note : Get FilePathName from FILE_OBJECT
转自:http://blog.csdn.net/lostspeed/article/details/11738311
封了一个函数, 从 FILE_OBJECT 中 得到 FilePathName
在WinXpSp3下测试通过.
view plain copy
- BOOLEAN IsValidUnicodeString(PUNICODE_STRING pstr);
[cpp] view plain copy
- BOOLEAN GetFilePathNameFromFileObject(
- FILE_OBJECT * pFileObj,
- UNICODE_STRING * puniFilePathName);
view plain copy
- BOOLEAN GetFilePathNameFromFileObject(
- FILE_OBJECT * pFileObj,
- UNICODE_STRING * puniFilePathName)
- {
- /// puniFilePathName 已经被 RtlInitUnicodeString 初始化过,
- /// .Buffer 有MAX_PATH宽字符长度
-
- BOOLEAN bValidFN_FileObj = FALSE;
- BOOLEAN bValidFN_RelatedFileObj = FALSE;
-
- PFILE_OBJECT pRelatedFileObject = NULL;
- UNICODE_STRING ustrTmp;
- UNICODE_STRING ustrLink; ///< 分隔符号, e.g. L'\\'
-
- if ((NULL == pFileObj) || (NULL == puniFilePathName))
- return FALSE;
-
- /// 初始化数据
- RtlInitUnicodeString(&ustrTmp, NULL);
- RtlInitUnicodeString(&ustrLink, L"\\");
- RtlZeroMemory(puniFilePathName->Buffer, puniFilePathName->MaximumLength);
- puniFilePathName->Length = 0;
-
- pRelatedFileObject = pFileObj->RelatedFileObject;
- bValidFN_FileObj = IsValidUnicodeString(&pFileObj->FileName);
- bValidFN_RelatedFileObj =
- IsValidUnicodeString(&pRelatedFileObject->FileName);
-
- /// 盘符
- IoVolumeDeviceToDosName(pFileObj->DeviceObject, &ustrTmp);
- RtlCopyUnicodeString(puniFilePathName, &ustrTmp);
- RtlFreeUnicodeString(&ustrTmp); ///< !
-
- /// 相对路径
- /// pRelatedFileObject->FileName 也有可能是空的
- /// 相对全路径名称全部在 pFileObj->FileName
- if (bValidFN_RelatedFileObj)
- {
- /// pRelatedFileObject->FileName.Buffer 可能是有效的
- /// 却不是一个可见的宽字符串, 以 L'\0'开头
- if ((L'\\' != pRelatedFileObject->FileName.Buffer[0])
- &&(L'\0' != pRelatedFileObject->FileName.Buffer[0]))
- {
- RtlUnicodeStringCat(puniFilePathName, &ustrLink);
- }
-
- RtlUnicodeStringCat(puniFilePathName, &pRelatedFileObject->FileName);
- }
-
- /// 文件名, 也有可能是包含相对路径的全路径名称.
- /// e.g. "\Windows\System\xx.yyy"
- if (bValidFN_FileObj)
- {
- if ((L'\\' != pFileObj->FileName.Buffer[0])
- && (L'\0' != pFileObj->FileName.Buffer[0]))
- {
- RtlUnicodeStringCat(puniFilePathName, &ustrLink);
- }
-
- RtlUnicodeStringCat(puniFilePathName, &pFileObj->FileName);
- }
-
- return (bValidFN_FileObj || bValidFN_RelatedFileObj);
- }
[cpp] view plain copy
- BOOLEAN IsValidUnicodeString(PUNICODE_STRING pstr)
- {
- BOOLEAN bRc = FALSE;
- ULONG ulIndex = 0;
-
- __try
- {
- if (!MmIsAddressValid(pstr))
- return FALSE;
-
- if ((NULL == pstr->Buffer) || (0 == pstr->Length))
- return FALSE;
-
- for (ulIndex = 0; ulIndex < pstr->Length; ulIndex++)
- {
- if (!MmIsAddressValid((UCHAR *)pstr->Buffer + ulIndex))
- return FALSE;
- }
-
- bRc = TRUE;
- }
-
- __except(EXCEPTION_EXECUTE_HANDLER)
- {
- bRc = FALSE;
- }
-
- return bRc;
- }
view plain copy
- pIoStack = IoGetCurrentIrpStackLocation(pIrp);
[cpp] view plain copy
- pFileObject = pIoStack->FileObject;
- BOOLEAN GetFilePathNameFromFileObject(
- FILE_OBJECT * pFileObj,
- UNICODE_STRING * puniFilePathName)
- {
- /// puniFilePathName 已经被 RtlInitUnicodeString 初始化过,
- /// .Buffer 有MAX_PATH宽字符长度
- BOOLEAN bValidFN_FileObj = FALSE;
- BOOLEAN bValidFN_RelatedFileObj = FALSE;
- PFILE_OBJECT pRelatedFileObject = NULL;
- UNICODE_STRING ustrTmp;
- UNICODE_STRING ustrLink; ///< 分隔符号, e.g. L'\\'
- if ((NULL == pFileObj) || (NULL == puniFilePathName))
- return FALSE;
- /// 初始化数据
- RtlInitUnicodeString(&ustrTmp, NULL);
- RtlInitUnicodeString(&ustrLink, L"\\");
- RtlZeroMemory(puniFilePathName->Buffer, puniFilePathName->MaximumLength);
- puniFilePathName->Length = 0;
- pRelatedFileObject = pFileObj->RelatedFileObject;
- bValidFN_FileObj = IsValidUnicodeString(&pFileObj->FileName);
- bValidFN_RelatedFileObj =
- IsValidUnicodeString(&pRelatedFileObject->FileName);
- /// 盘符
- IoVolumeDeviceToDosName(pFileObj->DeviceObject, &ustrTmp);
- RtlCopyUnicodeString(puniFilePathName, &ustrTmp);
- RtlFreeUnicodeString(&ustrTmp); ///< !
- /// 相对路径
- /// pRelatedFileObject->FileName 也有可能是空的
- /// 相对全路径名称全部在 pFileObj->FileName
- if (bValidFN_RelatedFileObj)
- {
- /// pRelatedFileObject->FileName.Buffer 可能是有效的
- /// 却不是一个可见的宽字符串, 以 L'\0'开头
- if ((L'\\' != pRelatedFileObject->FileName.Buffer[0])
- &&(L'\0' != pRelatedFileObject->FileName.Buffer[0]))
- {
- RtlUnicodeStringCat(puniFilePathName, &ustrLink);
- }
- RtlUnicodeStringCat(puniFilePathName, &pRelatedFileObject->FileName);
- }
- /// 文件名, 也有可能是包含相对路径的全路径名称.
- /// e.g. "\Windows\System\xx.yyy"
- if (bValidFN_FileObj)
- {
- if ((L'\\' != pFileObj->FileName.Buffer[0])
- && (L'\0' != pFileObj->FileName.Buffer[0]))
- {
- RtlUnicodeStringCat(puniFilePathName, &ustrLink);
- }
- RtlUnicodeStringCat(puniFilePathName, &pFileObj->FileName);
- }
- return (bValidFN_FileObj || bValidFN_RelatedFileObj);
- }
- BOOLEAN IsValidUnicodeString(PUNICODE_STRING pstr)
- {
- BOOLEAN bRc = FALSE;
- ULONG ulIndex = 0;
- __try
- {
- if (!MmIsAddressValid(pstr))
- return FALSE;
- if ((NULL == pstr->Buffer) || (0 == pstr->Length))
- return FALSE;
- for (ulIndex = 0; ulIndex < pstr->Length; ulIndex++)
- {
- if (!MmIsAddressValid((UCHAR *)pstr->Buffer + ulIndex))
- return FALSE;
- }
- bRc = TRUE;
- }
- __except(EXCEPTION_EXECUTE_HANDLER)
- {
- bRc = FALSE;
- }
- return bRc;
- }
view plain copy
- pIoStack = IoGetCurrentIrpStackLocation(pIrp);
[cpp] view plain copy
- pFileObject = pIoStack->FileObject;
view plain copy
- WCHAR cFilePathNameW[MAX_PATH];
- UNICODE_STRING unistrFilePathName;
-
- RtlZeroMemory(cFilePathNameW, sizeof(cFilePathNameW));
- RtlInitUnicodeString(&unistrFilePathName, cFilePathNameW);
- unistrFilePathName.MaximumLength = sizeof(cFilePathNameW); ///< !
