ANTICHAT — форум по информационной безопасности, OSINT и технологиям

NTSTATUS DriverEntry( IN PDRIVER_OBJECT DriverObject , IN PUNICODE_STRING RegistryPath )
{
	NTSTATUS ns;
	PFILE_OBJECT pFileObject;
	PDEVICE_OBJECT pDev;
	UNICODE_STRING usDiskName;
	UNICODE_STRING usLinkName;


	RtlInitUnicodeString( &usDiskName , L"\\Device\\CdRom0" );

	ns = IoGetDeviceObjectPointer( &usDiskName , FILE_ALL_ACCESS , &pFileObject , &pDev );

	if( !NT_SUCCESS(ns) )
	{
		KdPrint(("IoGetDeviceObjectPointer failed with status : %08X\n" , ns ));
		goto _end;
	}

	ns = IoVolumeDeviceToDosName( pDev , &usLinkName );

	if( !NT_SUCCESS(ns) )
	{
		KdPrint(("IoVolumeDeviceToDosName failed with status : %08X\n" , ns ));
		goto _end;
	}

	KdPrint(("Symbolick link is :%ws \n" , usLinkName.Buffer ));

_end:
	return ns;
}

char data[256];
char disk[]="A:";
for (int i='A'; i<='Z'; i++)
{
 disk[0] = i;
 QueryDosDeviceA(disk, data, 256);
 printf("%c: - %s\n", i, data);
}

#include<stdio.h>
#include<windows.h>
#include"ntdll.h"

#pragma comment ( lib , "ntdll.lib" )

int main( int argc , char*argv[] )
{
	NTSTATUS ns;
	HANDLE hDirectory;
	UNICODE_STRING usDirectoryName;
	OBJECT_ATTRIBUTES oa;

	RtlInitUnicodeString( &usDirectoryName , L"\\GLOBAL??" ); // windows 2000 - \??

	InitializeObjectAttributes( &oa , &usDirectoryName , OBJ_CASE_INSENSITIVE , NULL , NULL );

	ns = NtOpenDirectoryObject( &hDirectory , DIRECTORY_QUERY | DIRECTORY_TRAVERSE , &oa );

	if( !NT_SUCCESS(ns) )
	{
		printf("NtOpenDirectoryObject failed with status : %08X\n" , ns );
		return -1;
	}
	CloseHandle( hDirectory );
	return 0;
}

UCHAR GetDiskByDevice(char * device)
{
 char data[256];
 char disk[]="A:";
 for (int i='A'; i<='Z'; i++)
 {
  disk[0] = i;
  QueryDosDeviceA(disk, data, 256);
  if (!strcmp(data,device)) return i;
 }
 return 0;
}
int main(int argc, char* argv[])
{
 UCHAR disk;
 disk = GetDiskByDevice("\\Device\\CdRom1");
 printf("%c\n",disk);
 return 0;
}