{"id":185,"date":"2010-04-18T00:18:38","date_gmt":"2010-04-18T09:18:38","guid":{"rendered":"\/blog\/?p=185"},"modified":"2023-09-21T09:39:13","modified_gmt":"2023-09-21T00:39:13","slug":"ddk-ms%ec%97%90%ec%84%9c-%ea%b3%b5%ea%b0%9c%ed%95%98%ec%a7%80-%ec%95%8a%ec%9d%80-%ed%95%a8%ec%88%98-obopenobjectbyname-%eb%82%b4%eb%b6%80-%ec%bd%94%eb%93%9c","status":"publish","type":"post","link":"https:\/\/hasu0707.duckdns.org\/blog\/?p=185","title":{"rendered":"[DDK] MS\uc5d0\uc11c \uacf5\uac1c\ud558\uc9c0 \uc54a\uc740 \ud568\uc218 ObOpenObjectByName() \ub0b4\ubd80 \ucf54\ub4dc"},"content":{"rendered":"\n
\n
\n<\/div>\n
  1. NTSTATUS    <\/span><\/span> \n<\/li>
  2. STDCALL   <\/span> \n<\/li>
  3. ObOpenObjectByName(   <\/span> \n<\/li>
  4.   POBJECT_ATTRIBUTES ObjectAttributes,   <\/span> \n<\/li>
  5.   POBJECT_TYPE ObjectType,   <\/span> \n<\/li>
  6.   <\/span>PVOID<\/font><\/strong><\/span> ParseContext,   <\/span> \n<\/li>
  7.   KPROCESSOR_MODE AccessMode,   <\/span> \n<\/li>
  8.   ACCESS_MASK DesiredAccess,   <\/span> \n<\/li>
  9.   PACCESS_STATE PassedAccessState,   <\/span> \n<\/li>
  10.   <\/span>PHANDLE<\/font><\/strong><\/span> Handle   <\/span> \n<\/li>
  11.   )   <\/span> \n<\/li>
  12. {   <\/span> \n<\/li>
  13.    UNICODE_STRING RemainingPath;   <\/span> \n<\/li>
  14.    <\/span>PVOID<\/font><\/strong><\/span> Object = NULL;   <\/span> \n\n<\/li>
  15.    NTSTATUS Status;   <\/span> \n<\/li>
  16.   <\/span> \n<\/li>
  17.    DPRINT(<\/span>\"ObOpenObjectByName()\\n\"<\/font><\/span>);   <\/span> \n<\/li>
  18.   <\/span> \n<\/li>
  19.    Status = ObFindObject(ObjectAttributes,   <\/span> \n<\/li>
  20.                                    &Object,   <\/span> \n<\/li>
  21.                                    &RemainingPath, \n  <\/span> \n<\/li>
  22.                                    ObjectType   <\/span> \n<\/li>
  23.                                    );   <\/span> \n<\/li>
  24.    <\/span>if<\/font><\/strong><\/span> (!NT_SUCCESS(Status)) \n  <\/span> \n<\/li>
  25.      {   <\/span> \n<\/li>
  26.             <\/span>return<\/font><\/strong><\/span> Status;   <\/span> \n<\/li>
  27.      }   <\/span> \n<\/li>
  28.   <\/span> \n<\/li>
  29.    <\/span>if<\/font><\/strong><\/span> (RemainingPath.Buffer != NULL || \n  <\/span> \n<\/li>
  30.        Object == NULL)   <\/span> \n<\/li>
  31.      {   <\/span> \n<\/li>
  32.             RtlFreeUnicodeString(&RemainingPath);   <\/span> \n<\/li>
  33.             <\/span>return<\/font><\/strong><\/span> STATUS_UNSUCCESSFUL; \n  <\/span> \n<\/li>
  34.      }   <\/span> \n<\/li>
  35.   <\/span> \n<\/li>
  36.    Status = ObCreateHandle(PsGetCurrentProcess(),   <\/span> \n<\/li>
  37.                                        Object,   <\/span> \n<\/li>
  38.                                        DesiredAccess,   <\/span> \n<\/li>
  39.                                        FALSE,   <\/span> \n<\/li>
  40.                                        Handle   <\/span> \n<\/li>
  41.                                       );   <\/span> \n<\/li>
  42.   <\/span> \n<\/li>
  43.    ObDereferenceObject(Object);   <\/span> \n<\/li>
  44.    RtlFreeUnicodeString(&RemainingPath);   <\/span> \n<\/li>
  45.   <\/span> \n<\/li>
  46.    <\/span>return<\/font><\/strong><\/span> Status;   <\/span> \n<\/li>
  47. }  <\/span><\/li><\/ol><\/div>\n

