Thread View: borland.public.cppbuilder.nativeapi
5 messages
5 total messages
Started by Mike Collins
Fri, 13 Jul 2007 15:10
Converting to and from *extended file paths *
Author: Mike Collins
Date: Fri, 13 Jul 2007 15:10
Date: Fri, 13 Jul 2007 15:10
31 lines
2204 bytes
2204 bytes
Hi all, got what seems like a simple problem but can't find the right answer anywhere. We have been developing a product suite of unique parental control solutions. The latest instalment provides the facility for a parent to decide what can be "done" on the computer. This has been achieved using a mixture of filter-layer drivers and dll injection / api hooking. The control system "talks" back with a service to ask if the *hooked* item or api can be allowed to execute. This is done using a specific IPC system. The control mechanism is now completed and i'm approaching the easier task of writing the control panel application that configures what can and can't be done. - All done in Builder!!! However, with respect to application execution, i get a path returned from the control mechanism in the form of : \Device\Harddisk\Volume1\Windows\system32\notepad.exe Now i'm developing a Control Panel applet where the user can specify the applications that they want to restrict. Obviously within this applet, the application paths will be in the form of: C:\Windows\System32\notepad.exe - what i need to know it, how to i convert to and from the two types of paths that i'm being provided with. Is it possible to convert the "c:\..." path to a "\Device\.." style path? Hope this makes sense, Many thanks in advance,
Re: Converting to and from *extended file paths *
Author: Bob Gonder
Date: Fri, 13 Jul 2007 15:09
Date: Fri, 13 Jul 2007 15:09
26 lines
1801 bytes
1801 bytes
Mike Collins wrote: >However, with respect to application execution, i get a path returned from >the control mechanism in the form of : > >\Device\Harddisk\Volume1\Windows\system32\notepad.exe Not ringing any bells here. What is the control mechanism using to create this path? Can you show a real example of what that path looks like for C:\Windows\System32\notepad.exe >- what i need to know it, how to i convert to and from the two types of >paths that i'm being provided with. Is it possible to convert the "c:\..." >path to a "\Device\.." style path? > >Hope this makes sense, The question makes sense, just the \Device\Harddisk\Volume1\ is a bit hazy. You can get a volume from GetVolumeInformation(), but I have no idea if that is what you want for that portion of the path. Probably you will end up somewhere in DeviceIoControl()
Re: Converting to and from *extended file paths *
Author: Mike Collins
Date: Sat, 14 Jul 2007 18:02
Date: Sat, 14 Jul 2007 18:02
39 lines
2329 bytes
2329 bytes
Hi Bob, in this particular case, i'm hooking the lowest native api call used to create a process i.e. Nt/ZwCreateSection. This is the format that the file path is returned in, when i query the file handle of this api (using ZwQueryObject). Any other ideas? "Bob Gonder" <notbg@notmindspring.invalid> wrote in message news:pn4f93pgj3ghntrb47c12he658laicl5ps@4ax.com... > Mike Collins wrote: > >>However, with respect to application execution, i get a path returned from >>the control mechanism in the form of : >> >>\Device\Harddisk\Volume1\Windows\system32\notepad.exe > > Not ringing any bells here. > What is the control mechanism using to create this path? > > Can you show a real example of what that path looks like for > C:\Windows\System32\notepad.exe > >>- what i need to know it, how to i convert to and from the two types of >>paths that i'm being provided with. Is it possible to convert the >>"c:\..." >>path to a "\Device\.." style path? >> >>Hope this makes sense, > > The question makes sense, just the \Device\Harddisk\Volume1\ > is a bit hazy. > > You can get a volume from GetVolumeInformation(), but I have no idea > if that is what you want for that portion of the path. > > Probably you will end up somewhere in DeviceIoControl() > > >
Re: Converting to and from *extended file paths *
Author: Bob Gonder
Date: Sun, 15 Jul 2007 15:38
Date: Sun, 15 Jul 2007 15:38
27 lines
1849 bytes
1849 bytes
Mike Collins wrote: >Hi Bob, in this particular case, i'm hooking the lowest native api call used >to create a process i.e. Nt/ZwCreateSection. This is the format that the >file path is returned in, when i query the file handle of this api (using >ZwQueryObject). Do you have a link to this Query? MSDN doesn't have that function. >>>\Device\Harddisk\Volume1\Windows\system32\notepad.exe If that is the actual string returned, then maybe this would work? I suppose you just know that it is a device of some sort. "\\Device" You can GetDriveType "\\Harddisk" "\\Cdrom" You can query the drive for PARTITION_INFORMATION_EX "\\Volume"+pie.PartitionNumber Or my previous suggestion GetVolumeInformation "\\"+lpVolumeNameBuffer Add the path.
Re: Converting to and from *extended file paths *
Author: Mike Collins
Date: Mon, 16 Jul 2007 12:26
Date: Mon, 16 Jul 2007 12:26
52 lines
2719 bytes
2719 bytes
Thanks for the input Bob, was really just looking for some starting points - which you have given me. Basically, most of the native API's aren't documented on MSDN - the only partial references are in the DDK - but mostly these related to kernal mode functions. I had to hunt for days to find the information that i needed. There are a few reference books out there: Windows 2000 - Undocumented Secrets Windows 2000 / NT Native API reference Windows NT Undocumented APIs (www.ntinternals.net) www.sysinternals.com - if there is anythings specific that you would like to know, please feel free to e-mail me and i'll show you what i have... "Bob Gonder" <notbg@notmindspring.invalid> wrote in message news:cndk93hd6roqqs7lsso36q8lo9eibusamu@4ax.com... > Mike Collins wrote: > >>Hi Bob, in this particular case, i'm hooking the lowest native api call >>used >>to create a process i.e. Nt/ZwCreateSection. This is the format that the >>file path is returned in, when i query the file handle of this api (using >>ZwQueryObject). > > Do you have a link to this Query? > MSDN doesn't have that function. > >>>>\Device\Harddisk\Volume1\Windows\system32\notepad.exe > > If that is the actual string returned, then maybe this would work? > > I suppose you just know that it is a device of some sort. > "\\Device" > > You can GetDriveType > "\\Harddisk" > "\\Cdrom" > > You can query the drive for PARTITION_INFORMATION_EX > "\\Volume"+pie.PartitionNumber > Or my previous suggestion GetVolumeInformation > "\\"+lpVolumeNameBuffer > > Add the path. > >
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads