ObReferenceObjectByName蓝屏问题

在拖了几天，调了快一天之后，问题终于在新年的第一天解决，庆贺一下O(∩_∩)O~

在“北极星2003”的CSDN博客上看到说用ObReferenceObjectByName来输出驱动程序的基本信息，结果我去测试的时候无情的蓝屏了。找了好久，终于发现了原因所在。因为博客上的代码是C++，而ObReferenceObjectByName是NativeAPI，所以需要做一个声明，C++用了extern “C”，而我的是C语言，用了ifdef宏定义，忘了加extern了，结果导致了蓝屏。

用WinDbg调试的时候，已进入ObReferenceObjectByName函数，系统就崩溃了，根本无法继续调试。还好最后发现了问题的所在。下面把代码贴出来

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70

#include <ntddk.h>   // 注意对于NativeAPI的声明 // C语言要加上extern // C++要加上extern "C" extern NTSTATUS ObReferenceObjectByName( IN PUNICODE_STRING ObjectPath, IN ULONG Attributes, IN PACCESS_STATE PassedAccessState OPTIONAL, IN ACCESS_MASK DesiredAccess OPTIONAL, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext OPTIONAL, OUT PVOID *ObjectPtr ); extern POBJECT_TYPE *IoDeviceObjectType;   // 卸载例程 VOID DriverUnload(PDRIVER_OBJECT pDriverObject) { DbgPrint("--------------------------------\n"); }   // 获取信息 NTSTATUS GetInfo() { NTSTATUS status = STATUS_UNSUCCESSFUL; PDRIVER_OBJECT pTestObject = NULL; UNICODE_STRING uniDriverName; WCHAR DriverNameBuffer[] = L"\\Driver\\HelloDDK";   RtlInitUnicodeString(&uniDriverName, DriverNameBuffer); status = ObReferenceObjectByName( &uniDriverName, OBJ_CASE_INSENSITIVE, NULL, 0, *IoDeviceObjectType, KernelMode, NULL, &pTestObject); if(!NT_SUCCESS(status)) { DbgPrint("ObReferenceObjectByName Failure!\n"); return status; }   DbgPrint("Driver Name : %wZ\n", &uniDriverName); DbgPrint("Load Address : 0x%08X\n", pTestObject->DriverStart); DbgPrint("Driver Size : %d\n", pTestObject->DriverSize); DbgPrint("Driver Object : 0x%08X\n", pTestObject->DriverExtension->DriverObject); DbgPrint("FastIo Dispatch : 0x%08X\n", pTestObject->FastIoDispatch); DbgPrint("StartIo Entry : 0x%08X\n", pTestObject->DriverStartIo); DbgPrint("Add Device Entry: : 0x%08X\n", pTestObject->DriverExtension->AddDevice); DbgPrint("Unload Routine : 0x%08X\n", pTestObject->DriverUnload);   ObDereferenceObject(pTestObject);   return status; }   NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath) { NTSTATUS status; DbgPrint("--------------------------------\n"); pDriverObject->DriverUnload = DriverUnload;; GetInfo();   return STATUS_SUCCESS; }