hi,all this is my code…
VOID NotifyRoutine (HANDLE parentId,HANDLE processId,BOOLEAN Create)
{
PROC_INFO p_info;
PEPROCESS pEProcess;
NTSTATUS nts;
HANDLE hProcess;
ULONG ulSize;
PUNICODE_STRING pusImageName = NULL;
p_info.parent = parentId;
p_info.process = processId;
p_info.create = Create;
if(Create) DbgPrint(“Execution detected.PID :%d”,processId);
else DbgPrint(“Termination detected.PID :%d”,processId);
PsLookupProcessByProcessId(processId,&pEProcess);
nts = ObOpenObjectByPointer(pEProcess,
OBJ_KERNEL_HANDLE,
NULL,
0,
NULL,
KernelMode,
&hProcess);
if(nts == STATUS_SUCCESS)ObDereferenceObject (pEProcess);
if (!NT_SUCCESS(nts))return;
nts = ZwQueryInformationProcess (hProcess,
27,
0,0,
&ulSize);
if (nts != STATUS_INFO_LENGTH_MISMATCH)return;
pusImageName = (PUNICODE_STRING)
ExAllocatePoolWithTag(PagedPool,(SIZE_T)ulSize,‘cccc’);
if (!pusImageName){
DbgPrint(“pusImageName is still NULL”);
return;
}
nts = ZwQueryInformationProcess(hProcess,
27,
pusImageName,
ulSize,
&ulSize);
if (!NT_SUCCESS(nts))
{
DbgPrint(“zwQuery is NULL”);
}
else
{
UNICODE_STRING pusDosPath;
UNICODE_STRING ObjectName;
PFILE_OBJECT f_object;
PDEVICE_OBJECT d_object;
WCHAR wchar_DHV1 = L"\Device\LanmanRedirector\10.0.0.5\c" ;
DbgPrint(“Image Name:%ws\n”,pusImageName->Buffer);
RtlInitUnicodeString(&ObjectName, wchar_DHV1);
if(
(nts=IoGetDeviceObjectPointer(&ObjectName,FILE_READ_ATTRIBUTES,&f_object,&d_object))==STATUS_SUCCESS)
{
UNICODE_STRING dName;
POBJECT_NAME_INFORMATION objName;
DbgPrint(“IoGetDeviceObjectPointer Success”);
if((nts=RtlVolumeDeviceToDosName(d_object,&dName))==STATUS_SUCCESS)
{
DbgPrint(“Name:%ws”,dName.Buffer);
}
if(IoQueryFileDosDeviceName(f_object,&objName)==STATUS_SUCCESS)
{
DbgPrint(“Success IoQueryFileDosDeviceName”);
}
}
else
{
DbgPrint(“%x IoGetDeviceObjectPointer UnSuccess”,nts);
}
//ExFreePool(ObjectName.Buffer);
}
ExFreePoolWithTag(pusImageName,‘cccc’);
if(index >=INDEX_MAX)index=0;
if( index < INDEX_MAX ){
memcpy(&p_buffer[index],&p_info,sizeof(PROC_INFO));
index++;
}
}
still i cant solve this problem.linker error is there.
On Sat, Sep 4, 2010 at 11:33 PM, Tim Roberts wrote:
> Dheeraj Patni wrote:
> > thanks Mark,
> > but i am not able to resolve it.I am using Xp,but winddk cant compile it.
>
> You are compiling a kernel-mode module, right? That’s a kernel API, not
> a user-mode API.
>
> If you can’t get it to fly, zip up your project and send it to me
> privately. I’ll take a look.
>
> –
> Tim Roberts, xxxxx@probo.com
> Providenza & Boekelheide, Inc.
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
–
-Dheeraj Patni
Live and let Live