Windows核心分析——NtCreateDebugObject函數分析

標籤：

第一篇分析Windows核心的文章，主要是加強學習記憶。以後會多寫這種筆記，正如豬豬俠所說，所學的知識只有實踐並且能夠講出來才能真正實現掌握。

程式來自ReactOS或WRK1.2

資料參考自《Windows核心情景分析》和《Windows 核心設計思想》以及網上文章和視頻

NTSTATUSNtCreateDebugObject (    OUT PHANDLE DebugObjectHandle,    IN ACCESS_MASK DesiredAccess,    IN POBJECT_ATTRIBUTES ObjectAttributes,    IN ULONG Flags    )/*++Routine Description:    Creates a new debug object that maintains the context for a single debug session. Multiple processes may be    associated with a single debug object.Arguments:    DebugObjectHandle - Pointer to a handle to recive the output objects handle    DesiredAccess     - Required handle access    ObjectAttributes  - Standard object attributes structure    Flags             - Only one flag DEBUG_KILL_ON_CLOSEReturn Value:    NTSTATUS - Status of call.--*/{    NTSTATUS Status;    HANDLE Handle;    KPROCESSOR_MODE PreviousMode;    PDEBUG_OBJECT DebugObject;    PAGED_CODE();    //    // Get previous processor mode and probe output arguments if necessary.    // Zero the handle for error paths.    //    PreviousMode = KeGetPreviousMode();    try {        if (PreviousMode != KernelMode) {            ProbeForWriteHandle (DebugObjectHandle);        }        *DebugObjectHandle = NULL;    } except (ExSystemExceptionFilter ()) { // If previous mode is kernel then don‘t handle the exception        return GetExceptionCode ();    }    if (Flags & ~DEBUG_KILL_ON_CLOSE) {        return STATUS_INVALID_PARAMETER;    }    //    // Create a new debug object and initialize it.    //    Status = ObCreateObject (PreviousMode,                             DbgkDebugObjectType,                             ObjectAttributes,                             PreviousMode,                             NULL,                             sizeof (DEBUG_OBJECT),                             0,                             0,                             &DebugObject);    if (!NT_SUCCESS (Status)) {        return Status;    }    ExInitializeFastMutex (&DebugObject->Mutex);    InitializeListHead (&DebugObject->EventList);    KeInitializeEvent (&DebugObject->EventsPresent, NotificationEvent, FALSE);    if (Flags & DEBUG_KILL_ON_CLOSE) {        DebugObject->Flags = DEBUG_OBJECT_KILL_ON_CLOSE;    } else {        DebugObject->Flags = 0;    }    //    // Insert the object into the handle table    //    Status = ObInsertObject (DebugObject,                             NULL,                             DesiredAccess,                             0,                             NULL,                             &Handle);    if (!NT_SUCCESS (Status)) {        return Status;    }    try {        *DebugObjectHandle = Handle;    } except (ExSystemExceptionFilter ()) {        //        // The caller changed the page protection or deleted the memory for the handle.        // No point closing the handle as process rundown will do that and we don‘t know its still the same handle        //        Status = GetExceptionCode ();    }    return Status;}

 

Windows核心分析——NtCreateDebugObject函數分析