0

I´ve tried to minimise the example as much as possible.

I have the following function that tries to convert a "\Device\Harddiskvolumex\path" file path to "C:\path" and return it as a PUNICODE_STRING.

/*
path has a string such as L"C:\\path"
*/
PUNICODE_STRING convert_path(WCHAR* path)
{
    HANDLE fileHandle = NULL;
    OBJECT_ATTRIBUTES objectAttributes;
    PUNICODE_STRING myUnicodeStr=NULL;
    PFILE_OBJECT  Object = NULL;
    POBJECT_NAME_INFORMATION dosNameInfo = NULL;
    RtlInitUnicodeString(myUnicodeStr, path);
    InitializeObjectAttributes(&objectAttributes,
        myUnicodeStr,
        OBJ_CASE_INSENSITIVE,
        NULL,
        NULL);
    ZwOpenSymbolicLinkObject(&fileHandle, GENERIC_READ, &objectAttributes);
    ZwQuerySymbolicLinkObject(fileHandle,myUnicodeStr, NULL);
    ObReferenceObjectByHandle(
                fileHandle,
                GENERIC_READ,
                NULL,
                KernelMode,
                (PVOID*)Object,
                NULL);
    IoQueryFileDosDeviceName(Object, &dosNameInfo);
    ExFreePool(Object);
    return &(dosNameInfo->Name);
}

When I use it in my code as:

UNICODE_STRING myUnicodeStr;
RtlCopyUnicodeString(&myUnicodeStr, convert_path(L"C:\\Users\\JohnDoe\\file.txt"));
//I expect myUnicodeStr->Buffer contains L"Device\Harddiskvolumex\\Users\\JohnDoe\\file.txt"

I am not getting the path in format "\Device\Harddiskvolumex\path" because when I filter on this path I am getting a blue screen; and I cannot figure out what I am doing wroing in my function.

I suppose the problem is the opposite as the one posted in here.

0 Answers0