首页 > WinDriver > WD-ObReferenceObjectByName通过设备对象名获取驱动对象(DRIVER_OBJ)
2013七月4

WD-ObReferenceObjectByName通过设备对象名获取驱动对象(DRIVER_OBJ)

1.这是个未文档化的NTOS导出函数,其中需要的类型也是未文档化的,都需要提前声明

extern PVOID *IoDriverObjectType;//使用*IoDriverObjectType
NTSTATUS __stdcall
ObReferenceObjectByName(
						__in PUNICODE_STRING ObjectName,
						__in ULONG Attributes,
						__in_opt PACCESS_STATE AccessState,
						__in_opt ACCESS_MASK DesiredAccess,
						__in POBJECT_TYPE ObjectType,
						__in KPROCESSOR_MODE AccessMode,
						__inout_opt PVOID ParseContext,
						__out PVOID *Object
						);

你也可以声明为extern PVOID IoDriverObjectType;//使用IoDriverObjectType

2.示例代码:获取文件系统NTFS.sys的地址:

	NTSTATUS status;
	UNICODE_STRING Unicode_Ntfs;
	PDRIVER_OBJECT Driver_Object_Ntfs;
	int nIndex = 0;
 
	RtlInitUnicodeString(&Unicode_Ntfs, L"\\FileSystem\\Ntfs");
 
	status = ObReferenceObjectByName(&Unicode_Ntfs,
		OBJ_CASE_INSENSITIVE¦OBJ_KERNEL_HANDLE,
		NULL,
		0,
		*IoDriverObjectType,//extern PVOID *IoDriverObjectType;
		KernelMode,
		NULL,
		&Driver_Object_Ntfs);
	if (NT_SUCCESS(status))
	{
		KdPrint(("[FsdHook]-DrvStart:0x%08x,DrvSize:0x%08x", Driver_Object_Ntfs->DriverStart,Driver_Object_Ntfs->DriverSize));
		ObDereferenceObject(Driver_Object_Ntfs);
	}

这个函数原型同样可以在WRK中找到

结果如下:

ntfs.jpg

可以用drivertree查看:

ntfs2.png











文章作者:hgy413
本文地址:https://hgy413.com/1504.html
版权所有 © 转载时必须以链接形式注明作者和原始出处!

30 Responses to “WD-ObReferenceObjectByName通过设备对象名获取驱动对象(DRIVER_OBJ)”

  1. #1 Leigh 回复 | 引用 Post:2016-04-25 05:51

    It’s going to be ending of mine day, but before ending
    I am reading this enormous paragraph to increase
    my experience.

  2. #2 minecraft 回复 | 引用 Post:2018-09-10 07:36

    Hello! I know this is kinda off topic however I’d figured I’d ask.

    Would you be interested in exchanging links or maybe guest authoring a blog article or vice-versa?
    My website covers a lot of the same subjects as yours and
    I feel we could greatly benefit from each other. If you are interested feel
    free to send me an e-mail. I look forward to hearing from you!
    Wonderful blog by the way!

  3. #3 minecraft 回复 | 引用 Post:2018-09-12 03:40

    Aw, this was an incredibly good post. Spending some time and actual effort to make a really good article… but what can I say… I procrastinate a lot and
    never seem to get anything done.

  4. #4 minecraft 回复 | 引用 Post:2018-09-14 10:51

    I enjoy what you guys are up too. Such clever work and reporting!

    Keep up the very good works guys I’ve you guys to my personal blogroll.

  5. #5 minecraft 回复 | 引用 Post:2018-09-18 00:51

    I used to be recommended this blog via my cousin. I am no
    longer positive whether this submit is written by him as nobody else realize such detailed about my trouble.

    You’re wonderful! Thanks!

  6. #6 minecraft 回复 | 引用 Post:2018-09-20 21:29

    Hi there, I enjoy reading through your article post.
    I like to write a little comment to support you.

  7. #7 minecraft 回复 | 引用 Post:2018-09-30 16:13

    Hello, I think your website might be having browser compatibility issues.
    When I look at your website in Safari, it looks fine but when opening in Internet Explorer, it has some overlapping.
    I just wanted to give you a quick heads up!
    Other then that, wonderful blog!

  8. #8 minecraft 回复 | 引用 Post:2018-09-30 19:10

    Unquestionably believe that that you stated. Your favourite reason seemed to
    be on the internet the simplest thing to be mindful of. I say
    to you, I definitely get annoyed whilst folks consider worries
    that they just do not realize about. You controlled to hit the nail upon the
    highest as smartly as defined out the whole thing without having side-effects
    , other people can take a signal. Will likely be again to get more.
    Thank you

  9. #9 minecraft 回复 | 引用 Post:2018-09-30 21:50

    Very good info. Lucky me I recently found your site by accident (stumbleupon).
    I have saved it for later!

