-
-
[原创]FUTO_enhanced点滴笔记
-
发表于:
2008-2-19 00:03
10381
-
[FONT=新宋体]POBJECT_TYPE
FindObjectTypes (char *ac_tName)
{
OBJECT_ATTRIBUTES ObjectAttributes;
UNICODE_STRING ucName, ufName;
ANSI_STRING afName;
NTSTATUS ntStatus;
HANDLE hDirectory = NULL;
POBJECT_DIRECTORY pDirectoryObject = NULL;
POBJECT_DIRECTORY_ENTRY DirectoryEntry;
POBJECT_HEADER objHead;
ULONG Bucket = 0;
DWORD d_size;
PUNICODE_STRING p_wcName;
p_wcName = (PUNICODE_STRING) ExAllocatePool(PagedPool, \
sizeof(UNICODE_STRING)+(sizeof(WCHAR)*1024));
if (p_wcName == NULL)
return NULL;
p_wcName->Length = 0;
p_wcName->MaximumLength = 1022;
p_wcName->Buffer = (PWSTR)((DWORD)p_wcName + sizeof(UNICODE_STRING));
RtlInitAnsiString(&afName, ac_tName);
// open driver directory in the object directory
RtlInitUnicodeString(&ucName,L"\\ObjectTypes");
InitializeObjectAttributes(&ObjectAttributes,&ucName,OBJ_CASE_INSENSITIVE,NULL,NULL);
ntStatus = ObOpenObjectByName(&ObjectAttributes,
NULL,
KernelMode,
NULL,
0x80000000,
NULL,
&hDirectory);
if (!NT_SUCCESS (ntStatus))
return NULL;
// get pointer from handle
ntStatus = ObReferenceObjectByHandle(hDirectory,
FILE_ANY_ACCESS,
NULL,
KernelMode,
&pDirectoryObject,
NULL);
ZwClose (hDirectory);
if (!NT_SUCCESS (ntStatus))
return NULL;
ntStatus = RtlAnsiStringToUnicodeString(&ufName, &afName, TRUE);
if (!NT_SUCCESS (ntStatus))
return NULL;
// walk the object directory
for (Bucket = 0; Bucket < NUMBER_HASH_BUCKETS; Bucket++)
{
DirectoryEntry = pDirectoryObject->HashBuckets[Bucket];
while (DirectoryEntry != NULL)
{
ntStatus = ObQueryNameString(DirectoryEntry->Object,
(POBJECT_NAME_INFORMATION) p_wcName,
p_wcName->MaximumLength,
&d_size);
if (NT_SUCCESS (ntStatus))
{
if (RtlCompareUnicodeString(p_wcName, &ufName, TRUE)==0)
{
if (pDirectoryObject)
ObDereferenceObject(pDirectoryObject);
RtlFreeUnicodeString(&ufName);
ExFreePool(p_wcName);
return (POBJECT_TYPE) DirectoryEntry->Object;
}
}
p_wcName->MaximumLength = 1022;
DirectoryEntry = DirectoryEntry->ChainLink;
}
}
if (pDirectoryObject)
ObDereferenceObject(pDirectoryObject);
RtlFreeUnicodeString(&ufName);
ExFreePool(p_wcName);
return NULL;
}[/FONT]
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
,这音乐能勾起儿提时代的回忆啊 o(*.*)O
