Convert DOS and NT paths using RTL functions

If you are here reading this post, it means you are looking for a way to convert your DOS and/or NT paths for your software. Rest assured that this is what you will learn here today!

The problem with Windows paths are clear; it’s so confusing. Let me repeat that, so confusing. This becomes a problem when you are working on your amazing piece of software and you need to convert DOS and NT paths.

In this article I will try to keep things short and sweet, so let’s begin.

There are functions that are undocumented inside ntdll that can be used for different conversions. The list of these functions begin with Rtl* and are as follows:

RtlDosPathNameToNtPathName_U (all windows)
RtlDosPathNameToNtPathName_U_WithStatus (all windows)
RtlDosLongPathNameToNtPathName_U_WithStatus (windows 10 Redstone 3)
RtlDosPathNameToRelativeNtPathName_U (all windows)
RtlDosPathNameToRelativeNtPathName_U_WithStatus (all windows)
RtlDosLongPathNameToRelativeNtPathName_U_WithStatus (windows 10 Redstone 3)
RtlNtPathNameToDosPathName (all windows; This particular function is quite a mystery because you cannot find definitions or information about it anywhere. However we will test all these functions accordingly and see their output.)

The above functions have the same input/output parameters:

DosFileName (in – required): A constant string containing the DOS name of the target file or directory.
NtFileName (out – required): Return the NT path to a file or directory. Must use a UNICODE_STRING which does not need to be initialised.
FilePart (out – optional): At the output, the file name address in the generated path will be entered into the pointer. If this parameter is filled with NULL in the output, then only the directory name is specified.
RelativeName (out – optional): Pointer to a RTL_RELATIVE_NAME_U structure containing information about the current directory.

For our play with these functions I have defined 3 paths:

1static const wchar_t NormalNamespace[MAX_PATH]  = L"C:\\Windows\\System32\\csrss.exe"; // Normal Win32 namespace
2static const wchar_t DeviceNamespace[MAX_PATH]  = L"\\\\.\\C:\\Windows\\System32\\csrss.exe"; // Win32 Device Namespace
3static const wchar_t FileNamespace[MAX_PATH]    = L"\\\\?\\C:\\Windows\\System32\\csrss.exe"; // Win32 Device Namespace
4static const wchar_t DevicePath[MAX_PATH]       = L"\\Device\\HarddiskVolume1\\Windows\\System32\\csrss.exe"; // Win32 Device Path
5static const wchar_t ExtraTest[MAX_PATH]        = L"directory.name\\file.name"; // Relative Path

Using RtlDosPathNameToNtPathName\_U

This function will return a BOOLEAN.

TRUE – The path transform operation completed successfully.
FALSE – The path conversion operation failed.

Code:

