How can I get the path of "%programfiles% when using ZwCreateFile in driver?

NTDEV
1

My driver need to open a file in the directory of “%HOMEDRIVE%\Program Files\Common Files\filename.dat”. That means, if my system is in c: , then the directory is “c:\Program Files\Common Files\filename.dat”. Now I use ZwCreateFile() with a path of L"\??\C:\Program Files\Common Files\filename.dat" to open it. But if someone’s system is installed in d: or others,then it will not work.

After many tries, I know I can use var “SystemRoot” in driver as L"\SystemRoot\System32\filename.dat" . But I cannot use L"\SystemRoot\…\Program Files\Common Files\filename.dat" . So I cannot find system disk by “SystemRoot”. I also cannot use L"\HOMEDRIVE\Program Files\Common Files\filename.dat". It seems “HOMEDRIVE”, “programfiles” and “commonprogramfiles” cannot be used in kernel driver. So are there any variable equals to “%HOMEDRIVE%” or "%HOMEDRIVE%\Program Files" or "%HOMEDRIVE%\Program Files\Common Files"?
Or by other means how can I get the path of “%HOMEDRIVE%\Program Files\Common Files\filename.dat”?

Thanks.
-Liu

2

%systemdrive%

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@dayang.com.cn
Sent: Tuesday, August 19, 2008 9:41
To: Windows System Software Devs Interest List
Subject: [ntdev] How can I get the path of "%programfiles% when using
ZwCreateFile in driver?

My driver need to open a file in the directory of “%HOMEDRIVE%\Program
Files\Common Files\filename.dat”. That means, if my system is in c: , then
the directory is “c:\Program Files\Common Files\filename.dat”. Now I use
ZwCreateFile() with a path of L"\??\C:\Program Files\Common
Files\filename.dat" to open it. But if someone’s system is installed in d:
or others,then it will not work.

After many tries, I know I can use var “SystemRoot” in driver as
L"\SystemRoot\System32\filename.dat" . But I cannot use
L"\SystemRoot\…\Program Files\Common Files\filename.dat" . So I cannot
find system disk by “SystemRoot”. I also cannot use L"\HOMEDRIVE\Program
Files\Common Files\filename.dat". It seems “HOMEDRIVE”, “programfiles”
and “commonprogramfiles” cannot be used in kernel driver. So are there any
variable equals to “%HOMEDRIVE%” or "%HOMEDRIVE%\Program Files" or
"%HOMEDRIVE%\Program Files\Common Files"?
Or by other means how can I get the path of “%HOMEDRIVE%\Program
Files\Common Files\filename.dat”?

Thanks.
-Liu

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

__________ Information from ESET NOD32 Antivirus, version of virus signature
database 3367 (20080819) __________

The message was checked by ESET NOD32 Antivirus.

http://www.eset.com

__________ Information from ESET NOD32 Antivirus, version of virus signature
database 3367 (20080819) __________

The message was checked by ESET NOD32 Antivirus.

http://www.eset.com

3

Since it doesn’t change, save it in the registry during installation.

If you use Windows Installer (MSI) to install, then save
[ProgramFilesFolder] in the registry somewhere your driver can find.

If you use an INF file, DirId %16422% is the Program Files folder.

Then your driver can read it from the registry at startup time or when
needed.

HTH,
Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@dayang.com.cn
Sent: Tuesday, August 19, 2008 4:41 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] How can I get the path of "%programfiles% when using
ZwCreateFile in driver?

My driver need to open a file in the directory of “%HOMEDRIVE%\Program
Files\Common Files\filename.dat”. That means, if my system is in c: , then
the directory is “c:\Program Files\Common Files\filename.dat”. Now I use
ZwCreateFile() with a path of L"\??\C:\Program Files\Common
Files\filename.dat" to open it. But if someone’s system is installed in d:
or others,then it will not work.

After many tries, I know I can use var “SystemRoot” in driver as
L"\SystemRoot\System32\filename.dat" . But I cannot use
L"\SystemRoot\…\Program Files\Common Files\filename.dat" . So I cannot
find system disk by “SystemRoot”. I also cannot use L"\HOMEDRIVE\Program
Files\Common Files\filename.dat". It seems “HOMEDRIVE”, “programfiles”
and “commonprogramfiles” cannot be used in kernel driver. So are there any
variable equals to “%HOMEDRIVE%” or "%HOMEDRIVE%\Program Files" or
"%HOMEDRIVE%\Program Files\Common Files"?
Or by other means how can I get the path of “%HOMEDRIVE%\Program
Files\Common Files\filename.dat”?

Thanks.
-Liu

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

4

Or better yet, forget about this and put your dat file in \systemroot and be done with it. Program Files can change after install IIRC using a power toy (or perhaps the shell, it’s been a long time since I have done it). Besides, if you can write to program files, you are already an elevated user, so writing to a file in \systemroot is no different.

