Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding a related function to NtQueryInformationProcess #18

Merged
merged 2 commits into from
Dec 31, 2024

Conversation

libyanlake
Copy link
Contributor

@libyanlake libyanlake commented Dec 29, 2024

Decompilation of GetLogicalDrives shows it uses NtQueryInformationProcess under the hood;

DWORD GetLogicalDrives
{
      int32_t buffer;
      NTSTATUS status = NtQueryInformationProcess(-1, 0x17, &buffer, 0x24, 0);
      
      if (status < STATUS_SUCCESS)
      {
          BaseSetLastNTError(status);
          return 0;
      }
      
      int32_t rax = buffer;
      
      if (rax != 0)
          return rax;
      
      RtlSetLastWin32Error(0);
      return buffer;
}

As such, I find it logical to add it to the "Related Win32 API" paragraph.

@m417z
Copy link
Owner

m417z commented Dec 30, 2024

@diversenok can you review please?

@diversenok
Copy link
Contributor

Yeah, looks good.
@libyanlake, you can also add the same link in processinfoclass.md under related APIs for ProcessDeviceMap (23) since that's what the function uses.

@libyanlake
Copy link
Contributor Author

Sure, done. Is there anywhere else it should be added?

@m417z m417z merged commit 24af683 into m417z:main Dec 31, 2024
1 check passed
@m417z
Copy link
Owner

m417z commented Dec 31, 2024

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants