NTSTATUS
CreatemyObjectTypeByName(
IN PCWSTR ObjectTypeName,//要创建的对象类型的名字
IN POBJECT_TYPE pObjectTypeForCopy,//原始的ObjectType
OUT POBJECT_TYPE *pNewObjectType)//返回新创建的ObjectType
{

	UNICODE_STRING NameString;
	OBJECT_TYPE_INITIALIZER ObjectTypeInitializer;
	NTSTATUS status = 0;
	RtlInitUnicodeString(&NameString, ObjectTypeName);
	RtlZeroMemory(&ObjectTypeInitializer, sizeof(OBJECT_TYPE_INITIALIZER));

	ObjectTypeInitializer.Length = pObjectTypeForCopy->TypeInfo.Length;
	ObjectTypeInitializer.UseDefaultObject = pObjectTypeForCopy->TypeInfo.UseDefaultObject;
	ObjectTypeInitializer.CaseInsensitive = pObjectTypeForCopy->TypeInfo.CaseInsensitive;
	ObjectTypeInitializer.InvalidAttributes = pObjectTypeForCopy->TypeInfo.InvalidAttributes;
	ObjectTypeInitializer.GenericMapping = pObjectTypeForCopy->TypeInfo.GenericMapping;
	ObjectTypeInitializer.ValidAccessMask = 0x1f000f;
	ObjectTypeInitializer.SecurityRequired = pObjectTypeForCopy->TypeInfo.SecurityRequired;
	ObjectTypeInitializer.MaintainHandleCount = pObjectTypeForCopy->TypeInfo.MaintainHandleCount;
	ObjectTypeInitializer.MaintainTypeList = pObjectTypeForCopy->TypeInfo.MaintainTypeList;
	ObjectTypeInitializer.PoolType = pObjectTypeForCopy->TypeInfo.PoolType;
	ObjectTypeInitializer.DefaultPagedPoolCharge = pObjectTypeForCopy->TypeInfo.DefaultPagedPoolCharge;
	ObjectTypeInitializer.DefaultNonPagedPoolCharge = pObjectTypeForCopy->TypeInfo.DefaultNonPagedPoolCharge;
	ObjectTypeInitializer.DumpProcedure = pObjectTypeForCopy->TypeInfo.DumpProcedure;
	ObjectTypeInitializer.OpenProcedure = pObjectTypeForCopy->TypeInfo.OpenProcedure;
	ObjectTypeInitializer.CloseProcedure = pObjectTypeForCopy->TypeInfo.CloseProcedure;
	ObjectTypeInitializer.DeleteProcedure = pObjectTypeForCopy->TypeInfo.DeleteProcedure;
	ObjectTypeInitializer.ParseProcedure = pObjectTypeForCopy->TypeInfo.ParseProcedure;
	ObjectTypeInitializer.SecurityProcedure = pObjectTypeForCopy->TypeInfo.SecurityProcedure;
	ObjectTypeInitializer.QueryNameProcedure = pObjectTypeForCopy->TypeInfo.QueryNameProcedure;
	ObjectTypeInitializer.OkayToCloseProcedure = pObjectTypeForCopy->TypeInfo.OkayToCloseProcedure;

	status = ObCreateObjectType(
		&NameString,
		&ObjectTypeInitializer,
		(PSECURITY_DESCRIPTOR)NULL,
		pNewObjectType);

	if (NT_SUCCESS(status))
	{
		DbgPrint("pNewObjectType: 0x%08X\n", *pNewObjectType);
	}
	return status;
}

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课