  10. #10 minecraft 回复 | 引用 Post:2018-10-01 00:59

    I’m not that much of a online reader to be honest but your sites really nice,
    keep it up! I’ll go ahead and bookmark your website to come back later.
    Many thanks

  11. #11 minecraft 回复 | 引用 Post:2018-10-01 08:28

    This site was… how do I say it? Relevant!! Finally I’ve found something that
    helped me. Many thanks!

  12. #12 minecraft 回复 | 引用 Post:2018-10-01 14:57

    I’m amazed, I have to admit. Seldom do I encounter a blog that’s both equally educative
    and amusing, and without a doubt, you have hit the nail on the head.
    The issue is something that too few people are speaking intelligently
    about. Now i’m very happy that I found this during my search for something concerning this.

  13. #13 minecraft 回复 | 引用 Post:2018-10-01 15:49

    I’ve been browsing online more than 4 hours today, yet I never found
    any interesting article like yours. It is pretty worth enough for me.
    In my opinion, if all website owners and bloggers made good content as you did, the internet will be much more useful than ever before.

  14. #14 minecraft 回复 | 引用 Post:2018-10-01 22:07

    Today, I went to the beach front with my kids.
    I found a sea shell and gave it to my 4 year old daughter and
    said “You can hear the ocean if you put this to your ear.” She
    put the shell to her ear and screamed. There was a hermit crab inside and it
    pinched her ear. She never wants to go back!

    LoL I know this is entirely off topic but I had
    to tell someone!

  15. #15 minecraft 回复 | 引用 Post:2018-10-01 23:08

    This piece of writing gives clear idea in favor of the new viewers of blogging, that truly how to do blogging.

  16. #16 minecraft 回复 | 引用 Post:2018-10-04 01:05

    Hello! This is kind of off topic but I need some help from an established blog.

    Is it difficult to set up your own blog? I’m not very techincal but I can figure things out pretty fast.
    I’m thinking about making my own but I’m not sure where to begin. Do
    you have any tips or suggestions? Thanks

  17. There is definately a great deal to learn about this issue.
    I really like all of the points you made.

  18. #18 tinder dating site 回复 | 引用 Post:2018-10-16 03:57

    At this time it sounds like BlogEngine is the preferred blogging platform
    out there right now. (from what I’ve read)
    Is that what you are using on your blog?

  19. I was able to find good info from your articles.

  20. #20 descargar facebook 回复 | 引用 Post:2018-11-02 09:19

    Hello, I think your site might be having browser compatibility issues.

    When I look at your blog site in Safari, it looks fine
    but when opening in Internet Explorer, it has some overlapping.
    I just wanted to give you a quick heads up! Other then that, superb blog!

  21. #21 Quest Bars 回复 | 引用 Post:2018-11-09 02:23

    Highly energetic post, I loved that a lot. Will there be a part 2?

  22. #22 Sling TV 回复 | 引用 Post:2018-11-14 17:52

    At this moment I am going away to do my breakfast, later than having my breakfast coming yet again to read more news.

  23. When I initially commented I clicked the “Notify me when new comments are added” checkbox and now each time a comment is added I get three e-mails with
    the same comment. Is there any way you can remove me from that service?
    Appreciate it!

  24. Sling tv coupons and promo codes for november 2018
    Your means of telling the whole thing in this piece of
    writing is truly pleasant, all can simply be aware of it,
    Thanks a lot. Sling tv coupons and promo codes for november 2018

  25. Hi to all, as I am truly eager of reading this webpage’s post to be updated regularly.
    It includes fastidious information.

  26. #26 descargar facebook 回复 | 引用 Post:2018-11-22 06:24

    Great post. I was checking continuously this
    blog and I am impressed! Very helpful information specifically the last part :) I care for such information much.
    I was seeking this certain information for a long time.
    Thank you and good luck.

  27. #27 descargar facebook 回复 | 引用 Post:2018-12-06 06:09

    Unquestionably believe that which you stated. Your favorite justification appeared to be on the internet the easiest thing
    to be aware of. I say to you, I definitely get irked while people consider worries that they just do not know about.
    You managed to hit the nail upon the top and also defined out
    the whole thing without having side effect
    , people can take a signal. Will probably be back to get more.
    Thanks

  28. I really like it when individuals get together and share ideas.
    Great blog, stick with it!

  29. #29 Denny 回复 | 引用 Post:2020-05-22 00:01

    When someone writes an paragraph he/she keeps the idea of a user in his/her brain that how a user can be aware of it.
    So that’s why this article is outstdanding. Thanks!

  30. #30 nba2k20.online 回复 | 引用 Post:2020-06-07 02:03

    Hi there, just became aware of your blog through Google,
    and found that it is really informative. I’m going to watch out for brussels.
    I’ll be grateful if you continue this in future. A lot of people
    will be benefited from your writing. Cheers!

发表评论