euhat

NTSTATUS querySymbolicLink(PUNICODE_STRING symbolicLinkName, PUNICODE_STRING linkTarget)
{
	OBJECT_ATTRIBUTES oa;
	NTSTATUS status;
	HANDLE handle;
 
	InitializeObjectAttributes(&oa, symbolicLinkName, OBJ_CASE_INSENSITIVE, 0, 0);
	status = ZwOpenSymbolicLinkObject(&handle, GENERIC_READ, &oa);
	if (!NT_SUCCESS(status))
		return status;
 
	linkTarget->MaximumLength = 200 * sizeof(WCHAR);
	linkTarget->Length = 0;
	linkTarget->Buffer = ExAllocatePool(PagedPool, linkTarget->MaximumLength);
	if (!linkTarget->Buffer)
	{
		ZwClose(handle);
		return STATUS_INSUFFICIENT_RESOURCES;
	}
	RtlZeroMemory(linkTarget->Buffer, linkTarget->MaximumLength);
 
	status = ZwQuerySymbolicLinkObject(handle, linkTarget, NULL);
	ZwClose(handle);
 
	if (!NT_SUCCESS(status))
	{
		ExFreePool(linkTarget->Buffer);
	}
	return status;
}
 
WCHAR *rtlVolumeDeviceToDosName(WCHAR *deviceName)
{
	NTSTATUS status;
	UNICODE_STRING driveLetterName;
	WCHAR driveLetterNameBuf[128];
	WCHAR c;
	WCHAR driLetter[3];
	UNICODE_STRING linkTarget;
 
	for (c = L'A'; c <= L'Z'; c++)
	{
		RtlInitEmptyUnicodeString(&driveLetterName, driveLetterNameBuf, sizeof(driveLetterNameBuf));
		RtlAppendUnicodeToString(&driveLetterName, L"\\??\\");
		driLetter[0] = c;
		driLetter[1] = L':';
		driLetter[2] = 0;
		RtlAppendUnicodeToString(&driveLetterName, driLetter);
 
		status = querySymbolicLink(&driveLetterName, &linkTarget);
		if (!NT_SUCCESS(status))
			continue;
 
		if (_wcsnicmp(linkTarget.Buffer, deviceName, linkTarget.Length) == 0)
		{
			deviceName += linkTarget.Length - 2;
			deviceName[0] = c;
			deviceName[1] = L":";
			ExFreePool(linkTarget.Buffer);
			break;
		}
		ExFreePool(linkTarget.Buffer);
	}
	return deviceName;
}
 
WCHAR *getDosPath(WCHAR *path)
{
	WCHAR device[] = L"\\Device\\";
 
	if (strIsStartWith(path, device))
	{
		path = rtlVolumeDeviceToDosName(path);
	}
 
	return path;
}