siendo para uso exclusivo del destinatario, quedando prohibida su divulgaci?n copia o distribuci?n a terceros sin la autorizaci?n expresa del remitente. Si Vd. ha recibido este mensaje err?neamente, se ruega lo notifique al remitente y proceda a su borrado. Gracias por su colaboraci?n.
------------------------------------------------------------------------------
This message including any attachments may contain confidential information, according to our Information Security Management System, and intended solely for a specific individual to whom they are addressed. Any unauthorised copy, disclosure or distribution of this message is strictly forbidden. If you have received this transmission in error, please notify the sender immediately and delete it.
------------------------------------------------------------------------------

4

Yes, I’ve readed about QueryDosDevice but is not supported on NT4 (according to MSDN).

I have fix it, I was inheriting linking options from a kernelmode project that links ntoskrnl.lib instead of ntdll.lib

Pero gracias :slight_smile:

De: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] En nombre de I?aki Castillo
Enviado el: ter?a-feira, 20 de novembro de 2007 13:27
Para: Windows System Software Devs Interest List
Asunto: RE: [ntdev] Get device name from device letters

Have you tried QueryDosDevice?

De: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] En nombre de Juli?n de Navascu?s Melero
Enviado el: martes, 20 de noviembre de 2007 11:43
Para: Windows System Software Devs Interest List
Asunto: [ntdev] Get device name from device letters

Hello,

I can get device names from symbolic link name opening a symbolic link object and querying with ZwQuerySymbolicLinkObject from kernel-mode.

I would like to use the same idea to do this in a small usermode application to show devices names and assigned device letters. Is this possible?

This app compiles and links ntoskrnl.lib with no warnings or errors but gives a 0xC0000005 “memory access violation” when I try to run it.

I should say its for Nt4 and I cant use newer APIs to get it.

Any ideas or suggested lectures?

Thanks

Este mensaje, y en su caso, cualquier fichero anexo al mismo, puede contener informaci?n clasificada por su emisor como confidencial en el marco de su Sistema de Gesti?n de Seguridad de la Informaci?n siendo para uso exclusivo del destinatario, quedando prohibida su divulgaci?n copia o distribuci?n a terceros sin la autorizaci?n expresa del remitente. Si Vd. ha recibido este mensaje err?neamente, se ruega lo notifique al remitente y proceda a su borrado. Gracias por su colaboraci?n.

This message including any attachments may contain confidential information, according to our Information Security Management System, and intended solely for a specific individual to whom they are addressed. Any unauthorised copy, disclosure or distribution of this message is strictly forbidden. If you have received this transmission in error, please notify the sender immediately and delete it.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Este mensaje, y en su caso, cualquier fichero anexo al mismo,
puede contener informacion clasificada por su emisor como confidencial
en el marco de su Sistema de Gestion de Seguridad de la
Informacion siendo para uso exclusivo del destinatario, quedando
prohibida su divulgacion copia o distribucion a terceros sin la
autorizacion expresa del remitente. Si Vd. ha recibido este mensaje
erroneamente, se ruega lo notifique al remitente y proceda a su borrado.
Gracias por su colaboracion.

This message including any attachments may contain confidential
information, according to our Information Security Management System,
and intended solely for a specific individual to whom they are addressed.
Any unauthorised copy, disclosure or distribution of this message
is strictly forbidden. If you have received this transmission in error,
please notify the sender immediately and delete it.

5

I was inheriting linking options from a kernelmode project that links ntoskrnl.lib instead of ntdll.lib, sorry.

Thx!

De: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] En nombre de frank
Enviado el: ter?a-feira, 20 de novembro de 2007 13:33
Para: Windows System Software Devs Interest List
Asunto: Re:[ntdev] Get device name from device letters

Maybe you’ve used wrong calling convention. How does your prototype looks like?

“Juli?n de Navascu?s Melero” wrote news:xxxxx@ntdev…
Hello,

I can get device names from symbolic link name opening a symbolic link object and querying with ZwQuerySymbolicLinkObject from kernel-mode.

I would like to use the same idea to do this in a small usermode application to show devices names and assigned device letters. Is this possible?
This app compiles and links ntoskrnl.lib with no warnings or errors but gives a 0xC0000005 “memory access violation” when I try to run it.

