ObReferenceObjectByName用法（自己测试成功）

//全局的一个对象类型

extern POBJECT_TYPE *IoDriverObjectType;

 函数原型声明

NTSTATUS
ObReferenceObjectByName (
    __in PUNICODE_STRING ObjectName,
    __in ULONG Attributes,
    __in_opt PACCESS_STATE AccessState,
    __in_opt ACCESS_MASK DesiredAccess,
    __in POBJECT_TYPE ObjectType,
    __in KPROCESSOR_MODE AccessMode,
    __inout_opt PVOID ParseContext,
    __out PVOID *Object
    );
 

PDRIVER_OBJECT  driverObject;

UNICODE_STRING driverString;

 

用法示例代码:

 status = ObReferenceObjectByName(&driverString,
                                     OBJ_CASE_INSENSITIVE,
                                     NULL,                 // access state
                                     FILE_ALL_ACCESS,                    // access mask
                                     *IoDriverObjectType,
                                     KernelMode,
                                     NULL,                 // parse context
                                     &driverObject);

 

 

说明：

driverString驱动名称 如：L“\\Driver\\Disk”

driverObject注意前面的&符号

*IoDriverObjectType 定义时有星号，用的时候*IoDriverObjectType也要加星号