note : ObReferenceObjectByName usage

69 阅读 0 评论 46 点赞

我是靠谱客的博主体贴金鱼，最近开发中收集的这篇文章主要介绍note : ObReferenceObjectByName usage，觉得挺不错的，现在分享给大家，希望可以做个参考。

概述

得到驱动对象

/// 系统全局变量声明
extern POBJECT_TYPE *IoDriverObjectType;

/// 常量, 用WinObj.exe 可以看到
#define DRVOBJ_NAME_XX    L"\xx"

NTSTATUS
GetDriverObject(
    WCHAR * pcDriverObjectName, 
    PDRIVER_OBJECT * ppDrvObj);

NTSTATUS GetDriverObject(WCHAR * pcDriverObjectName, PDRIVER_OBJECT * ppDrvObj)
{
    NTSTATUS        status = STATUS_UNSUCCESSFUL;
    UNICODE_STRING  strDrvObjName;

    if (NULL == ppDrvObj)
        return status;

    /// 得到驱动对象
    /// 参数2 参考 InitializeObjectAttributes.Attributes
    /// 内核句柄 |大小写不敏感
    RtlInitUnicodeString(&strDrvObjName, pcDriverObjectName);
    status = ObReferenceObjectByName(
        &strDrvObjName,    ///< IN PUNICODE_STRING ObjectName,
        OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, ///< IN ULONG Attributes,
        NULL, ///< IN PACCESS_STATE PassedAccessState OPTIONAL,
        0, ///< IN ACCESS_MASK DesiredAccess OPTIONAL,
        *IoDriverObjectType, ///< IN POBJECT_TYPE ObjectType,
        KernelMode, ///< IN KPROCESSOR_MODE AccessMode,
        NULL, ///< IN OUT PVOID ParseContext OPTIONAL,
        ppDrvObj ///< OUT PVOID *Object
        );

    return status;
}

调用代码

NTSTATUS ProcessXX()
{
    NTSTATUS        status = STATUS_UNSUCCESSFUL;
    PDRIVER_OBJECT  pDrvObj = NULL;
    
    DBGPRT((">> ProcessXXn"));

    status = GetDriverObject(DRVOBJ_NAME_XX, &pDrvObj);
    if (!NT_SUCCESS(status))
        goto _ProcessXX_END;

    DBGPRT((
        "pDrvObj->DriverName = %wZn" 
        "pDrvObj->HardwareDatabase = %wZrn", 
        &pDrvObj->DriverName,
        pDrvObj->HardwareDatabase));

_ProcessXX_END:    
    if (NULL != pDrvObj)
        ObDereferenceObject(pDrvObj); ///< !
        
    DBGPRT(("<< ProcessXXn"));
    return status;
}