I should say its for Nt4 and I cant use newer APIs to get it.

Any ideas or suggested lectures?

Thanks



Este mensaje, y en su caso, cualquier fichero anexo al mismo, puede contener informaci?n clasificada por su emisor como confidencial en el marco de su Sistema de Gesti?n de Seguridad de la Informaci?n siendo para uso exclusivo del destinatario, quedando prohibida su divulgaci?n copia o distribuci?n a terceros sin la autorizaci?n expresa del remitente. Si Vd. ha recibido este mensaje err?neamente, se ruega lo notifique al remitente y proceda a su borrado. Gracias por su colaboraci?n.


This message including any attachments may contain confidential information, according to our Information Security Management System, and intended solely for a specific individual to whom they are addressed. Any unauthorised copy, disclosure or distribution of this message is strictly forbidden. If you have received this transmission in error, please notify the sender immediately and delete it.
__________

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer


Este mensaje, y en su caso, cualquier fichero anexo al mismo,
puede contener informacion clasificada por su emisor como confidencial
en el marco de su Sistema de Gestion de Seguridad de la
Informacion siendo para uso exclusivo del destinatario, quedando
prohibida su divulgacion copia o distribucion a terceros sin la
autorizacion expresa del remitente. Si Vd. ha recibido este mensaje
erroneamente, se ruega lo notifique al remitente y proceda a su borrado.
Gracias por su colaboracion.

This message including any attachments may contain confidential
information, according to our Information Security Management System,
and intended solely for a specific individual to whom they are addressed.
Any unauthorised copy, disclosure or distribution of this message
is strictly forbidden. If you have received this transmission in error,
please notify the sender immediately and delete it.

6

What’s up with NT4 people coming out of the woodwork over the past week
or so? Most of us haven’t looked at NT4 in a good five years at least,
so it’s going to be difficult to comment. In any case, please post your
code, as it is hard to say much without seeing it. Also, what debugger
are you using? You need to narrow it down a little for us.

Good luck,

mm

Julián de Navascués Melero wrote:

I was inheriting linking options from a kernelmode project that links
ntoskrnl.lib instead of ntdll.lib, sorry.

Thx!

*De:* xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] *En nombre de *frank
*Enviado el:* terça-feira, 20 de novembro de 2007 13:33
*Para:* Windows System Software Devs Interest List
*Asunto:* Re:[ntdev] Get device name from device letters

Maybe you’ve used wrong calling convention. How does your prototype
looks like?

“Julián de Navascués Melero” > mailto:xxxxx> wrote news:xxxxx@ntdev…
> Hello,
>
> I can get device names from symbolic link name opening a symbolic
> link object and querying with ZwQuerySymbolicLinkObject from
> kernel-mode.
>
> I would like to use the same idea to do this in a small usermode
> application to show devices names and assigned device letters. Is
> this possible?
> This app compiles and links ntoskrnl.lib with no warnings or errors
> but gives a 0xC0000005 “memory access violation” when I try to run it.
>
> I should say its for Nt4 and I cant use newer APIs to get it.
>
> Any ideas or suggested lectures?
>
> Thanks
>
>
>
> ------------------------------------------------------------------------
> Este mensaje, y en su caso, cualquier fichero anexo al mismo, puede
> contener información clasificada por su emisor como confidencial en
> el marco de su Sistema de Gestión de Seguridad de la Información
> siendo para uso exclusivo del destinatario, quedando prohibida su
> divulgación copia o distribución a terceros sin la autorización
> expresa del remitente. Si Vd. ha recibido este mensaje erróneamente,
> se ruega lo notifique al remitente y proceda a su borrado. Gracias
> por su colaboración.
> ------------------------------------------------------------------------
> This message including any attachments may contain confidential
> information, according to our Information Security Management
> System, and intended solely for a specific individual to whom they
> are addressed. Any unauthorised copy, disclosure or distribution of
> this message is strictly forbidden. If you have received this
> transmission in error, please notify the sender immediately and
> delete it.
>
> ------------------------------------------------------------------------
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
> ------------------------------------------------------------------------
> Este mensaje, y en su caso, cualquier fichero anexo al mismo, puede
> contener información clasificada por su emisor como confidencial en el
> marco de su Sistema de Gestión de Seguridad de la Información siendo
> para uso exclusivo del destinatario, quedando prohibida su divulgación
> copia o distribución a terceros sin la autorización expresa del
> remitente. Si Vd. ha recibido este mensaje erróneamente, se ruega lo
> notifique al remitente y proceda a su borrado. Gracias por su colaboración.
> ------------------------------------------------------------------------
> This message including any attachments may contain confidential
> information, according to our Information Security Management System,
> and intended solely for a specific individual to whom they are
> addressed. Any unauthorised copy, disclosure or distribution of this
> message is strictly forbidden. If you have received this transmission in
> error, please notify the sender immediately and delete it.
>
> ------------------------------------------------------------------------
></mailto:xxxxx>

