Problem with paths to files (in Kernel Mode)

[Samael6]

Hello,
I have written small NtCreateFile intercepter (legacy driver). It will a filter with a list of denied files.
But I have a problem with paths to files.
The problem is in the next: windows has a several types for paths (DOS path, UNC, using symbolic links, etc). For example, I have seen these variants:

- ??C:dirfile.ext

- DosDevicesC:dirfile.ext

- GLOBAL??C:dirfile.ext

- DeviceHarddisk0Partition1dirfile.ext

- DeviceHarddiskVolume1dirfile.ext

- ??C:WINDOWSsystem32shell32.dll

- DeviceLanmanRedirectorPHILKALINEAGE II - INTERLUDE (shared resource on PHILKA)

- ??UNCPHILKALINEAGE II - INTERLUDE (again)

- DEVICEHARDDISKVOLUME2PROGRAM FILESDEBUGVIEWDBGVIEW.EXE (starting app)

As you can see, there are different variants to call a file.
How can I support all these types? Is it possible to reduce all these types to one (any one)?

Thank you.

[Samael6]

I have found a solution.
No more help needed

[alex_s]

@Samael6 wrote:

I have found a solution.
No more help needed

VolumeDeviceToDosName ?

[lovepkfilter]

@alex_s wrote:

@Samael6 wrote:

I have found a solution.
No more help needed

VolumeDeviceToDosName ?

3ks alex_s

[Author]

Posts