PsSetLoadImageNotifyRoutine loadImageNotifyRoutine 中拿全路径

PsSetLoadImageNotifyRoutine

#include <ntifs.h>
#include <ntddk.h>
#include <Ntstrsafe.h>
#include <fltKernel.h>


//删除指针
#define SafeFreeDelete(pData) { if(pData){ExFreePool(pData);pData=NULL;} }

//减少对象引用计数
#define SafeDereferenceObject(Object) { if(Object){ObDereferenceObject(Object);Object=NULL;} }

//关闭句柄
#define SafeCloseHandle(Handle) { if(Handle){ZwClose(Handle);Handle=NULL;} }



//分配内存
PUNICODE_STRING ExAllocateUnicodeStingPool(PUNICODE_STRING strBuff)
{
        PUNICODE_STRING AllocateString = NULL;
        if (MmIsAddressValid(strBuff) == FALSE || strBuff == NULL || strBuff->Buffer == NULL || strBuff->Length < sizeof(wchar_t))
        {
                ASSERT(FALSE);
                return NULL;
        }


        AllocateString = ExAllocatePool(NonPagedPool, sizeof(UNICODE_STRING) + strBuff->Length + sizeof(wchar_t));
        if (AllocateString == NULL)
        {
                ASSERT(FALSE);
                return NULL;
        }

        RtlZeroMemory(AllocateString, sizeof(UNICODE_STRING) + strBuff->Length + sizeof(wchar_t));
        AllocateString->Length = strBuff->Length;
        AllocateString->MaximumLength = AllocateString->Length + sizeof(wchar_t);
        AllocateString->Buffer = (PWSTR)(((PUCHAR)AllocateString) + sizeof(UNICODE_STRING));
        RtlCopyMemory(AllocateString->Buffer, strBuff->Buffer, strBuff->Length);

        return AllocateString;
}

//获取符号链接对象
NTSTATUS GetSymbolicLinkObject(PUNICODE_STRING pDeviceLinkName, PDEVICE_OBJECT* pDeviceObject, PFILE_OBJECT* pFileObject,PUNICODE_STRING* pDeviceVolumeName)
{
        NTSTATUS status = STATUS_UNSUCCESSFUL;