view plain copy
- DisPatchDeviceControl IOCTL 0x22e000
- cFilePathName[0] = C:\
- cFilePathName[1] = C:\Documents and Settings\All Users\Application Data\VMware
- cFilePathName[2] = C:\Documents and Settings\All Users\Application Data\VMware\VMware Tools
- cFilePathName[3] = C:\Documents and Settings\All Users\Application Data\VMware\VMware Tools\
- cFilePathName[4] = C:\WINDOWS\system32\Msimtf.dll
- cFilePathName[5] = C:\WINDOWS\system32\NOTEPAD.EXE
- cFilePathName[6] = C:\WINDOWS\AppPatch\sysmain.sdb
- cFilePathName[7] = C:\WINDOWS\AppPatch\systest.sdb
- cFilePathName[8] = C:\WINDOWS\system32\
- cFilePathName[9] = C:\WINDOWS\
- cFilePathName[10] = C:\WINDOWS\system32\NOTEPAD.EXE.Manifest
- cFilePathName[11] = C:\WINDOWS\system32\NOTEPAD.EXE.Config
- cFilePathName[12] = C:\WINDOWS\WinSxS\Policies\x86_Policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_zh-CN_f3ffe327\
- cFilePathName[13] = C:\WINDOWS\Assembly\GAC\Policy.6.0.Microsoft.Windows.Common-Controls\
- cFilePathName[14] = C:\WINDOWS\WinSxS\Policies\x86_Policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_zh-CHS_6bff526c\
- cFilePathName[15] = C:\WINDOWS\WinSxS\Policies\x86_Policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775\
- cFilePathName[16] = C:\WINDOWS\WinSxS\Policies\x86_Policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775\6.0.2600.5512.Policy
- cFilePathName[17] = C:\WINDOWS\WinSxS\Policies\x86_Policy.6.0.Microsoft.Windows.Common-Controls.mui_6595b64144ccf1df_zh-CN_b45a2b14\
- cFilePathName[18] = C:\WINDOWS\Assembly\GAC\Policy.6.0.Microsoft.Windows.Common-Controls.mui\
- cFilePathName[19] = C:\WINDOWS\WinSxS\Policies\x86_Policy.6.0.Microsoft.Windows.Common-Controls.mui_6595b64144ccf1df_zh-CHS_2c599a59\
- cFilePathName[20] = C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83.Manifest
- cFilePathName[21] = C:\WINDOWS\Prefetch\NOTEPAD.EXE-336351A9.pf
- cFilePathName[22] = C:\Documents and Settings\Administrator\
- cFilePathName[23] = C:\Documents and Settings\Administrator\桌面\
- cFilePathName[24] = C:\DOCUME~1\
- cFilePathName[25] = C:\DOCUME~1\ADMINI~1\
- cFilePathName[26] = C:\DOCUME~1\ADMINI~1\LOCALS~1\
- cFilePathName[27] = C:\Documents and Settings\Administrator\桌面\abc.txt
- cFilePathName[28] = C:\Documents and Settings\Administrator\桌面
- cFilePathName[29] = C:\SYSTEM VOLUME INFORMATION\
- cFilePathName[30] = C:\Documents and Settings\Administrator\Recent\
- cFilePathName[31] = C:\Documents and Settings\Administrator\Recent\abc.txt.lnk
- cFilePathName[32] = C:\SYSTEM VOLUME INFORMATION\_RESTORE{288FCF24-DDBA-4A0A-98C0-50E279B93ECC}\
- cFilePathName[33] = C:\SYSTEM VOLUME INFORMATION\_RESTORE{288FCF24-DDBA-4A0A-98C0-50E279B93ECC}\RP4\
