title: Hooking SSDT. Other driver uses my function
body: <p>How can I get the driver name or driver path inside its context? I mean when not my driver uses syscall and i hook it, i need to get this driver's name. For user processes there is no problem:</p>
  
  <pre><code>PUNICODE_STRING myname;
  SeLocateProcessImageName(PsGetCurrentProcess(), &amp;myname);
  </code></pre>
  
  <p>But if alien driver uses hooked syscall, its PID is 4. And I cannot get name like above...
  Here it is full hook's code:</p>
  
  <pre><code>    NTSTATUS
  HookNtTerminateProcess(
      HANDLE hProcess,
      NTSTATUS ExitStatus
      )
  {
      NTSTATUS statuscod;
      if (hProcess == NULL || hProcess == (HANDLE)-1 || hProcess&lt;2) {
          return fnNtTerminateProcess(hProcess, ExitStatus);
      }
      if (PsGetCurrentProcessId() == 4)
      {
          ???????????????????????????
      }
      PUNICODE_STRING name;
      getPathByProcessHandle(hProcess, &amp;name);
      PUNICODE_STRING myname;
      SeLocateProcessImageName(PsGetCurrentProcess(), &amp;myname);
  
      DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "\n-------------------------------------------\n");
      DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "KILL TO PROCESS WITH HANDLE %d\n", hProcess);
      DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "WHO: %S\n", myname-&gt;Buffer);
      DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "TARGET: %S\n", name-&gt;Buffer);
      DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "PID is %d\n", PsGetCurrentProcessId());
  
      NTSTATUS status;
      if (wcsstr(name-&gt;Buffer, L"Windows\\protecteddir\\myapp.exe") == NULL) {
          return fnNtTerminateProcess(hProcess, ExitStatus);
      }
      sendEvent(0, PsGetCurrentProcessId());
      return STATUS_ACCESS_DENIED;
  }
  </code></pre>