7
  • original message -
    Subject: RE: [ntdev] Get device name from device letters
    From: Iñaki Castillo
    Date: 20/11/2007 12:37

    Have you tried QueryDosDevice?



    De: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] En nombre de Julián de Navascués Melero
    Enviado el: martes, 20 de noviembre de 2007 11:43
    Para: Windows System Software Devs Interest List
    Asunto: [ntdev] Get device name from device letters

    Hello,

    I can get device names from symbolic link name opening a symbolic link object and querying with ZwQuerySymbolicLinkObject from kernel-mode.

    I would like to use the same idea to do this in a small usermode application to show devices names and assigned device letters. Is this possible?

    This app compiles and links ntoskrnl.lib with no warnings or errors but gives a 0xC0000005 “memory access violation” when I try to run it.

    I should say its for Nt4 and I cant use newer APIs to get it.

    Any ideas or suggested lectures?

    Thanks



    Este mensaje, y en su caso, cualquier fichero anexo al mismo, puede contener información clasificada por su emisor como confidencial en el marco de su Sistema de Gestión de Seguridad de la Información siendo para uso exclusivo del destinatario, quedando prohibida su divulgación copia o distribución a terceros sin la autorización expresa del remitente. Si Vd. ha recibido este mensaje erróneamente, se ruega lo notifique al remitente y proceda a su borrado. Gracias por su colaboración.



    This message including any attachments may contain confidential information, according to our Information Security Management System, and intended solely for a specific individual to whom they are addressed. Any unauthorised copy, disclosure or distribution of this message is strictly forbidden. If you have received this transmission in error, please notify the sender immediately and delete it.



    —
    NTDEV is sponsored by OSR

    For our schedule of WDF, WDM, debugging and other seminars visit:
    http://www.osr.com/seminars

    To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

    —
    NTDEV is sponsored by OSR

    For our schedule of WDF, WDM, debugging and other seminars visit:
    http://www.osr.com/seminars

    To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
8

Have you looked at QueryDosDevice? Given a symbolic link name (say “C:”) it should give you the target of the link.

-p

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Juli?n de Navascu?s Melero
Sent: Tuesday, November 20, 2007 2:43 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Get device name from device letters

Hello,

I can get device names from symbolic link name opening a symbolic link object and querying with ZwQuerySymbolicLinkObject from kernel-mode.

I would like to use the same idea to do this in a small usermode application to show devices names and assigned device letters. Is this possible?
This app compiles and links ntoskrnl.lib with no warnings or errors but gives a 0xC0000005 “memory access violation” when I try to run it.

I should say its for Nt4 and I cant use newer APIs to get it.

Any ideas or suggested lectures?

Thanks

Este mensaje, y en su caso, cualquier fichero anexo al mismo, puede contener informaci?n clasificada por su emisor como confidencial en el marco de su Sistema de Gesti?n de Seguridad de la Informaci?n siendo para uso exclusivo del destinatario, quedando prohibida su divulgaci?n copia o distribuci?n a terceros sin la autorizaci?n expresa del remitente. Si Vd. ha recibido este mensaje err?neamente, se ruega lo notifique al remitente y proceda a su borrado. Gracias por su colaboraci?n.

