[Hippey]

Hi all!

Can anybody give me a code, which would extract ImageFileName of EPROCESS in Dos format(like C:\\) for kernel driver?

Thanks!

[rkhunter]

How do you imagine that? ImageFileName holds only ImageName, "explorer.exe", for example. Look PsGetProcessImageFileName for that. Other information is stored in PEB and you can access it through NtQueryInformationProcess.

[EP_X0FF]

Hi all!

Can anybody give me a code, which would extract ImageFileName of EPROCESS in Dos format(like C:\\) for kernel driver?

Thanks!

http://www.kernelmode.info/forum/viewto ... 03&p=10941

Closed as duplicate. Author gets achievement - creation of three closed topics.