A forum for reverse engineering, OS internals and malware analysis 

Ask your beginner questions here.
 #9091  by 0xC0000022L
 Tue Oct 11, 2011 8:00 pm
Tigzy wrote:Well, found.

The path needs to refer to a file within the sys32 folder :!:
For drivers, yes. System32 is also known as SystemRoot (there is also a variable of that same name) and appears under the name \SystemRoot in the object manager's namespace.

However, I think for non-boot drivers it's possible to give a complete path, as long as it is using the native format, i.e. \??\C:\... or a device path \Device\...

Remember that the components loading the drivers are not Win32 but instead have no subsystem.