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Ken Cross
Sent: Tuesday, August 19, 2008 4:36 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] How can I get the path of "%programfiles% when using ZwCreateFile in driver?

Since it doesn’t change, save it in the registry during installation.

If you use Windows Installer (MSI) to install, then save
[ProgramFilesFolder] in the registry somewhere your driver can find.

If you use an INF file, DirId %16422% is the Program Files folder.

Then your driver can read it from the registry at startup time or when
needed.

HTH,
Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@dayang.com.cn
Sent: Tuesday, August 19, 2008 4:41 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] How can I get the path of "%programfiles% when using
ZwCreateFile in driver?

My driver need to open a file in the directory of “%HOMEDRIVE%\Program
Files\Common Files\filename.dat”. That means, if my system is in c: , then
the directory is “c:\Program Files\Common Files\filename.dat”. Now I use
ZwCreateFile() with a path of L"\??\C:\Program Files\Common
Files\filename.dat" to open it. But if someone’s system is installed in d:
or others,then it will not work.

After many tries, I know I can use var “SystemRoot” in driver as
L"\SystemRoot\System32\filename.dat" . But I cannot use
L"\SystemRoot\…\Program Files\Common Files\filename.dat" . So I cannot
find system disk by “SystemRoot”. I also cannot use L"\HOMEDRIVE\Program
Files\Common Files\filename.dat". It seems “HOMEDRIVE”, “programfiles”
and “commonprogramfiles” cannot be used in kernel driver. So are there any
variable equals to “%HOMEDRIVE%” or "%HOMEDRIVE%\Program Files" or
"%HOMEDRIVE%\Program Files\Common Files"?
Or by other means how can I get the path of “%HOMEDRIVE%\Program
Files\Common Files\filename.dat”?

Thanks.
-Liu

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

5

Thanks for all of you. I have tried L"\systemdrive\Program Files\Common Files\filename.dat" but it still could not work. And if I use L"%systemdrive%\Program Files\Common Files\filename.dat", the system will crash because it considered “%s” as a string. Is that means I cannot get the path of "%systemdrive% in a driver? Maybe I must registry it during installation or change the directory to SystemRoot. I will try it.

6

Simply query the ‘SystemRoot’ value in the registry at
\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion. Then you can get the
system volume drive letter and use that to assemble your path.

On Tue, Aug 19, 2008 at 11:21 PM, wrote:

> Thanks for all of you. I have tried L"\systemdrive\Program Files\Common
> Files\filename.dat" but it still could not work. And if I use
> L"%systemdrive%\Program Files\Common Files\filename.dat", the system will
> crash because it considered “%s” as a string. Is that means I cannot get the
> path of "%systemdrive% in a driver? Maybe I must registry it during
> installation or change the directory to SystemRoot. I will try it.
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

7

Quoting Michael Zhu :

> Simply query the ‘SystemRoot’ value in the registry at
> \HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion. Then you can get the
> system volume drive letter and use that to assemble your path.

This solution will not work. He can not assemble the path in that way.
Common Files is a construct of the shell. By default is is at
C:\Program Files\Common Files but there is no guarentee it will be called
that it can be moved elsewhere. A user level program can call a function
such as SHGetFolderPath with CSIDL_PROGRAM_FILES_COMMON to get the path.

I think the best solution so far is the suggestion that he writes the path to
the registry at (the application’s) install time and read it from the registry
so the driver can use it.

>
> On Tue, Aug 19, 2008 at 11:21 PM, wrote:
>
> > Thanks for all of you. I have tried L"\systemdrive\Program Files\Common
> > Files\filename.dat" but it still could not work. And if I use
> > L"%systemdrive%\Program Files\Common Files\filename.dat", the system
> will
> > crash because it considered “%s” as a string. Is that means I cannot get
> the
> > path of "%systemdrive% in a driver? Maybe I must registry it during
> > installation or change the directory to SystemRoot. I will try it.
> >
> > —
> > NTDEV is sponsored by OSR
> >
> > For our schedule of WDF, WDM, debugging and other seminars visit:
> > http://www.osr.com/seminars
> >
> > To unsubscribe, visit the List Server section of OSR Online at
> > http://www.osronline.com/page.cfm?name=ListServer
> >
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer

–

-------------------------------------------------
Visit Pipex Business: The homepage for UK Small Businesses

Go to http://www.pipex.co.uk/business-services

8

The OP asked for %ProgramFiles% but he really wants %CommonProgramFiles%.
Either could easily be stuck in the registry as a REG_EXPAND_SZ. That would
accommodate moving the directory and also handle localization and WOW64
registry redirector issues.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@dsl.pipex.com
Sent: Wednesday, August 20, 2008 11:31 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] How can I get the path of "%programfiles% when using
ZwCreateFile in driver?

Quoting Michael Zhu :

> Simply query the ‘SystemRoot’ value in the registry at
> \HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion. Then you can get the
> system volume drive letter and use that to assemble your path.

