Reply To: retrieving full process image path name in kernel mode

Home › Forums › Discussions › General › retrieving full process image path name in kernel mode › Reply To: retrieving full process image path name in kernel mode

July 31, 2006 at 11:53 am #5876
bitshaker
Participant

    Hi,

    I found my mistake, I need to use _SEGMENT instead of _SEGMENT_OBJECT, even if it is written different while analyzing structures from kernel debugger. I found that in calls to MapViewOfSection, there are some ControlAreas that have no FileObject associated? Can someone tell me why?

    Many Thx!