ObReferenceObjectByName用法（自己測試成功）

//全域的一個物件類型

extern POBJECT_TYPE *IoDriverObjectType;

 函數原型聲明

NTSTATUS
ObReferenceObjectByName (
    __in PUNICODE_STRING ObjectName,
    __in ULONG Attributes,
    __in_opt PACCESS_STATE AccessState,
    __in_opt ACCESS_MASK DesiredAccess,
    __in POBJECT_TYPE ObjectType,
    __in KPROCESSOR_MODE AccessMode,
    __inout_opt PVOID ParseContext,
    __out PVOID *Object
    );
 

PDRIVER_OBJECT  driverObject;

UNICODE_STRING driverString;

 

用法範例程式碼:

 status = ObReferenceObjectByName(&driverString,
                                     OBJ_CASE_INSENSITIVE,
                                     NULL,                 // access state
                                     FILE_ALL_ACCESS,                    // access mask
                                     *IoDriverObjectType,
                                     KernelMode,
                                     NULL,                 // parse context
                                     &driverObject);

 

 

說明：

driverString驅動名稱 如：L“\\Driver\\Disk”

driverObject注意前面的&符號

*IoDriverObjectType 定義時有星號，用的時候*IoDriverObjectType也要加星號