This message including any attachments may contain confidential information, according to our Information Security Management System, and intended solely for a specific individual to whom they are addressed. Any unauthorised copy, disclosure or distribution of this message is strictly forbidden. If you have received this transmission in error, please notify the sender immediately and delete it.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

9

> I would like to use the same idea to do this in a small usermode application to show devices > names and assigned device letters. Is this possible?

Of course - don’t forget that ZwQuerySymbolicLinkObject() is exported by ntdll.dll, and , hence, is callable from the user mode. Furthermore, kernel32.dll provides QueryDosDevice(), which calls ZwQuerySymbolicLinkObject() behind the scenes…

This app compiles and links ntoskrnl.lib with no warnings or errors but gives
a 0xC0000005 >“memory access violation” when I try to run it.

You just don’t link user-mode apps against ntoskrnl.exe. Period. The absolute maximum that you can do in the user mode is to write a native application, but even native applications get linked against ntdll.dll, rather than ntoskrnl.exe.

Anton Bassov

10

Yes, but according with MSDN QueryDosDevice is not available en NT4

thanks!

Julian

De: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] En nombre de Peter Wieland
Enviado el: ter?a-feira, 20 de novembro de 2007 22:17
Para: Windows System Software Devs Interest List
Asunto: RE:[ntdev] Get device name from device letters

Have you looked at QueryDosDevice? Given a symbolic link name (say “C:”) it should give you the target of the link.

-p

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Juli?n de Navascu?s Melero
Sent: Tuesday, November 20, 2007 2:43 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Get device name from device letters

Hello,

I can get device names from symbolic link name opening a symbolic link object and querying with ZwQuerySymbolicLinkObject from kernel-mode.

I would like to use the same idea to do this in a small usermode application to show devices names and assigned device letters. Is this possible?

This app compiles and links ntoskrnl.lib with no warnings or errors but gives a 0xC0000005 “memory access violation” when I try to run it.

I should say its for Nt4 and I cant use newer APIs to get it.

Any ideas or suggested lectures?

Thanks

Este mensaje, y en su caso, cualquier fichero anexo al mismo, puede contener informaci?n clasificada por su emisor como confidencial en el marco de su Sistema de Gesti?n de Seguridad de la Informaci?n siendo para uso exclusivo del destinatario, quedando prohibida su divulgaci?n copia o distribuci?n a terceros sin la autorizaci?n expresa del remitente. Si Vd. ha recibido este mensaje err?neamente, se ruega lo notifique al remitente y proceda a su borrado. Gracias por su colaboraci?n.

This message including any attachments may contain confidential information, according to our Information Security Management System, and intended solely for a specific individual to whom they are addressed. Any unauthorised copy, disclosure or distribution of this message is strictly forbidden. If you have received this transmission in error, please notify the sender immediately and delete it.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Este mensaje, y en su caso, cualquier fichero anexo al mismo,
puede contener informacion clasificada por su emisor como confidencial
en el marco de su Sistema de Gestion de Seguridad de la
Informacion siendo para uso exclusivo del destinatario, quedando
prohibida su divulgacion copia o distribucion a terceros sin la
autorizacion expresa del remitente. Si Vd. ha recibido este mensaje
erroneamente, se ruega lo notifique al remitente y proceda a su borrado.
Gracias por su colaboracion.

This message including any attachments may contain confidential
information, according to our Information Security Management System,
and intended solely for a specific individual to whom they are addressed.
Any unauthorised copy, disclosure or distribution of this message
is strictly forbidden. If you have received this transmission in error,
please notify the sender immediately and delete it.

11

Yes, I realized. Thank you very much.

-----Mensaje original-----
De: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] En nombre de xxxxx@hotmail.com
Enviado el: quarta-feira, 21 de novembro de 2007 02:15
Para: Windows System Software Devs Interest List
Asunto: RE:[ntdev] Get device name from device letters

I would like to use the same idea to do this in a small usermode application to show devices > names and assigned device letters. Is this possible?

Of course - don’t forget that ZwQuerySymbolicLinkObject() is exported by ntdll.dll, and , hence, is callable from the user mode. Furthermore, kernel32.dll provides QueryDosDevice(), which calls ZwQuerySymbolicLinkObject() behind the scenes…

This app compiles and links ntoskrnl.lib with no warnings or errors
but gives a 0xC0000005 >“memory access violation” when I try to run it.