- cFilePathName[34] = C:\WINDOWS\APPPATCH\
- cFilePathName[35] = C:\WINDOWS\WINSXS\
- cFilePathName[36] = C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.5512_X-WW_35D4CE83\
- cFilePathName[37] = C:\WINDOWS\SYSTEM32\NTDLL.DLL
- cFilePathName[38] = C:\WINDOWS\SYSTEM32\KERNEL32.DLL
- cFilePathName[39] = C:\WINDOWS\SYSTEM32\UNICODE.NLS
- cFilePathName[40] = C:\WINDOWS\SYSTEM32\LOCALE.NLS
- cFilePathName[41] = C:\WINDOWS\SYSTEM32\SORTTBLS.NLS
- cFilePathName[42] = C:\WINDOWS\SYSTEM32\COMDLG32.DLL
- cFilePathName[43] = C:\WINDOWS\SYSTEM32\ADVAPI32.DLL
- cFilePathName[44] = C:\WINDOWS\SYSTEM32\RPCRT4.DLL
- cFilePathName[45] = C:\WINDOWS\SYSTEM32\SECUR32.DLL
- cFilePathName[46] = C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.5512_X-WW_35D4CE83\COMCTL32.DLL
- cFilePathName[47] = C:\WINDOWS\SYSTEM32\MSVCRT.DLL
- cFilePathName[48] = C:\WINDOWS\SYSTEM32\GDI32.DLL
- cFilePathName[49] = C:\WINDOWS\SYSTEM32\USER32.DLL
- cFilePathName[50] = C:\WINDOWS\SYSTEM32\SHLWAPI.DLL
- cFilePathName[51] = C:\WINDOWS\SYSTEM32\SHELL32.DLL
- cFilePathName[52] = C:\WINDOWS\SYSTEM32\WINSPOOL.DRV
- cFilePathName[53] = C:\WINDOWS\SYSTEM32\SHIMENG.DLL
- cFilePathName[54] = C:\WINDOWS\APPPATCH\ACGENRAL.DLL
- cFilePathName[55] = C:\WINDOWS\SYSTEM32\WINMM.DLL
- cFilePathName[56] = C:\WINDOWS\SYSTEM32\OLE32.DLL
- cFilePathName[57] = C:\WINDOWS\SYSTEM32\OLEAUT32.DLL
- cFilePathName[58] = C:\WINDOWS\SYSTEM32\MSACM32.DLL
- cFilePathName[59] = C:\WINDOWS\SYSTEM32\VERSION.DLL
- cFilePathName[60] = C:\WINDOWS\SYSTEM32\USERENV.DLL
- cFilePathName[61] = C:\WINDOWS\SYSTEM32\UXTHEME.DLL
- cFilePathName[62] = C:\WINDOWS\SYSTEM32\CTYPE.NLS
- cFilePathName[63] = C:\WINDOWS\SYSTEM32\IMM32.DLL
- cFilePathName[64] = C:\WINDOWS\SYSTEM32\LPK.DLL
- cFilePathName[65] = C:\WINDOWS\SYSTEM32\USP10.DLL
- cFilePathName[66] = C:\WINDOWS\WINDOWSSHELL.MANIFEST
- cFilePathName[67] = C:\WINDOWS\SYSTEM32\MSCTF.DLL
- cFilePathName[68] = C:\WINDOWS\SYSTEM32\MSCTFIME.IME
- cFilePathName[69] = C:\SYSTEM VOLUME INFORMATION\_RESTORE{288FCF24-DDBA-4A0A-98C0-50E279B93ECC}\RP4\CHANGE.LOG
- cFilePathName[70] = C:\BOOT.INI
- cFilePathName[71] = C:\WINDOWS\SYSTEM32\WIN32K.SYS
- cFilePathName[72] = C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
- cFilePathName[73] = C:\Documents and Settings\
- cFilePathName[74] = C:\Documents and Settings\Administrator\Local Settings\
- cFilePathName[75] = C:\Documents and Settings\Administrator\Local Settings\History\desktop.ini
- cFilePathName[76] = C:\WINDOWS\WindowsShell.Config
- cFilePathName[77] = C:\WINDOWS\system32\SHELL32.dll.124.Manifest