 1{
 2    UNICODE_STRING Converted{};
 3    RTL_RELATIVE_NAME_U RelativeName{};
 4    PWSTR FilePart{};
 5
 6    static const wchar_t NormalNamespace[MAX_PATH]  = L"C:\\Windows\\System32\\csrss.exe"; // Normal Win32 namespace
 7    static const wchar_t DeviceNamespace[MAX_PATH]  = L"\\\\.\\C:\\Windows\\System32\\csrss.exe"; // Win32 Device Namespace
 8    static const wchar_t FileNamespace[MAX_PATH]    = L"\\\\?\\C:\\Windows\\System32\\csrss.exe"; // Win32 Device Namespace
 9    static const wchar_t DevicePath[MAX_PATH]       = L"\\Device\\HarddiskVolume1\\Windows\\System32\\csrss.exe"; // Win32 Device Path
10    static const wchar_t ExtraTest[MAX_PATH]        = L"directory.name\\file.name"; // Relative Path
11
12    pRtlDosPathNameToNtPathName_U _RtlDosPathNameToNtPathName_U = reinterpret_cast<pRtlDosPathNameToNtPathName_U>(GetProcAddress(GetModuleHandle(L"ntdll.dll"), "RtlDosPathNameToNtPathName_U"));
13
14    if (_RtlDosPathNameToNtPathName_U(NormalNamespace, &Converted, &FilePart, &RelativeName))
15    {
16        std::wcout << L"[NormalNamespace] (previous): " << NormalNamespace << std::endl;
17        std::wcout << L"[NormalNamespace] (converted): " << Converted.Buffer << std::endl;
18        std::wcout << L"[NormalNamespace] FilePart: " << FilePart << std::endl;
19        std::wcout << L"[NormalNamespace] RelativeName.Buffer: " << ((RelativeName.RelativeName.Buffer != NULL) ? RelativeName.RelativeName.Buffer : L"NULL") << std::endl;
20        std::wcout << L"[NormalNamespace] ContainingDirectory: " << (void*)RelativeName.ContainingDirectory << std::endl;
21        std::wcout << L"[NormalNamespace] CurDirRef->DirectoryHandle: " << ((RelativeName.CurDirRef != nullptr) ? (void*)RelativeName.CurDirRef->DirectoryHandle : L"NULL") << std::endl;
22        std::wcout << L"[NormalNamespace] CurDirRef->ReferenceCount: " << ((RelativeName.CurDirRef != nullptr) ? RelativeName.CurDirRef->ReferenceCount : 0UL) << std::endl;
23    }
24
25    std::wcout << L"------------------------------------------------------------------------" << std::endl;
26
27    Converted = { 0 };
28    RelativeName = { 0 };
29    FilePart = { 0 };
30
31    if (_RtlDosPathNameToNtPathName_U(DeviceNamespace, &Converted, &FilePart, &RelativeName))
32    {
33        std::wcout << L"[DeviceNamespace] (previous): " << DeviceNamespace << std::endl;
34        std::wcout << L"[DeviceNamespace] (converted): " << Converted.Buffer << std::endl;
35        std::wcout << L"[DeviceNamespace] FilePart: " << FilePart << std::endl;
36        std::wcout << L"[DeviceNamespace] RelativeName.Buffer: " << ((RelativeName.RelativeName.Buffer != NULL) ? RelativeName.RelativeName.Buffer : L"NULL") << std::endl;
37        std::wcout << L"[DeviceNamespace] ContainingDirectory: " << (void*)RelativeName.ContainingDirectory << std::endl;
38        std::wcout << L"[DeviceNamespace] CurDirRef->DirectoryHandle: " << ((RelativeName.CurDirRef != nullptr) ? (void*)RelativeName.CurDirRef->DirectoryHandle : L"NULL") << std::endl;
39        std::wcout << L"[DeviceNamespace] CurDirRef->ReferenceCount: " << ((RelativeName.CurDirRef != nullptr) ? RelativeName.CurDirRef->ReferenceCount : 0UL) << std::endl;
40    }
41
42    std::wcout << L"------------------------------------------------------------------------" << std::endl;
43
44    Converted = { 0 };
45    RelativeName = { 0 };
46    FilePart = { 0 };
47
