c++cprocessdriverfilter-driver

How get current process image file full name in filter driver?


In filter driver I can call IoGetCurrentProcess to get an PEPROCESS structure, and than call PsGetProcessImageFileName to get file name.

My questions is how I can get full name of the process image file?


Solution

  • here I found full code like @Martin Drab code

    EDIT: new fixed code

    NTSTATUS
    GetProcessImageName(
        PEPROCESS eProcess,
        PUNICODE_STRING* ProcessImageName
        )
    {
        NTSTATUS status = STATUS_UNSUCCESSFUL;
        ULONG returnedLength;
        HANDLE hProcess = NULL;
    
        PAGED_CODE(); // this eliminates the possibility of the IDLE Thread/Process
    
        if (eProcess == NULL)
        {
            return STATUS_INVALID_PARAMETER_1;
        }
    
        status = ObOpenObjectByPointer(eProcess,
            0, NULL, 0, 0, KernelMode, &hProcess);
        if (!NT_SUCCESS(status))
        {
            DbgPrint("ObOpenObjectByPointer Failed: %08x\n", status);
            return status;
        }
    
        if (ZwQueryInformationProcess == NULL)
        {
            UNICODE_STRING routineName = RTL_CONSTANT_STRING(L"ZwQueryInformationProcess");
    
            ZwQueryInformationProcess =
                (QUERY_INFO_PROCESS)MmGetSystemRoutineAddress(&routineName);
    
            if (ZwQueryInformationProcess == NULL)
            {
                DbgPrint("Cannot resolve ZwQueryInformationProcess\n");
                status = STATUS_UNSUCCESSFUL;
                goto cleanUp;
            }
        }
    
        /* Query the actual size of the process path */
        status = ZwQueryInformationProcess(hProcess,
            ProcessImageFileName,
            NULL, // buffer
            0,    // buffer size
            &returnedLength);
    
        if (STATUS_INFO_LENGTH_MISMATCH != status) {
            DbgPrint("ZwQueryInformationProcess status = %x\n", status);
            goto cleanUp;
        }
    
        *ProcessImageName = kmalloc(returnedLength);
    
        if (ProcessImageName == NULL)
        {
            status = STATUS_INSUFFICIENT_RESOURCES;
            goto cleanUp;
        }
    
        /* Retrieve the process path from the handle to the process */
        status = ZwQueryInformationProcess(hProcess,
            ProcessImageFileName,
            *ProcessImageName,
            returnedLength,
            &returnedLength);
    
        if (!NT_SUCCESS(status)) kfree(*ProcessImageName);
    
    cleanUp:
    
        ZwClose(hProcess);
    
        return status;
    }
    
    FLT_POSTOP_CALLBACK_STATUS
    PostCreate(
        _Inout_ PFLT_CALLBACK_DATA Data,
        _In_ PCFLT_RELATED_OBJECTS FltObjects,
        _In_opt_ PVOID CompletionContext,
        _In_ FLT_POST_OPERATION_FLAGS Flags
        )
    {
        PUNICODE_STRING pni = NULL;
        NTSTATUS status = STATUS_UNSUCCESSFUL;
    
        status = GetProcessImageName(IoThreadToProcess(Data->Thread), &pni);
        if (NT_SUCCESS(status))
        {
            DbgPrint("ProcessName = %ws\n", pni->Buffer);
            kfree(pni);
        }
        else
        {
            DbgPrint("GetProcessImageName status = %x\n", status);
        }
    
        // ...
    }