How to get drive letter.

NTDEV
1

Hi This is Muhammad Irfan.
I am developing a filter driver. I displays the path of files which are opened.
I am getting the paths right but iam unable to get the drive letter for paths kindly provide the solution for this problem.
Here is the code for getting file path.

NTSTATUS FsFilterDispatchPassThrough( __in PDEVICE_OBJECT DeviceObject, __in PIRP Irp )
{
PFSFILTER_DEVICE_EXTENSION pDevExt = (PFSFILTER_DEVICE_EXTENSION)DeviceObject->DeviceExtension;

IoSkipCurrentIrpStackLocation(Irp);
return IoCallDriver(pDevExt->AttachedToDeviceObject, Irp);
}

///////////////////////////////////////////////////////////////////////////////////////////////////
// IRP_MJ_CREATE IRP Handler

NTSTATUS FsFilterDispatchCreate(
__in PDEVICE_OBJECT DeviceObject,
__in PIRP Irp
)
//{
// return STATUS_SUCCESS;
//}
{
PFILE_OBJECT pFileObject = IoGetCurrentIrpStackLocation(Irp)->FileObject;

DbgPrint(“%wZ\n”, &pFileObject->FileName);

return FsFilterDispatchPassThrough(DeviceObject, Irp);
}

2

Printing file path in second last line

3

xxxxx@yahoo.com wrote:

I am developing a filter driver. I displays the path of files which are opened.
I am getting the paths right but iam unable to get the drive letter for paths kindly provide the solution for this problem.

This is true. File system drivers do not know what their drive letter
is, and they don’t need to know. Drive letters are a user-mode concept
that are all handled in the layers above.

A user-mode app can find this information without too much trouble. For
kernel help, you should probably ask on the [ntfsd] mailing list. The
file system geniuses live over there.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

4

Hi,

In user mode you can use QueryDosDevice.
In Kernel mode you can use ZwOpenSymbolicLinkObject API to get the NT Names
from Symbolic links

regards,
Rabish

On Fri, Mar 1, 2013 at 4:39 PM, wrote:

> Hi This is Muhammad Irfan.
> I am developing a filter driver. I displays the path of files which are
> opened.
> I am getting the paths right but iam unable to get the drive letter for
> paths kindly provide the solution for this problem.
> Here is the code for getting file path.
>
> NTSTATUS FsFilterDispatchPassThrough( in PDEVICE_OBJECT DeviceObject,
> in PIRP Irp )
> {
> PFSFILTER_DEVICE_EXTENSION pDevExt =
> (PFSFILTER_DEVICE_EXTENSION)DeviceObject->DeviceExtension;
>
> IoSkipCurrentIrpStackLocation(Irp);
> return IoCallDriver(pDevExt->AttachedToDeviceObject, Irp);
> }
>
>
> ///////////////////////////////////////////////////////////////////////////////////////////////////
> // IRP_MJ_CREATE IRP Handler
>
> NTSTATUS FsFilterDispatchCreate(
> in PDEVICE_OBJECT DeviceObject,
> in PIRP Irp
> )
> //{
> // return STATUS_SUCCESS;
> //}
> {
> PFILE_OBJECT pFileObject =
> IoGetCurrentIrpStackLocation(Irp)->FileObject;
>
> DbgPrint(“%wZ\n”, &pFileObject->FileName);
>
> return FsFilterDispatchPassThrough(DeviceObject, Irp);
> }
>
>
> —
> NTDEV is sponsored by OSR
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>