From 1f8be438815007d84f9d7882b74ed0e686565545 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <carter.li@eoitek.com>
Date: Mon, 25 Mar 2024 10:09:05 +0800
Subject: [PATCH] Disk (Windows): use MS-DOS device name as mountFrom result,
 instead of useless GUID volume name

---
 CHANGELOG.md                      |  3 +++
 src/detection/disk/disk_windows.c | 20 ++++++++++++--------
 src/modules/disk/disk.c           | 12 ++++++++++--
 3 files changed, 25 insertions(+), 10 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 72ba71d35..583283942 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,8 @@
 # 2.8.10
 
+Changes:
+* Use MS-DOS device name as mountFrom result, instead of useless GUID volume name (Windows, Disk)
+
 Bugfixes:
 * Don't display 0.00 GHz (CPU, FreeBSD)
 * Don't detect manufactor of Qualcomm as ARM (CPU, Android)
diff --git a/src/detection/disk/disk_windows.c b/src/detection/disk/disk_windows.c
index 24a1651ba..cf951f294 100644
--- a/src/detection/disk/disk_windows.c
+++ b/src/detection/disk/disk_windows.c
@@ -15,7 +15,7 @@ const char* ffDetectDisksImpl(FFlist* disks)
 
     for(uint32_t i = 0; i < length; i++)
     {
-        const wchar_t* mountpoint = buf + i;
+        wchar_t* mountpoint = buf + i;
 
         UINT driveType = GetDriveTypeW(mountpoint);
         if(driveType == DRIVE_NO_ROOT_DIR)
@@ -25,13 +25,6 @@ const char* ffDetectDisksImpl(FFlist* disks)
         }
 
         FFDisk* disk = ffListAdd(disks);
-        ffStrbufInitWS(&disk->mountpoint, mountpoint);
-
-        wchar_t volumeName[64];
-        if(GetVolumeNameForVolumeMountPointW(mountpoint, volumeName, sizeof(volumeName) / sizeof(*volumeName)))
-            ffStrbufInitWS(&disk->mountFrom, volumeName);
-        else
-            ffStrbufInit(&disk->mountFrom);
 
         if(!GetDiskFreeSpaceExW(
             mountpoint,
@@ -78,6 +71,17 @@ const char* ffDetectDisksImpl(FFlist* disks)
                 disk->type |= FF_DISK_VOLUME_TYPE_READONLY_BIT;
         }
 
+        ffStrbufInitWS(&disk->mountpoint, mountpoint);
+        if (mountpoint[2] == L'\\' && mountpoint[3] == L'\0')
+        {
+            wchar_t volumeName[MAX_PATH + 1];
+            mountpoint[2] = L'\0';
+            if(QueryDosDeviceW(mountpoint, volumeName, sizeof(volumeName) / sizeof(*volumeName)))
+                ffStrbufInitWS(&disk->mountFrom, volumeName);
+            else
+                ffStrbufInit(&disk->mountFrom);
+        }
+
         //Unsupported
         disk->filesUsed = 0;
         disk->filesTotal = 0;
diff --git a/src/modules/disk/disk.c b/src/modules/disk/disk.c
index b5137fa95..20c53f980 100644
--- a/src/modules/disk/disk.c
+++ b/src/modules/disk/disk.c
@@ -422,8 +422,16 @@ void ffGenerateDiskJsonResult(FFDiskOptions* options, yyjson_mut_doc* doc, yyjso
         yyjson_mut_obj_add_uint(doc, bytes, "used", item->bytesUsed);
 
         yyjson_mut_val* files = yyjson_mut_obj_add_obj(doc, obj, "files");
-        yyjson_mut_obj_add_uint(doc, files, "total", item->filesTotal);
-        yyjson_mut_obj_add_uint(doc, files, "used", item->filesUsed);
+        if (item->filesTotal == 0 && item->filesUsed == 0)
+        {
+            yyjson_mut_obj_add_null(doc, files, "total");
+            yyjson_mut_obj_add_null(doc, files, "used");
+        }
+        else
+        {
+            yyjson_mut_obj_add_uint(doc, files, "total", item->filesTotal);
+            yyjson_mut_obj_add_uint(doc, files, "used", item->filesUsed);
+        }
 
         yyjson_mut_obj_add_strbuf(doc, obj, "filesystem", &item->filesystem);
         yyjson_mut_obj_add_strbuf(doc, obj, "mountpoint", &item->mountpoint);