WINDOWS中有20几类无数的内核对象,它们都独立地存在于系统地址空间中。系统利用目录对象将所有的这些对象组织起来。目录对象是一个有37个数组元素组成的哈希(HASH)树。数据结构如下:
Typedef struct _OBJECT_DIRECTORY_ENTY
{
Struct _OBJECT_DIRECTORY_ENTRY *NextEntry;
POBJECT Object
}OBJECT_DIRECTORY_ENTRY, *POBJECT_DIRECTORY_ENTRY,**PPOBJECT_DIRECTORY_ENTRY;
Typedef struct _OBJECT_DIRECTORY
{
POBJECT_DIRECTORY_ENTRY HashTable[37];
POBJECT_DIRECTORY_ENTRY CurrentEntry;
BOOLEAN CurrentEntryValid;
BYTE Reserved1;
WORD Reserved2;
DWORD Reserved3;
}OBJECT_DIRECTORY, *POBJECT_DIRECTORY;
系统将对象名称进行一定的算法得出一个 HASH 值,算法如下:
//根据名字计算HASH值。
<span style="font-family: Arial, Helvetica, sans-serif;">hash = 0;</span>
p = (PSHORT)wStr; //存放名称的一个WCHAR数组
while(*p)
{
Symb = (CHAR)*p;
hash = hash * 3 + (hash >> 1);
if (Symb < 'a') //<a
hash= hash + Symb;
else if (Symb <= 'z') //即 a~z
hash = hash + Symb - 0x20;
else // > z
hash = hash + (CHAR)RtlUpcaseUnicodeChar((WCHAR)*p);
p ++;
}
hash = hash % 37; //最终的hash值。