You just don’t link user-mode apps against ntoskrnl.exe. Period. The absolute maximum that you can do in the user mode is to write a native application, but even native applications get linked against ntdll.dll, rather than ntoskrnl.exe.

Anton Bassov

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Este mensaje, y en su caso, cualquier fichero anexo al mismo,
puede contener informacion clasificada por su emisor como confidencial
en el marco de su Sistema de Gestion de Seguridad de la
Informacion siendo para uso exclusivo del destinatario, quedando
prohibida su divulgacion copia o distribucion a terceros sin la
autorizacion expresa del remitente. Si Vd. ha recibido este mensaje
erroneamente, se ruega lo notifique al remitente y proceda a su borrado.
Gracias por su colaboracion.

This message including any attachments may contain confidential
information, according to our Information Security Management System,
and intended solely for a specific individual to whom they are addressed.
Any unauthorised copy, disclosure or distribution of this message
is strictly forbidden. If you have received this transmission in error,
please notify the sender immediately and delete it.

12

I believe it is supported on NT4 even though MSDN has omitted it. Also do
not link the kernel with a user mode application which is likely why you
were getting access violations. User mode applications should be linking
firstly against kernel32/ntdll for user mode interfaces for kernel
functionality.

From: Juli?n de Navascu?s Melero [mailto:xxxxx@gmv.com]
Sent: Tuesday, November 20, 2007 11:15 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Get device name from device letters

Yes, but according with MSDN QueryDosDevice is not available en NT4

thanks!

Julian

De: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] En nombre de Peter Wieland
Enviado el: ter?a-feira, 20 de novembro de 2007 22:17
Para: Windows System Software Devs Interest List
Asunto: RE:[ntdev] Get device name from device letters

Have you looked at QueryDosDevice? Given a symbolic link name (say ?C:?) it
should give you the target of the link.

-p

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Juli?n de Navascu?s
Melero
Sent: Tuesday, November 20, 2007 2:43 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Get device name from device letters

Hello,

I can get device names from symbolic link name opening a symbolic link
object and querying with ZwQuerySymbolicLinkObject from kernel-mode.

I would like to use the same idea to do this in a small usermode application
to show devices names and assigned device letters. Is this possible?

This app compiles and links ntoskrnl.lib with no warnings or errors but
gives a 0xC0000005 “memory access violation” when I try to run it.

I should say its for Nt4 and I cant use newer APIs to get it.

Any ideas or suggested lectures?

Thanks

Este mensaje, y en su caso, cualquier fichero anexo al mismo, puede contener
informaci?n clasificada por su emisor como confidencial en el marco de su
Sistema de Gesti?n de Seguridad de la Informaci?n siendo para uso exclusivo
del destinatario, quedando prohibida su divulgaci?n copia o distribuci?n a
terceros sin la autorizaci?n expresa del remitente. Si Vd. ha recibido este
mensaje err?neamente, se ruega lo notifique al remitente y proceda a su
borrado. Gracias por su colaboraci?n.

This message including any attachments may contain confidential information,
according to our Information Security Management System, and intended solely
for a specific individual to whom they are addressed. Any unauthorised copy,
disclosure or distribution of this message is strictly forbidden. If you
have received this transmission in error, please notify the sender
immediately and delete it.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Este mensaje, y en su caso, cualquier fichero anexo al mismo, puede contener
informaci?n clasificada por su emisor como confidencial en el marco de su
Sistema de Gesti?n de Seguridad de la Informaci?n siendo para uso exclusivo
del destinatario, quedando prohibida su divulgaci?n copia o distribuci?n a
terceros sin la autorizaci?n expresa del remitente. Si Vd. ha recibido este
mensaje err?neamente, se ruega lo notifique al remitente y proceda a su
borrado. Gracias por su colaboraci?n.

This message including any attachments may contain confidential information,
according to our Information Security Management System, and intended solely
for a specific individual to whom they are addressed. Any unauthorised copy,
disclosure or distribution of this message is strictly forbidden. If you
have received this transmission in error, please notify the sender
immediately and delete it.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

13

Yes, you are definitively right. (Dumpbin output says QueryDosDeviceA and QueryDosDeviceW are supported in NT 4)

thanks a lot!

