ObReferenceObjectByName藍屏問題

在拖了幾天，調了快一天之後，問題終於在新年的第一天解決，慶賀一下O(∩_∩)O~

在“北極星2003”的CSDN部落格上看到說用ObReferenceObjectByName來輸出驅動程式的基本資料，結果我去測試的時候無情的藍屏了。找了好久，終於發現了原因所在。因為部落格上的代碼是C++，而ObReferenceObjectByName是NativeAPI，所以需要做一個聲明，C++用了extern “C”，而我的是C語言，用了ifdef宏定義，忘了加extern了，結果導致了藍屏。

用WinDbg調試的時候，已進入ObReferenceObjectByName函數，系統就崩潰了，根本無法繼續調試。還好最後發現了問題的所在。下面把代碼貼出來

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970

#include <ntddk.h> // 注意對於NativeAPI的聲明// C語言要加上extern// C++要加上extern "C"extern NTSTATUS ObReferenceObjectByName(IN PUNICODE_STRING ObjectPath,IN ULONG Attributes,IN PACCESS_STATE PassedAccessState OPTIONAL,IN ACCESS_MASK DesiredAccess OPTIONAL,IN POBJECT_TYPE ObjectType,IN KPROCESSOR_MODE AccessMode,IN OUT PVOID ParseContext OPTIONAL,OUT PVOID *ObjectPtr);extern POBJECT_TYPE *IoDeviceObjectType; // 卸載常式VOID DriverUnload(PDRIVER_OBJECT pDriverObject){DbgPrint("--------------------------------\n");} // 擷取資訊NTSTATUS GetInfo(){NTSTATUSstatus = STATUS_UNSUCCESSFUL;PDRIVER_OBJECTpTestObject = NULL;UNICODE_STRINGuniDriverName;WCHARDriverNameBuffer[] = L"\\Driver\\HelloDDK"; RtlInitUnicodeString(&uniDriverName, DriverNameBuffer);status = ObReferenceObjectByName(&uniDriverName,OBJ_CASE_INSENSITIVE,NULL,0,*IoDeviceObjectType,KernelMode,NULL,&pTestObject);if(!NT_SUCCESS(status)){DbgPrint("ObReferenceObjectByName Failure!\n");return status;} DbgPrint("Driver Name: %wZ\n", &uniDriverName);DbgPrint("Load Address: 0x%08X\n", pTestObject->DriverStart);DbgPrint("Driver Size: %d\n", pTestObject->DriverSize);DbgPrint("Driver Object: 0x%08X\n", pTestObject->DriverExtension->DriverObject);DbgPrint("FastIo Dispatch: 0x%08X\n", pTestObject->FastIoDispatch);DbgPrint("StartIo Entry: 0x%08X\n", pTestObject->DriverStartIo);DbgPrint("Add Device Entry:: 0x%08X\n", pTestObject->DriverExtension->AddDevice);DbgPrint("Unload Routine: 0x%08X\n", pTestObject->DriverUnload); ObDereferenceObject(pTestObject); return status;} NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath){NTSTATUS status;DbgPrint("--------------------------------\n");pDriverObject->DriverUnload = DriverUnload;;GetInfo(); return STATUS_SUCCESS;}