\WINDOWS and \SystemRoot

NTFSD
1

Hi.

I have a few questions.

How do I change a path starting with “\WINDOWS” to “C:” and \DEVICE\HARDDISK0\PARTITION0

If I believed \WINDOWS was always on the \SystemRoot drive, what about \Program Files and \Program Files (x86)? Can these be on different drives?

Is there an easy was to translate “C:” to “\DEVICE\HARDDISK0\PARITION0”

Another question on a different related topic. Can I ever load a Network Filter with fltmc?

2

For c: -> \device\n you need to open the symbolic link object. See
ZwOpenSymbolicLinkObject.
For DOS paths without a driver letter you are out of luck. A path like
\windows does not have to be the system \windows path.

Bill Wandel

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@hotmail.co.uk
Sent: Wednesday, December 30, 2009 4:10 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] \WINDOWS and \SystemRoot

Hi.

I have a few questions.

How do I change a path starting with “\WINDOWS” to “C:” and
\DEVICE\HARDDISK0\PARTITION0

If I believed \WINDOWS was always on the \SystemRoot drive, what about
\Program Files and \Program Files (x86)? Can these be on different drives?

Is there an easy was to translate “C:” to “\DEVICE\HARDDISK0\PARITION0”

Another question on a different related topic. Can I ever load a Network
Filter with fltmc?

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars (including our new fs
mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

Actually I may be in some luck because it is the LoadImageNotifyRoutine that is reporting \WINDOWS\something.exe, just like it sometimes report \SystemRoot\something.dll or \Device\HardDisk0\Parition0\something.exe

Can I assume in this case \WINDOWS\ is always on the same drive as \SystemRoot\ ?

RE: \WINDOWS and \SystemRoot

For c: -> \device\n you need to open the symbolic link object. See
ZwOpenSymbolicLinkObject.
For DOS paths without a driver letter you are out of luck. A path like
\windows does not have to be the system \windows path.

Bill Wandel

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@hotmail.co.uk
Sent: Wednesday, December 30, 2009 4:10 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] \WINDOWS and \SystemRoot

Hi.

I have a few questions.

How do I change a path starting with “\WINDOWS” to “C:” and
\DEVICE\HARDDISK0\PARTITION0

If I believed \WINDOWS was always on the \SystemRoot drive, what about
\Program Files and \Program Files (x86)? Can these be on different drives?

Is there an easy was to translate “C:” to “\DEVICE\HARDDISK0\PARITION0”

Another question on a different related topic. Can I ever load a Network
Filter with fltmc?

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars (including our new fs
mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

4

Just note that any directory on NTFS can be setup as a junction point which points to a different volume.

Bronislav Gabrhelik

5

You are assuming that \windows is the system windows directory. What if the
user created another windows directory on a different drive?

Bill Wandel

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@hotmail.co.uk
Sent: Thursday, December 31, 2009 3:41 AM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] \WINDOWS and \SystemRoot

Actually I may be in some luck because it is the LoadImageNotifyRoutine that
is reporting \WINDOWS\something.exe, just like it sometimes report
\SystemRoot\something.dll or \Device\HardDisk0\Parition0\something.exe

Can I assume in this case \WINDOWS\ is always on the same drive as
\SystemRoot\ ?

RE: \WINDOWS and \SystemRoot

For c: -> \device\n you need to open the symbolic link object. See
ZwOpenSymbolicLinkObject.
For DOS paths without a driver letter you are out of luck. A path like
\windows does not have to be the system \windows path.

Bill Wandel

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@hotmail.co.uk
Sent: Wednesday, December 30, 2009 4:10 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] \WINDOWS and \SystemRoot

Hi.

I have a few questions.

How do I change a path starting with “\WINDOWS” to “C:” and
\DEVICE\HARDDISK0\PARTITION0

If I believed \WINDOWS was always on the \SystemRoot drive, what about
\Program Files and \Program Files (x86)? Can these be on different drives?

Is there an easy was to translate “C:” to “\DEVICE\HARDDISK0\PARITION0”

Another question on a different related topic. Can I ever load a Network
Filter with fltmc?

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars (including our new fs
mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars (including our new fs
mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

6

Is there another solution?

I have the string “\WINDOWS\some.exe” and that is all the LoadImageNotifyRoutine has given the driver. I can see no other assumption the driver could make. Sometimes “\Device\HarddiskVolume1\WINDOWS\some.exe” is given. Is it safe for the driver to assume if \Device\ it is possible it is present then it is on another drive to \SystemRoot\ ?