Reply To: retrieving full process image path name in kernel mode

Home Forums Discussions General Discussion retrieving full process image path name in kernel mode Reply To: retrieving full process image path name in kernel mode

#5882

Vadim Smirnov
Moderator

Yes there is last field EPROCESS block which points to a UNICODE_STRING which gives me the FullPathName , but still I am not able to get the Drive Letters form there.

Drive letter is a symbolic link to disk object, so you can enumerate symbolic links to get the exact mappings.

I had one more query ,what does DEVICEMAP field in EPROCESS strucure signify…?

Devicemap is used when object manager sees a name beginning from ?? for getting the object directory to use for the particular process.