Detect Driver

#include "drvCommon.h"

#include "KernelNames.h"
#include "KernelHandleGuard.h"
#include "StringUtils.h"

namespace utils
{

void ResolveSymbolicLink(PUNICODE_STRING symLink, 
                         PUNICODE_STRING target,
                         std::vector<char>* targetBuffer)
{
    OBJECT_ATTRIBUTES   objAttr;
    InitializeObjectAttributes(&objAttr, symLink, 
                               OBJ_KERNEL_HANDLE|OBJ_CASE_INSENSITIVE,0,0);

    // Get sym link handle
    HANDLE hSymLink;
    NTSTATUS status = ZwOpenSymbolicLinkObject(&hSymLink, GENERIC_READ, &objAttr);
    if( !NT_SUCCESS(status) )
        throw std::exception("Can't open symbolic link.");

    HandleGuard guardhandle(hSymLink);

    // Get name size
    ULONG neededLength = NULL;
    UNICODE_STRING targetStr = {0,0,NULL};
    status = ZwQuerySymbolicLinkObject(hSymLink,&targetStr,&neededLength);
    if( status != STATUS_BUFFER_TOO_SMALL)
        throw std::exception("Can't get symbolic link target name size.");

    // Prepare buffer
    targetBuffer->resize(neededLength);
    target->Length = target->MaximumLength = neededLength;
    target->Buffer = (wchar_t*)&targetBuffer->front();

    // Get name
    status = ZwQuerySymbolicLinkObject(hSymLink,target,&neededLength);
    if( !NT_SUCCESS(status) )
        throw std::exception("Can't query symbolic link.");
}

std::wstring ConvertUserToKernelPath(const std::wstring& userPath)
{
    if( userPath.empty() )
        throw std::exception("Path can't be empty.");

    std::wstring driveName;
    driveName += userPath.at(0);
    driveName += L':';

    std::wstring driveNameInGlobals = L"\\??\\" + driveName;
    
    UNICODE_STRING driveNameInGlobalsUS = wstring2UnicodeStr(driveNameInGlobals);

    std::vector<char> buffer;
    UNICODE_STRING kernelDriveNameUS;
    ResolveSymbolicLink(&driveNameInGlobalsUS,&kernelDriveNameUS,&buffer);

    std::wstring kernelDriverName = unicodeStr2wstring(&kernelDriveNameUS);
    std::wstring kernelPath = userPath;
    
    size_t pos = kernelPath.find(driveName);
    if( pos == std::wstring::npos )
        throw std::exception("Internal error. Can't find drive name inside userPath.");

    kernelPath.replace(pos,driveName.length(),kernelDriverName.c_str(),kernelDriverName.length());
    
    return kernelPath;
}

}