ObReferenceObjectByName函数调用WIN7下的解决 - UnMovedMover

《寒江独钓 Windows内核安全编程》第4章键盘的过滤ctrl2cap代码中，ObReferenceObjectByName函数调用：

                              【1】extern POBJECT_TYPE IoDriverObjectType;

【2】status = ObReferenceObjectByName (

        &uniNtNameString,

        OBJ_CASE_INSENSITIVE,

        NULL,

        0,

        IoDriverObjectType,

        KernelMode,

        NULL,

        &KbdDriverObject

        );

这样会导致

修正方法：

                              【1】extern POBJECT_TYPE *IoDriverObjectType;

【2】status = ObReferenceObjectByName (

        &uniNtNameString,

        OBJ_CASE_INSENSITIVE,

        NULL,

        0,

        *IoDriverObjectType,

        KernelMode,

        NULL,

        &KbdDriverObject

        );