🚀 go-pugleaf

Thanks for the input Bob, was really just looking for some starting points - 
which you have given me.

Basically, most of the native API's aren't documented on MSDN - the only 
partial references are in the DDK - but mostly these related to kernal mode 
functions.  I had to hunt for days to find the information that i needed. 
There are a few reference books out there:

Windows 2000 - Undocumented Secrets

Windows 2000 / NT Native API reference

Windows NT Undocumented APIs (www.ntinternals.net)

www.sysinternals.com

- if there is anythings specific that you would like to know, please feel 
free to e-mail me and i'll show you what i have...


"Bob Gonder" <notbg@notmindspring.invalid> wrote in message 
news:cndk93hd6roqqs7lsso36q8lo9eibusamu@4ax.com...
> Mike Collins wrote:
>
>>Hi Bob, in this particular case, i'm hooking the lowest native api call 
>>used
>>to create a process i.e. Nt/ZwCreateSection.  This is the format that the
>>file path is returned in, when i query the file handle of this api (using
>>ZwQueryObject).
>
> Do you have a link to this Query?
> MSDN doesn't have that function.
>
>>>>\Device\Harddisk\Volume1\Windows\system32\notepad.exe
>
> If that is the actual string returned, then maybe this would work?
>
> I suppose you just know that it is a device of some sort.
> "\\Device"
>
> You can  GetDriveType
> "\\Harddisk"
> "\\Cdrom"
>
> You can query the drive for PARTITION_INFORMATION_EX
> "\\Volume"+pie.PartitionNumber
> Or my previous suggestion GetVolumeInformation
> "\\"+lpVolumeNameBuffer
>
> Add the path.
>
>