POBJECT_TYPE* IoDriverObjectType;
换成
extern POBJECT_TYPE* IoDriverObjectType;

试试.

extern POBJECT_TYPE *IoDriverObjectType;

ObReferenceObjectByName(&DriverName, OBJ_CASE_INSENSITIVE, NULL, 0, *IoDriverObjectType, KernelMode, NULL, (PVOID*)&MouClassDriverObject)

不用谢我

谢啦

试过了， 还是蓝屏

我的IoDriverObjectType是包括在extern "C"{}里面的, 我再加上一个extern 或者把IoDriverObjectType拿出来单独写都不行

我发现这样写就不蓝屏了， 但是函数返回的结果表示没有成功获得kbdclass

extern "C" POBJECT_TYPE IoDriverObjectType;
extern "C"
{
       
        NTKERNELAPI
                NTSTATUS
                ObReferenceObjectByName(PUNICODE_STRING ObjectName,
                ULONG Attributes,
                PACCESS_STATE AccessState,
                ACCESS_MASK DesiredAccess,
                POBJECT_TYPE ObjectType,
                KPROCESSOR_MODE AccessMode,
                PVOID ParseContent,
                PVOID *Object);
};

status = ObReferenceObjectByName(&uniNtNameString, OBJ_CASE_INSENSITIVE, NULL, 0, IoDriverObjectType, KernelMode, NULL, (PVOID *)&pKbdDriverObject);
        if (!(NT_SUCCESS(status)))
        {
                KdPrint(("could not get the KbdDriverObject!"));
                return status;
        }

好吧， 照着2楼3楼的写法去写代码， 这次又不蓝屏了， 不知道以前到底是什么情况。 还有， 我上面写得代码是错的， 2楼和3楼说的方法是对的， 下面附上正确代码：

extern "C" POBJECT_TYPE* IoDriverObjectType;
extern "C"
{
  
  NTKERNELAPI
    NTSTATUS
    ObReferenceObjectByName(PUNICODE_STRING ObjectName,
    ULONG Attributes,
    PACCESS_STATE AccessState,
    ACCESS_MASK DesiredAccess,
    POBJECT_TYPE ObjectType,
    KPROCESSOR_MODE AccessMode,
    PVOID ParseContent,
    PVOID *Object);
};

status = ObReferenceObjectByName(&uniNtNameString, OBJ_CASE_INSENSITIVE, NULL, 0, *IoDriverObjectType, KernelMode, NULL, (PVOID *)&pKbdDriverObject);
  if (!(NT_SUCCESS(status)))
  {
    KdPrint(("could not get the KbdDriverObject!"));
    return status;
  }

我刚遇到这个问题，刚发完帖子就发现你这个了

看来我们学习进度很接近啊