- cFilePathName[78] = C:\WINDOWS\system32\SHELL32.dll.124.Config
- cFilePathName[79] = C:\WINDOWS\Prefetch\
- cFilePathName[80] = C:\WINDOWS\system32\0804\
- cFilePathName[81] = C:\WINDOWS\MUI\Fallback\0804\
- cFilePathName[82] = C:\WINDOWS\system32\DRIVERS\MUI\0804\
- cFilePathName[83] = C:\WINDOWS\system32\DRIVERS\ACPI.sys
- cFilePathName[84] = C:\WINDOWS\system32\DRIVERS\mssmbios.sys
- cFilePathName[85] = C:\WINDOWS\system32\DRIVERS\intelppm.sys
- cFilePathName[86] = C:\WINDOWS\system32\DRIVERS\ipnat.sys
- cFilePathName[87] = C:\WINDOWS\System32\Drivers\HTTP.sys
- cFilePathName[88] = C:\WINDOWS\system32\WBEM\Logs\wmiprov.log
- cFilePathName[89] = C:\WINDOWS\SoftwareDistribution\DataStore\
- cFilePathName[90] = C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.edb
- cFilePathName[91] = C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.edb\
- cFilePathName[92] = C:\WINDOWS\SoftwareDistribution\DataStore
- cFilePathName[93] = C:\WINDOWS\SoftwareDistribution
- cFilePathName[94] = C:\WINDOWS\SoftwareDistribution\
- cFilePathName[95] = C:\WINDOWS
- cFilePathName[96] = C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.chk
- cFilePathName[97] = C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.chk\
- cFilePathName[98] = C:\WINDOWS\SoftwareDistribution\DataStore\Logs
- cFilePathName[99] = C:\WINDOWS\system32\xpsp2res.dll
- DisPatchDeviceControl IOCTL 0x22e000
- cFilePathName[0] = C:\
- cFilePathName[1] = C:\Documents and Settings\All Users\Application Data\VMware
- cFilePathName[2] = C:\Documents and Settings\All Users\Application Data\VMware\VMware Tools
- cFilePathName[3] = C:\Documents and Settings\All Users\Application Data\VMware\VMware Tools\
- cFilePathName[4] = C:\WINDOWS\system32\Msimtf.dll
- cFilePathName[5] = C:\WINDOWS\system32\NOTEPAD.EXE
- cFilePathName[6] = C:\WINDOWS\AppPatch\sysmain.sdb
- cFilePathName[7] = C:\WINDOWS\AppPatch\systest.sdb
- cFilePathName[8] = C:\WINDOWS\system32\
- cFilePathName[9] = C:\WINDOWS\
- cFilePathName[10] = C:\WINDOWS\system32\NOTEPAD.EXE.Manifest
- cFilePathName[11] = C:\WINDOWS\system32\NOTEPAD.EXE.Config
- cFilePathName[12] = C:\WINDOWS\WinSxS\Policies\x86_Policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_zh-CN_f3ffe327\
- cFilePathName[13] = C:\WINDOWS\Assembly\GAC\Policy.6.0.Microsoft.Windows.Common-Controls\
- cFilePathName[14] = C:\WINDOWS\WinSxS\Policies\x86_Policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_zh-CHS_6bff526c\
- cFilePathName[15] = C:\WINDOWS\WinSxS\Policies\x86_Policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775\
- cFilePathName[16] = C:\WINDOWS\WinSxS\Policies\x86_Policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775\6.0.2600.5512.Policy
- cFilePathName[17] = C:\WINDOWS\WinSxS\Policies\x86_Policy.6.0.Microsoft.Windows.Common-Controls.mui_6595b64144ccf1df_zh-CN_b45a2b14\
- cFilePathName[18] = C:\WINDOWS\Assembly\GAC\Policy.6.0.Microsoft.Windows.Common-Controls.mui\
- cFilePathName[19] = C:\WINDOWS\WinSxS\Policies\x86_Policy.6.0.Microsoft.Windows.Common-Controls.mui_6595b64144ccf1df_zh-CHS_2c599a59\
- cFilePathName[20] = C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83.Manifest
- cFilePathName[21] = C:\WINDOWS\Prefetch\NOTEPAD.EXE-336351A9.pf
- cFilePathName[22] = C:\Documents and Settings\Administrator\
- cFilePathName[23] = C:\Documents and Settings\Administrator\桌面\
- cFilePathName[24] = C:\DOCUME~1\
- cFilePathName[25] = C:\DOCUME~1\ADMINI~1\
- cFilePathName[26] = C:\DOCUME~1\ADMINI~1\LOCALS~1\
- cFilePathName[27] = C:\Documents and Settings\Administrator\桌面\abc.txt
- cFilePathName[28] = C:\Documents and Settings\Administrator\桌面
- cFilePathName[29] = C:\SYSTEM VOLUME INFORMATION\
- cFilePathName[30] = C:\Documents and Settings\Administrator\Recent\
- cFilePathName[31] = C:\Documents and Settings\Administrator\Recent\abc.txt.lnk
- cFilePathName[32] = C:\SYSTEM VOLUME INFORMATION\_RESTORE{288FCF24-DDBA-4A0A-98C0-50E279B93ECC}\
- cFilePathName[33] = C:\SYSTEM VOLUME INFORMATION\_RESTORE{288FCF24-DDBA-4A0A-98C0-50E279B93ECC}\RP4\
- cFilePathName[34] = C:\WINDOWS\APPPATCH\
- cFilePathName[35] = C:\WINDOWS\WINSXS\
- cFilePathName[36] = C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.5512_X-WW_35D4CE83\
- cFilePathName[37] = C:\WINDOWS\SYSTEM32\NTDLL.DLL
- cFilePathName[38] = C:\WINDOWS\SYSTEM32\KERNEL32.DLL
- cFilePathName[39] = C:\WINDOWS\SYSTEM32\UNICODE.NLS
- cFilePathName[40] = C:\WINDOWS\SYSTEM32\LOCALE.NLS
- cFilePathName[41] = C:\WINDOWS\SYSTEM32\SORTTBLS.NLS
- cFilePathName[42] = C:\WINDOWS\SYSTEM32\COMDLG32.DLL
- cFilePathName[43] = C:\WINDOWS\SYSTEM32\ADVAPI32.DLL
- cFilePathName[44] = C:\WINDOWS\SYSTEM32\RPCRT4.DLL
- cFilePathName[45] = C:\WINDOWS\SYSTEM32\SECUR32.DLL
- cFilePathName[46] = C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.5512_X-WW_35D4CE83\COMCTL32.DLL
- cFilePathName[47] = C:\WINDOWS\SYSTEM32\MSVCRT.DLL
- cFilePathName[48] = C:\WINDOWS\SYSTEM32\GDI32.DLL
- cFilePathName[49] = C:\WINDOWS\SYSTEM32\USER32.DLL
- cFilePathName[50] = C:\WINDOWS\SYSTEM32\SHLWAPI.DLL
- cFilePathName[51] = C:\WINDOWS\SYSTEM32\SHELL32.DLL
- cFilePathName[52] = C:\WINDOWS\SYSTEM32\WINSPOOL.DRV
- cFilePathName[53] = C:\WINDOWS\SYSTEM32\SHIMENG.DLL
- cFilePathName[54] = C:\WINDOWS\APPPATCH\ACGENRAL.DLL
- cFilePathName[55] = C:\WINDOWS\SYSTEM32\WINMM.DLL
- cFilePathName[56] = C:\WINDOWS\SYSTEM32\OLE32.DLL
