IoQueryFullDriverPath function (ntddk.h)
The IoQueryFullDriverPath routine retrieves the full path name of the binary file that is loaded for the specified driver object. Starting in Windows 10 version 1709, callers may query for driver objects that are not their own, as long as they use proper synchronization to ensure that the DRIVER_OBJECT structure remains valid during the call.
Syntax
NTSTATUS IoQueryFullDriverPath(
[in] PDRIVER_OBJECT DriverObject,
[out] PUNICODE_STRING FullPath
);
Parameters
[in] DriverObject
A pointer to a DRIVER_OBJECT structure. If you are calling IoQueryFullDriverPath on a computer running a version of Windows 10 earlier than version 1709, this structure is required to be the driver object for the calling driver.
[out] FullPath
A pointer to a caller-allocated UNICODE_STRING structure. On successful return, this structure contains the path name.
Return value
IoQueryFullDriverPath returns STATUS_SUCCESS if the call successfully fetches the path name. Possible error return values include the following status codes.
| Return code | Description |
|---|---|
| STATUS_ACCESS_DENIED | The target driver object does not belong to the caller. This status code is only returned on versions of Windows 10 earlier than 1709. |
| STATUS_NOT_FOUND | The driver object has no section (loaded memory image) associated with it. |
| STATUS_INSUFFICIENT_RESOURCES | Insufficient resources are available to perform the requested operation. |
Remarks
A driver can call this routine to query for the full path name of its binary file, or, starting in Windows 10 version 1709, the full path name of the binary file for another driver.
The caller allocates the UNICODE_STRING structure pointed to by the FullPath parameter, but does not need to initialize this structure. IoQueryFullDriverPath assumes that the original contents of this structure are invalid and overwrites them. This routine allocates a string buffer from paged system memory, sets the Buffer member of the structure to point to this buffer, and sets the MaximumLength and Buffer members to describe the buffer and its contents.
The caller is responsible for freeing the storage pointed to by FullPath->Buffer when the full path string is no longer needed. Typically, the caller frees this storage by calling a routine such as ExFreePool.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client | Available starting with Windows 8.1. |
| Target Platform | Universal |
| Header | ntddk.h (include Wdm.h, Ntddk.h, Ntifs.h) |
| Library | NtosKrnl.lib |
| DLL | NtosKrnl.exe |
| IRQL | <= APC_LEVEL |