GetDriveType function
Determines whether a disk drive is a removable, fixed, CD-ROM, RAM disk, or network drive.
To determine whether a drive is a USB-type drive, call SetupDiGetDeviceRegistryProperty and specify theSPDRP_REMOVAL_POLICY property.
Syntax
UINT WINAPI GetDriveType( _In_opt_ LPCTSTR lpRootPathName );
Parameters
- lpRootPathName [in, optional]
The root directory for the drive.
A trailing backslash is required. If this parameter is NULL, the function uses the root of the current directory.
Return value
The return value specifies the type of drive, which can be one of the following values.
| Return code/value | Description |
|---|---|
| The drive type cannot be determined. |
| The root path is invalid; for example, there is no volume mounted at the specified path. |
| The drive has removable media; for example, a floppy drive, thumb drive, or flash card reader. |
| The drive has fixed media; for example, a hard disk drive or flash drive. |
| The drive is a remote (network) drive. |
| The drive is a CD-ROM drive. |
| The drive is a RAM disk. |
GetDriveType
- Return 값에 따른 드라이브 Type을 결정짓고, 이에 따른 악성 행위를 분기할 수 있음
- 최근 말레이시아에서 존재했던 Mumblehard ELF 악성 코드도 분석된 결과에 따르면 Removable Device를 찾아 그에 따른 악성 행위를 진행했다고 하는데, 위와 같이 특정 API를 사용했을 것이라 추측해본다.