Julian

De: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] En nombre de Toby Opferman
Enviado el: quarta-feira, 21 de novembro de 2007 08:51
Para: Windows System Software Devs Interest List
Asunto: RE: [ntdev] Get device name from device letters

I believe it is supported on NT4 even though MSDN has omitted it. Also do not link the kernel with a user mode application which is likely why you were getting access violations. User mode applications should be linking firstly against kernel32/ntdll for user mode interfaces for kernel functionality.

From: Juli?n de Navascu?s Melero [mailto:xxxxx@gmv.com]
Sent: Tuesday, November 20, 2007 11:15 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Get device name from device letters

Yes, but according with MSDN QueryDosDevice is not available en NT4

thanks!

Julian

De: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] En nombre de Peter Wieland
Enviado el: ter?a-feira, 20 de novembro de 2007 22:17
Para: Windows System Software Devs Interest List
Asunto: RE:[ntdev] Get device name from device letters

Have you looked at QueryDosDevice? Given a symbolic link name (say “C:”) it should give you the target of the link.

-p

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Juli?n de Navascu?s Melero
Sent: Tuesday, November 20, 2007 2:43 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Get device name from device letters

Hello,

I can get device names from symbolic link name opening a symbolic link object and querying with ZwQuerySymbolicLinkObject from kernel-mode.

I would like to use the same idea to do this in a small usermode application to show devices names and assigned device letters. Is this possible?

This app compiles and links ntoskrnl.lib with no warnings or errors but gives a 0xC0000005 “memory access violation” when I try to run it.

I should say its for Nt4 and I cant use newer APIs to get it.

Any ideas or suggested lectures?

Thanks

Este mensaje, y en su caso, cualquier fichero anexo al mismo, puede contener informaci?n clasificada por su emisor como confidencial en el marco de su Sistema de Gesti?n de Seguridad de la Informaci?n siendo para uso exclusivo del destinatario, quedando prohibida su divulgaci?n copia o distribuci?n a terceros sin la autorizaci?n expresa del remitente. Si Vd. ha recibido este mensaje err?neamente, se ruega lo notifique al remitente y proceda a su borrado. Gracias por su colaboraci?n.

This message including any attachments may contain confidential information, according to our Information Security Management System, and intended solely for a specific individual to whom they are addressed. Any unauthorised copy, disclosure or distribution of this message is strictly forbidden. If you have received this transmission in error, please notify the sender immediately and delete it.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Este mensaje, y en su caso, cualquier fichero anexo al mismo, puede contener informaci?n clasificada por su emisor como confidencial en el marco de su Sistema de Gesti?n de Seguridad de la Informaci?n siendo para uso exclusivo del destinatario, quedando prohibida su divulgaci?n copia o distribuci?n a terceros sin la autorizaci?n expresa del remitente. Si Vd. ha recibido este mensaje err?neamente, se ruega lo notifique al remitente y proceda a su borrado. Gracias por su colaboraci?n.

This message including any attachments may contain confidential information, according to our Information Security Management System, and intended solely for a specific individual to whom they are addressed. Any unauthorised copy, disclosure or distribution of this message is strictly forbidden. If you have received this transmission in error, please notify the sender immediately and delete it.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Este mensaje, y en su caso, cualquier fichero anexo al mismo,
puede contener informacion clasificada por su emisor como confidencial
en el marco de su Sistema de Gestion de Seguridad de la
Informacion siendo para uso exclusivo del destinatario, quedando
prohibida su divulgacion copia o distribucion a terceros sin la
autorizacion expresa del remitente. Si Vd. ha recibido este mensaje
erroneamente, se ruega lo notifique al remitente y proceda a su borrado.
Gracias por su colaboracion.

This message including any attachments may contain confidential
information, according to our Information Security Management System,
and intended solely for a specific individual to whom they are addressed.
Any unauthorised copy, disclosure or distribution of this message
is strictly forbidden. If you have received this transmission in error,
please notify the sender immediately and delete it.