windows 内核对象hash 算法

WINDOWS中有20几类无数的内核对象，它们都独立地存在于系统地址空间中。系统利用目录对象将所有的这些对象组织起来。目录对象是一个有37个数组元素组成的哈希（HASH）树。数据结构如下：

Typedef struct _OBJECT_DIRECTORY_ENTY
{
  Struct _OBJECT_DIRECTORY_ENTRY *NextEntry;
  POBJECT Object
}OBJECT_DIRECTORY_ENTRY, *POBJECT_DIRECTORY_ENTRY,**PPOBJECT_DIRECTORY_ENTRY;
 
Typedef struct _OBJECT_DIRECTORY
{
  POBJECT_DIRECTORY_ENTRY HashTable[37];
  POBJECT_DIRECTORY_ENTRY CurrentEntry;
  BOOLEAN CurrentEntryValid;
  BYTE  Reserved1;
  WORD Reserved2;
  DWORD Reserved3;
}OBJECT_DIRECTORY, *POBJECT_DIRECTORY;

系统将对象名称进行一定的算法得出一个 HASH 值，算法如下：

//根据名字计算HASH值。

<span style="font-family: Arial, Helvetica, sans-serif;">hash = 0;</span>

p = (PSHORT)wStr; //存放名称的一个WCHAR数组
while(*p)
{
Symb = (CHAR)*p;
hash = hash * 3 + (hash >> 1);
 
if (Symb < 'a')  //<a
hash= hash  + Symb;
else if (Symb <= 'z')   //即 a~z
hash = hash + Symb - 0x20;
else          // > z
hash = hash + (CHAR)RtlUpcaseUnicodeChar((WCHAR)*p);
 
p ++;
}
hash = hash % 37;  //最终的hash值。