48    if (_RtlDosPathNameToNtPathName_U(FileNamespace, &Converted, &FilePart, &RelativeName))
49    {
50        std::wcout << L"[FileNamespace] (previous): " << FileNamespace << std::endl;
51        std::wcout << L"[FileNamespace] (converted): " << Converted.Buffer << std::endl;
52        std::wcout << L"[FileNamespace] FilePart: " << FilePart << std::endl;
53        std::wcout << L"[FileNamespace] RelativeName.Buffer: " << ((RelativeName.RelativeName.Buffer != NULL) ? RelativeName.RelativeName.Buffer : L"NULL") << std::endl;
54        std::wcout << L"[FileNamespace] ContainingDirectory: " << (void*)RelativeName.ContainingDirectory << std::endl;
55        std::wcout << L"[FileNamespace] CurDirRef->DirectoryHandle: " << ((RelativeName.CurDirRef != nullptr) ? (void*)RelativeName.CurDirRef->DirectoryHandle : L"NULL") << std::endl;
56        std::wcout << L"[FileNamespace] CurDirRef->ReferenceCount: " << ((RelativeName.CurDirRef != nullptr) ? RelativeName.CurDirRef->ReferenceCount : 0UL) << std::endl;
57    }
58
59    std::wcout << L"------------------------------------------------------------------------" << std::endl;
60
61    Converted = { 0 };
62    RelativeName = { 0 };
63    FilePart = { 0 };
64
65    if (_RtlDosPathNameToNtPathName_U(DevicePath, &Converted, &FilePart, &RelativeName))
66    {
67        std::wcout << L"[DevicePath] (previous): " << DevicePath << std::endl;
68        std::wcout << L"[DevicePath] (converted): " << Converted.Buffer << std::endl;
69        std::wcout << L"[DevicePath] FilePart: " << FilePart << std::endl;
70        std::wcout << L"[DevicePath] RelativeName.Buffer: " << ((RelativeName.RelativeName.Buffer != NULL) ? RelativeName.RelativeName.Buffer : L"NULL") << std::endl;
71        std::wcout << L"[DevicePath] ContainingDirectory: " << (void*)RelativeName.ContainingDirectory << std::endl;
72        std::wcout << L"[DevicePath] CurDirRef->DirectoryHandle: " << ((RelativeName.CurDirRef != nullptr) ? (void*)RelativeName.CurDirRef->DirectoryHandle : L"NULL") << std::endl;
73        std::wcout << L"[DevicePath] CurDirRef->ReferenceCount: " << ((RelativeName.CurDirRef != nullptr) ? RelativeName.CurDirRef->ReferenceCount : 0UL) << std::endl;
74    }
75
76    std::wcout << L"------------------------------------------------------------------------" << std::endl;
77
78    Converted = { 0 };
79    RelativeName = { 0 };
80    FilePart = { 0 };
81
82    if (_RtlDosPathNameToNtPathName_U(ExtraTest, &Converted, &FilePart, &RelativeName))
83    {
84        std::wcout << L"[ExtraTest] (previous): " << ExtraTest << std::endl;
85        std::wcout << L"[ExtraTest] (converted): " << Converted.Buffer << std::endl;
86        std::wcout << L"[ExtraTest] FilePart: " << FilePart << std::endl;
87        std::wcout << L"[ExtraTest] RelativeName.Buffer: " << ((RelativeName.RelativeName.Buffer != NULL) ? RelativeName.RelativeName.Buffer : L"NULL") << std::endl;
88        std::wcout << L"[ExtraTest] ContainingDirectory: " << (void*)RelativeName.ContainingDirectory << std::endl;
89        std::wcout << L"[ExtraTest] CurDirRef->DirectoryHandle: " << ((RelativeName.CurDirRef != nullptr) ? (void*)RelativeName.CurDirRef->DirectoryHandle : L"NULL") << std::endl;
90        std::wcout << L"[ExtraTest] CurDirRef->ReferenceCount: " << ((RelativeName.CurDirRef != nullptr) ? RelativeName.CurDirRef->ReferenceCount : 0UL) << std::endl;
91    }
92}

