KernelMode.info

#include <ntddk.h>
#include <windef.h>

PVOID pBuffer;
NTSTATUS NTGetLogicalDrives(OUT DWORD *pDiskNumber);

NTSTATUS WINAPI ZwQueryInformationProcess(
	_In_      HANDLE           ProcessHandle,
	_In_      PROCESSINFOCLASS ProcessInformationClass,//ProcessDeviceMap
	_Out_     PVOID            ProcessInformation,
	_In_      ULONG            ProcessInformationLength,
	_Out_opt_ PULONG           ReturnLength
);


VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
	//UNREFERENCED_PARAMETER(pDriverObject);//close error tip
	KdPrint(("DriverUnload.....\n"));

	return;
}



NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING pRegPath) {
	NTSTATUS status;

	pDriverObject->DriverUnload = DriverUnload;
	KdPrint(("DriverEntry.....\n"));

	int dm = 0;
	DWORD *pDiskNumber = &dm;
	status = NTGetLogicalDrives(pDiskNumber);

	KdPrint(("%d.....\n", status));

	KdPrint(("0x%p.....\n", dm));

	return status;
}

NTSTATUS NTGetLogicalDrives(OUT DWORD *pDiskNumber) {
	NTSTATUS status;

	HANDLE handle = -1;
	PVOID pBuffer = ExAllocatePool(NonPagedPool, 4);

	status = ZwQueryInformationProcess(handle, 0x17,pBuffer, 0x24, 0);
	if (NT_SUCCESS(status))
	{
		*pDiskNumber = *(int *)pBuffer;

	}
	//ExFreePool(pBuffer);//blue screen

	return status;
}