WDM中通过driver name获取Driver Object并遍历此Driver产生的Device Object
2014-05-09 17:17
260 查看
这里需要用到一个未公开的(undocumented)API
ObReferenceObjectByName
函数可以通过对象名字得到包括设备对象在内的各种内核对象的指针,比如内核事件,互斥体对象等.他会增加内核对象的引用计数,使用完内核对象后要用ObDereferenceObject内核函数将引用计数减1.
定义参考:
从Driver name获取DRIVER_OBJECT:
从Device name获取Device Object的方式类似,只需要注意区分ObjectType即可。
我们可以通过DRIVER_OBJECT->DeviceObject来获取此Driver产生的DEVICE_OBJECT,并通过DEVICE_OBJECT->NextDevice来遍历所有的DEVICE_OBJECT。
遍历的同时,我们可以将PDO的Device Name提取到,参考:
ObReferenceObjectByName
函数可以通过对象名字得到包括设备对象在内的各种内核对象的指针,比如内核事件,互斥体对象等.他会增加内核对象的引用计数,使用完内核对象后要用ObDereferenceObject内核函数将引用计数减1.
定义参考:
NTKERNELAPI NTSTATUS ObReferenceObjectByName ( __in PUNICODE_STRING ObjectName, __in ULONG Attributes, __in_opt PACCESS_STATE AccessState, __in_opt ACCESS_MASK DesiredAccess, __in POBJECT_TYPE ObjectType, __in KPROCESSOR_MODE AccessMode, __inout_opt PVOID ParseContext, __out PVOID * Object )支持从driver name获取DRIVER_OBJECT,从device name获取DEVICE_OBJECT
从Driver name获取DRIVER_OBJECT:
// API define #ifdef __cplusplus extern "C" { #endif #include <NTDDK.h> NTKERNELAPI NTSTATUS ObReferenceObjectByName( IN PUNICODE_STRING ObjectName, IN ULONG Attributes, IN PACCESS_STATE PassedAccessState OPTIONAL, IN ACCESS_MASK DesiredAccess OPTIONAL, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext OPTIONAL, OUT PVOID *Object ); extern POBJECT_TYPE *IoDriverObjectType; #ifdef __cplusplus } #endif // use such API NTSTATUS status = STATUS_SUCCESS; UNICODE_STRING DriverName; PDRIVER_OBJECT pDriverObj = NULL; RtlInitUnicodeString(&DriverName, L"\\Driver\\usbhub"); // usbhub as an example status = ObReferenceObjectByName( &DriverName, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, 0, *IoDriverObjectType, KernelMode, NULL, (PVOID*)&pDriverObj);
从Device name获取Device Object的方式类似,只需要注意区分ObjectType即可。
我们可以通过DRIVER_OBJECT->DeviceObject来获取此Driver产生的DEVICE_OBJECT,并通过DEVICE_OBJECT->NextDevice来遍历所有的DEVICE_OBJECT。
typedef struct _DRIVER_OBJECT { CSHORT Type; CSHORT Size; // // The following links all of the devices created by a single driver // together on a list, and the Flags word provides an extensible flag // location for driver objects. // PDEVICE_OBJECT DeviceObject; ULONG Flags; // // The following section describes where the driver is loaded. The count // field is used to count the number of times the driver has had its // registered reinitialization routine invoked. // PVOID DriverStart; ULONG DriverSize; PVOID DriverSection; PDRIVER_EXTENSION DriverExtension; // // The driver name field is used by the error log thread // determine the name of the driver that an I/O request is/was bound. // UNICODE_STRING DriverName; // // The following section is for registry support. Thise is a pointer // to the path to the hardware information in the registry // PUNICODE_STRING HardwareDatabase; // // The following section contains the optional pointer to an array of // alternate entry points to a driver for "fast I/O" support. Fast I/O // is performed by invoking the driver routine directly with separate // parameters, rather than using the standard IRP call mechanism. Note // that these functions may only be used for synchronous I/O, and when // the file is cached. // PFAST_IO_DISPATCH FastIoDispatch; // // The following section describes the entry points to this particular // driver. Note that the major function dispatch table must be the last // field in the object so that it remains extensible. // PDRIVER_INITIALIZE DriverInit; PDRIVER_STARTIO DriverStartIo; PDRIVER_UNLOAD DriverUnload; PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1]; } DRIVER_OBJECT;
遍历的同时,我们可以将PDO的Device Name提取到,参考:
if (STATUS_SUCCESS == status && NULL != pDriverObj) { PDEVICE_OBJECT pDevObj = pDriverObj->DeviceObject; ULONG resultLength = 0; PWCHAR pResultBuffer = NULL; while(NULL != pDevObj) { if (pDevObj->Flags & DO_BUS_ENUMERATED_DEVICE ) // PDO { resultLength = 0; status = IoGetDeviceProperty( // get PDO device name pDevObj, DevicePropertyPhysicalDeviceObjectName, 0, NULL, &resultLength); if (STATUS_BUFFER_TOO_SMALL == status && resultLength>0) { pResultBuffer = ExAllocatePoolWithTag( NonPagedPool, resultLength+1, 'NCSP'); if (pResultBuffer) { RtlZeroMemory(pResultBuffer, resultLength+1); status = IoGetDeviceProperty( pDevObj, DevicePropertyPhysicalDeviceObjectName, resultLength, pResultBuffer, &resultLength); } } if (pResultBuffer) { ExFreePool(pResultBuffer); } } pDevObj = pDevObj->NextDevice; } ObDereferenceObject(pPciDriverObj); }
相关文章推荐
- WebDriver获取table的内容(通过动态获取Table单元格的TagName对其innerHTML值进行获取)
- jquery通过id或name获取radio选中值
- jquery 通过name名称获取当前name的value值
- IE 通过name获取元素
- 遍历json对象的所有key,在使用json对象时,如果无法知道key,怎么通过key变量来获取值
- 使用Java代码遍历以获取Map<String,Object>的值
- JsonObject通过键获取值 "."和"[]" 的区别
- 通过 document.getElementsByName 获取数组对象,传递多个值
- ThinkPHP3.2.3通过ajax获取指定字段,循环遍历渲染到视图层
- 通过枚举类型的value或者name获取description
- JSONObject遍历获取键值
- 通过LDAP获取Username
- List<Map<String,Object>>使用Java代码遍历以获取String,Object的值
- JavaScript通过元素id和name直接获取元素对象
- jquery通过id或name获取标签的值,以及简单的js正则表达式
- JS原生通过id,class,tagname 来获取元素的方法
- JDBC:通过 Driver 接口获取数据库连接
- JSONObject遍历获取键值方法合并两个JSONObject
- 1.通过原始的Driver接口获取JDBC数据库连接Connection
- 1.通过原始的Driver接口获取JDBC数据库连接Connection