🚀 go-pugleaf

Hi Bob, in this particular case, i'm hooking the lowest native api call used 
to create a process i.e. Nt/ZwCreateSection.  This is the format that the 
file path is returned in, when i query the file handle of this api (using 
ZwQueryObject).

Any other ideas?

"Bob Gonder" <notbg@notmindspring.invalid> wrote in message 
news:pn4f93pgj3ghntrb47c12he658laicl5ps@4ax.com...
> Mike Collins wrote:
>
>>However, with respect to application execution, i get a path returned from
>>the control mechanism in the form of :
>>
>>\Device\Harddisk\Volume1\Windows\system32\notepad.exe
>
> Not ringing any bells here.
> What is the control mechanism using to create this path?
>
> Can you show a real example of what that path looks like for
> C:\Windows\System32\notepad.exe
>
>>- what i need to know it, how to i convert to and from the two types of
>>paths that i'm being provided with.  Is it possible to convert the 
>>"c:\..."
>>path to a "\Device\.." style path?
>>
>>Hope this makes sense,
>
> The question makes sense, just the \Device\Harddisk\Volume1\
> is a bit hazy.
>
> You can get a volume from GetVolumeInformation(), but I have no idea
> if that is what you want for that portion of the path.
>
> Probably you will end up somewhere in DeviceIoControl()
>
>
>