This solution will not work. He can not assemble the path in that way.
Common Files is a construct of the shell. By default is is at
C:\Program Files\Common Files but there is no guarentee it will be called
that it can be moved elsewhere. A user level program can call a function
such as SHGetFolderPath with CSIDL_PROGRAM_FILES_COMMON to get the path.

I think the best solution so far is the suggestion that he writes the path
to
the registry at (the application’s) install time and read it from the
registry
so the driver can use it.

>
> On Tue, Aug 19, 2008 at 11:21 PM, wrote:
>
> > Thanks for all of you. I have tried L"\systemdrive\Program
Files\Common
> > Files\filename.dat" but it still could not work. And if I use
> > L"%systemdrive%\Program Files\Common Files\filename.dat", the system
> will
> > crash because it considered “%s” as a string. Is that means I cannot get
> the
> > path of "%systemdrive% in a driver? Maybe I must registry it during
> > installation or change the directory to SystemRoot. I will try it.
> >
> > —
> > NTDEV is sponsored by OSR
> >
> > For our schedule of WDF, WDM, debugging and other seminars visit:
> > http://www.osr.com/seminars
> >
> > To unsubscribe, visit the List Server section of OSR Online at
> > http://www.osronline.com/page.cfm?name=ListServer
> >
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer

–

-------------------------------------------------
Visit Pipex Business: The homepage for UK Small Businesses

Go to http://www.pipex.co.uk/business-services

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

9

Ken Cross wrote:

The OP asked for %ProgramFiles% but he really wants %CommonProgramFiles%.
Either could easily be stuck in the registry as a REG_EXPAND_SZ. That would
accommodate moving the directory and also handle localization and WOW64
registry redirector issues.

However, one can make a very good argument that files needed by drivers
should be copied into the %SystemRoot% tree, instead of having a driver
root through the Win32 file system architecture.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

10

REG_EXPAND_SZ is not automagically expanded with env vars in KM. wow64 also only comes into play in UM, in KM it is always 64 bit. How about leaving well enough alone and just putting your file in \systemroot\system32\drivers *right next to your driver* and be done with it?

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Ken Cross
Sent: Wednesday, August 20, 2008 9:11 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] How can I get the path of "%programfiles% when using ZwCreateFile in driver?

The OP asked for %ProgramFiles% but he really wants %CommonProgramFiles%.
Either could easily be stuck in the registry as a REG_EXPAND_SZ. That would
accommodate moving the directory and also handle localization and WOW64
registry redirector issues.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@dsl.pipex.com
Sent: Wednesday, August 20, 2008 11:31 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] How can I get the path of "%programfiles% when using
ZwCreateFile in driver?

Quoting Michael Zhu :

> Simply query the ‘SystemRoot’ value in the registry at
> \HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion. Then you can get the
> system volume drive letter and use that to assemble your path.

This solution will not work. He can not assemble the path in that way.
Common Files is a construct of the shell. By default is is at
C:\Program Files\Common Files but there is no guarentee it will be called
that it can be moved elsewhere. A user level program can call a function
such as SHGetFolderPath with CSIDL_PROGRAM_FILES_COMMON to get the path.

I think the best solution so far is the suggestion that he writes the path
to
the registry at (the application’s) install time and read it from the
registry
so the driver can use it.

>
> On Tue, Aug 19, 2008 at 11:21 PM, wrote:
>
> > Thanks for all of you. I have tried L"\systemdrive\Program
Files\Common
> > Files\filename.dat" but it still could not work. And if I use
> > L"%systemdrive%\Program Files\Common Files\filename.dat", the system
> will
> > crash because it considered “%s” as a string. Is that means I cannot get
> the
> > path of "%systemdrive% in a driver? Maybe I must registry it during
> > installation or change the directory to SystemRoot. I will try it.
> >
> > —
> > NTDEV is sponsored by OSR
> >
> > For our schedule of WDF, WDM, debugging and other seminars visit:
> > http://www.osr.com/seminars
> >
> > To unsubscribe, visit the List Server section of OSR Online at
> > http://www.osronline.com/page.cfm?name=ListServer
> >
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer

–

-------------------------------------------------
Visit Pipex Business: The homepage for UK Small Businesses

Go to http://www.pipex.co.uk/business-services

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

11

Thanks for your answer. They are all helpful. I will explain to you how the problem comes from. This program and driver have been released for nearly 2years. But recently a client reported a bug that there is some wrong status when the driver is initing. The file I needed is designed used only by the program not by the driver. But the easiest solution to this problem is the driver to read the program’s file and set some regs. It only need a little change in the driver. After many tries, I finally gave up to find the “%HOMEDRIVE%” or "%HOMEDRIVE%\Program Files" or
"%HOMEDRIVE%\Program Files\Common Files" path. It must be a bad design for a driver to read file outside the SystemRoot. I will consider it in the future. Thansks all of you.