Следующий код решил проблему
KAPC_STATE ka_state;
WCHAR CWDBuffer[MAX_PATH] = { 0 };
USHORT CWDBytes = 0;
UNICODE_STRING GetProcessPeb = RTL_CONSTANT_STRING(L"PsGetProcessPeb");
PsGetPeb = (PsGetProcessPeb)MmGetSystemRoutineAddress(&GetProcessPeb);
if (PsGetPeb)
{
Peb = PsGetPeb(Process); // Process is handle to current process
if (Peb) {
KeStackAttachProcess(Process, &ka_state);
if (Peb->ProcessParameters->CurrentDirectory.DosPath.Length < (MAX_PATH * sizeof(WCHAR)))
{
CWDBytes = Peb->ProcessParameters->CurrentDirectory.DosPath.Length;
}
else
{
CWDBytes = MAX_PATH * sizeof(WCHAR);
}
memcpy(CWDBuffer, Peb->ProcessParameters->CurrentDirectory.DosPath.Buffer, CWDBytes);
KeUnstackDetachProcess(&ka_state);
}
else {
DbgPrintEx(
DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL,
"Unable to get PEB\n"
);
}
}