- cFilePathName[57] = C:\WINDOWS\SYSTEM32\OLEAUT32.DLL
- cFilePathName[58] = C:\WINDOWS\SYSTEM32\MSACM32.DLL
- cFilePathName[59] = C:\WINDOWS\SYSTEM32\VERSION.DLL
- cFilePathName[60] = C:\WINDOWS\SYSTEM32\USERENV.DLL
- cFilePathName[61] = C:\WINDOWS\SYSTEM32\UXTHEME.DLL
- cFilePathName[62] = C:\WINDOWS\SYSTEM32\CTYPE.NLS
- cFilePathName[63] = C:\WINDOWS\SYSTEM32\IMM32.DLL
- cFilePathName[64] = C:\WINDOWS\SYSTEM32\LPK.DLL
- cFilePathName[65] = C:\WINDOWS\SYSTEM32\USP10.DLL
- cFilePathName[66] = C:\WINDOWS\WINDOWSSHELL.MANIFEST
- cFilePathName[67] = C:\WINDOWS\SYSTEM32\MSCTF.DLL
- cFilePathName[68] = C:\WINDOWS\SYSTEM32\MSCTFIME.IME
- cFilePathName[69] = C:\SYSTEM VOLUME INFORMATION\_RESTORE{288FCF24-DDBA-4A0A-98C0-50E279B93ECC}\RP4\CHANGE.LOG
- cFilePathName[70] = C:\BOOT.INI
- cFilePathName[71] = C:\WINDOWS\SYSTEM32\WIN32K.SYS
- cFilePathName[72] = C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
- cFilePathName[73] = C:\Documents and Settings\
- cFilePathName[74] = C:\Documents and Settings\Administrator\Local Settings\
- cFilePathName[75] = C:\Documents and Settings\Administrator\Local Settings\History\desktop.ini
- cFilePathName[76] = C:\WINDOWS\WindowsShell.Config
- cFilePathName[77] = C:\WINDOWS\system32\SHELL32.dll.124.Manifest
- cFilePathName[78] = C:\WINDOWS\system32\SHELL32.dll.124.Config
- cFilePathName[79] = C:\WINDOWS\Prefetch\
- cFilePathName[80] = C:\WINDOWS\system32\0804\
- cFilePathName[81] = C:\WINDOWS\MUI\Fallback\0804\
- cFilePathName[82] = C:\WINDOWS\system32\DRIVERS\MUI\0804\
- cFilePathName[83] = C:\WINDOWS\system32\DRIVERS\ACPI.sys
- cFilePathName[84] = C:\WINDOWS\system32\DRIVERS\mssmbios.sys
- cFilePathName[85] = C:\WINDOWS\system32\DRIVERS\intelppm.sys
- cFilePathName[86] = C:\WINDOWS\system32\DRIVERS\ipnat.sys
- cFilePathName[87] = C:\WINDOWS\System32\Drivers\HTTP.sys
- cFilePathName[88] = C:\WINDOWS\system32\WBEM\Logs\wmiprov.log
- cFilePathName[89] = C:\WINDOWS\SoftwareDistribution\DataStore\
- cFilePathName[90] = C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.edb
- cFilePathName[91] = C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.edb\
- cFilePathName[92] = C:\WINDOWS\SoftwareDistribution\DataStore
- cFilePathName[93] = C:\WINDOWS\SoftwareDistribution
- cFilePathName[94] = C:\WINDOWS\SoftwareDistribution\
- cFilePathName[95] = C:\WINDOWS
- cFilePathName[96] = C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.chk
- cFilePathName[97] = C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.chk\
- cFilePathName[98] = C:\WINDOWS\SoftwareDistribution\DataStore\Logs
- cFilePathName[99] = C:\WINDOWS\system32\xpsp2res.dll