Home › Forums › Discussions › General Discussion › retrieving full process image path name in kernel mode › Reply To: retrieving full process image path name in kernel mode
Yes there is last field EPROCESS block which points to a UNICODE_STRING which gives me the FullPathName , but still I am not able to get the Drive Letters form there.
Drive letter is a symbolic link to disk object, so you can enumerate symbolic links to get the exact mappings.
I had one more query ,what does DEVICEMAP field in EPROCESS strucure signify…?
Devicemap is used when object manager sees a name beginning from ?? for getting the object directory to use for the particular process.