Full file path with drive letter

Question

I am a beginner in driver development. I am developing a filter driver(Kernel Mode). I want to get the full path of every file which is opened. I have a file object and an IRP. I am using &pFileObject->fileName to display the path. It shows the complete path but dose not show drive letter. Kindly provide a kernel level routine which tells the drive letter. below is the code

#include "StdAfx.h"
#include "drv_common.h"
#include "ntddk.h"
#include "FsFilter.h"


///////////////////////////////////////////////////////////////////////////////////////////    ////////
// PassThrough IRP Handler

NTSTATUS FsFilterDispatchPassThrough( __in PDEVICE_OBJECT DeviceObject, __in PIRP Irp )
{
    PFSFILTER_DEVICE_EXTENSION pDevExt = (PFSFILTER_DEVICE_EXTENSION)DeviceObject-    >DeviceExtension;

    IoSkipCurrentIrpStackLocation(Irp);
    return IoCallDriver(pDevExt->AttachedToDeviceObject, Irp);
}

///////////////////////////////////////////////////////////////////////////////////////////    ////////
// IRP_MJ_CREATE IRP Handler

NTSTATUS FsFilterDispatchCreate(
    __in PDEVICE_OBJECT DeviceObject,
    __in PIRP           Irp
    )
{
    PFILE_OBJECT pFileObject = IoGetCurrentIrpStackLocation(Irp)->FileObject;

    DbgPrint("%wZ\n", &pFileObject->FileName);

    return FsFilterDispatchPassThrough(DeviceObject, Irp);
}

Stack Overflow is a not a "plz give me teh codez" website. You need to explain what you've tried, show some actual code, and explain where it goes wrong. People are much more willing to help if you demonstrate that you've put some effort into solving the problem yourself. — Cody Gray - on strike, Mar 17 '13 at 11:01
Try `IoVolumeDeviceToDosName` http://msdn.microsoft.com/en-us/library/windows/hardware/ff550422(v=vs.85).aspx — Serg, Mar 18 '13 at 08:07
Thanks sergmat for help..On using this routine VM crashes.. What could br its reason?? — Muhammad Irfan, Mar 19 '13 at 09:34

score 1 · Answer 1 · answered Mar 20 '13 at 04:38

As @sergmat suggested you can use IoVolumeDeviceToDosName routine to get the volume name. But be sure that you call that route only at PASSIVE_LEVEL, which might be what you are experiencing.

Also, using pFileObject->FileName in dispatch routine is not recommended. The memory may come from paged pool which is not accessible in DISPATCH_LEVEL or higher.

Full file path with drive letter

1 Answers1