    <TEXTAREA class=\"cpp\" style=\"DISPLAY: none\" name=code rows=10 \ncols=60>NTSTATUS STDCALL ObOpenObjectByName( POBJECT_ATTRIBUTES \nObjectAttributes, POBJECT_TYPE ObjectType, PVOID ParseContext, KPROCESSOR_MODE \nAccessMode, ACCESS_MASK DesiredAccess, PACCESS_STATE PassedAccessState, PHANDLE \nHandle ) { UNICODE_STRING RemainingPath; PVOID Object = NULL; NTSTATUS Status; \nDPRINT(\"ObOpenObjectByName()\\n\"); Status = ObFindObject(ObjectAttributes, \n&Object, &RemainingPath, ObjectType ); if (!NT_SUCCESS(Status)) { return \nStatus; } if (RemainingPath.Buffer != NULL || Object == NULL) { \nRtlFreeUnicodeString(&RemainingPath); return STATUS_UNSUCCESSFUL; } Status = \nObCreateHandle(PsGetCurrentProcess(), Object, DesiredAccess, FALSE, Handle ); \nObDereferenceObject(Object); RtlFreeUnicodeString(&RemainingPath); return \nStatus; } <\/TEXTAREA>

    MS\uc5d0\uc11c \uacf5\uac1c\ud558\uc9c0 \uc54a\uc740 \ud568\uc218\ub85c

    \uc2ec\ubcfc\ub9ad \uc720\ub2c8\ucf54\ub4dc\uc774\ub984\uc5d0 \ub300\ud55c \n\ud578\ub4e4\uc758 \ud5e4\ub354\ub97c \uac00\uc838 \uc624\ub294 \ud568\uc218<\/font>\uc774\ub2e4.

    \uc2dc\uc2a4\ud15c \ub0b4\ubd80\uc758 \ud578\ub4e4 \ud14c\uc774\ube14\uc5d0\uc11c \uac80\uc0c9\ud574\uc11c \n\uac00\uc838\uc628\ub2e4.

    \uadf8\ub9ac\uace0 ObReferenceObjectByHandle<\/font>()\uc744 \n\ud638\ucd9c\ud574\uc11c

    \ud5e4\ub354\uc5d0 \ub300\ud55c \ubc14\ub514\ub97c \uac00\uc838\uc640\uc57c\ud55c\ub2e4

    React OS\uc5d0\uc11c \ucc38\uc870\ud588\ub2e4. <\/p>\n

     <\/p>\n

    \ucd9c\ucc98 : http:\/\/ssmhz.tistory.com\/158<\/a> \n<\/p>


    <\/p>\n","protected":false},"excerpt":{"rendered":"

    NTSTATUS    STDCALL   ObOpenObjectByName(     POBJECT_ATTRIBUTES ObjectAttributes,     POBJECT_TYPE ObjectType,     PVOID ParseContext,     KPROCESSOR_MODE AccessMode,     ACCESS_MASK DesiredAccess,     PACCESS_STATE PassedAccessState,     PHANDLE Handle     )   {      UNICODE_STRING RemainingPath;      PVOID Object = NULL;      NTSTATUS Status;        DPRINT(“ObOpenObjectByName()\\n”);       […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_import_markdown_pro_load_document_selector":0,"_import_markdown_pro_submit_text_textarea":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[24],"tags":[],"class_list":["post-185","post","type-post","status-publish","format-standard","hentry","category-development_winddk"],"_links":{"self":[{"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/posts\/185","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=185"}],"version-history":[{"count":0,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/posts\/185\/revisions"}],"wp:attachment":[{"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=185"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=185"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=185"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}