Result:

Notes:

If you relative path, the function will still succeed. However the output will contain not only the NT path but it will also prepend the current working directory path. Check the last test result.

Using RtlDosPathNameToNtPathName\_U\_WithStatus

This function will return NTSTATUS instead of BOOLEAN.

It is exactly the same as the above one RtlDosPathNameToNtPathName_U, however with this version you can retrieve the last NTSTATUS if the function has failed.

Using RtlDosLongPathNameToNtPathName\_U\_WithStatus

This function will return NTSTATUS.

From my tests this function returned the exact same result as above, however with this version you can retrieve the last NTSTATUS if the function has failed.

This function is only available starting Windows 10 Redstone 3. I cannot find anything special about it.

From my guess it can convert longer paths, hence the “long” in the function name.

Using RtlDosPathNameToRelativeNtPathName\_U

This function will return a BOOLEAN.

From my tests this function returned the exact same result as above, so I`m not sure what’s the deal with it. (feel free to comment)

Using RtlDosPathNameToRelativeNtPathName\_U\_WithStatus

This function will return NTSTATUS instead of BOOLEAN.

From my tests this function returned the exact same result as above, so I`m not sure what’s the deal with it. (feel free to comment)

Using RtlDosLongPathNameToRelativeNtPathName\_U\_WithStatus

This function will return NTSTATUS instead of BOOLEAN.

Once again this function returned the same results, maybe I am calling it wrong. (feel free to comment)

This function is only available starting Windows 10 Redstone 3.

Using RtlNtPathNameToDosPathName

This function will return a NTSTATUS.

The function itself is interesting, as it’s purpose is to reverse what we achieved above. To be honest I had a hard time finding some documentation, like anything at all just to test it.

Flags (in – optional): I have no idea what it’s for.
Path (in/out – required): Pointer to RTL_UNICODE_STRING_BUFFER initialised structure. It will also contain the result after execution.
Disposition (in – optional): I have no idea what it’s for.
FilePart (out- optional): I have no idea what it’s for.

From my tests you can only convert paths and not full paths (eg. to a file) with this function. If you try a full path it will not convert it, but it will still execute normally o.O

Code:

 1{
 2
 3    RTL_UNICODE_STRING_BUFFER DosPath = { 0 };
 4    PWSTR FilePart{};
 5
 6    UNICODE_STRING NtPath;
 7    RtlInitUnicodeString(&NtPath, L"\\??\\C:\\WINDOWS\\system32\\drivers");
 8
 9    wchar_t* DosPathBuffer = NULL;
10    wchar_t* NtPathBuffer = NULL;
11
12    DosPathBuffer = (wchar_t*)new char[NtPath.Length + sizeof(wchar_t)];
13    NtPathBuffer  = (wchar_t*)new char[NtPath.Length + sizeof(wchar_t)];
14
15    RtlZeroMemory(DosPathBuffer, NtPath.Length + sizeof(wchar_t));
16    RtlZeroMemory(NtPathBuffer, NtPath.Length + sizeof(wchar_t));
17    RtlCopyMemory(DosPathBuffer, NtPath.Buffer, NtPath.Length);
18    RtlCopyMemory(NtPathBuffer, NtPath.Buffer, NtPath.Length);
19
20    DosPath.ByteBuffer.Buffer       = DosPathBuffer;
21    DosPath.ByteBuffer.StaticBuffer = NtPathBuffer;
22    DosPath.String.Buffer           = NtPath.Buffer;
23    DosPath.String.Length           = NtPath.Length;
24    DosPath.String.MaximumLength    = NtPath.Length;
25    DosPath.ByteBuffer.Size         = NtPath.Length;
26    DosPath.ByteBuffer.StaticSize   = NtPath.Length;
27
28    pRtlNtPathNameToDosPathName _RtlNtPathNameToDosPathName = reinterpret_cast<pRtlNtPathNameToDosPathName>(GetProcAddress(GetModuleHandle(L"ntdll.dll"), "RtlNtPathNameToDosPathName"));
29
30    if (NT_SUCCESS(_RtlNtPathNameToDosPathName(0, &DosPath, NULL, &FilePart)))
31    {
32        //RtlCopyMemory(pszDosPath, ByteDosPathBuffer, wcslen(ByteDosPathBuffer) * sizeof(wchar_t));
33
34        std::wcout << L"[NtPath] (previous): " << NtPath.Buffer << std::endl;
35        std::wcout << L"[DosPathBuffer] (converted): " << DosPathBuffer << std::endl;
36        std::wcout << L"[NtPathBuffer] (untouched): " << NtPathBuffer << std::endl;
37        std::wcout << L"[NormalNamespace] FilePart: " << ((FilePart != nullptr) ? FilePart : L"NULL") << std::endl;
38    }
39
40    std::wcout << L"------------------------------------------------------------------------" << std::endl;
41
42}

Result:

The code example I posted is confusing, however let me try to clear the air. What happens is that this function will replace the NT paths in the structure provided.

I have set a breakpoint before the function executes: