Reply To: retrieving full process image path name in kernel mode

Home Forums Discussions General retrieving full process image path name in kernel mode Reply To: retrieving full process image path name in kernel mode

#5882
Vadim Smirnov
Keymaster

    Yes there is last field EPROCESS block which points to a UNICODE_STRING which gives me the FullPathName , but still I am not able to get the Drive Letters form there.

    Drive letter is a symbolic link to disk object, so you can enumerate symbolic links to get the exact mappings.

    I had one more query ,what does DEVICEMAP field in EPROCESS strucure signify…?

    Devicemap is used when object manager sees a name beginning from ?? for getting the object directory to use for the particular process.