函数接口解释参考ddk文档(win 7 32),用来遍历某个驱动对象的设备对象。c代码+WinDbg得到的反汇编代码
NTSTATUS
IoEnumerateDeviceObjectList(IN PDRIVER_OBJECT DriverObject, //ebp+8
IN PDEVICE_OBJECT *DeviceObject, //ebp+ch
IN ULONG DeviceObjectListSize, //ebp+10h
OUT PLONG ActualNumberDeviceObjects) //ebp+14h
{
NTSTATUS status=STATUS_SUCCESSFUL;
PDEVICE_OBJECT tempDeviceObject=NULL;
ULONG Count=0,i=0;
PKIRQL OldIrql;
KeAcquireQueuedSpinLock(0xa,OldIrql);
DeviceObjcetListSize=DeviceObjectListSize/4; //4=sizeof(a pointer)
//enumerate the DeviceObject and get the number
tempDeviceObjcet=DriverObject->DeviceObject;
while(tempDeviceObject)
{
tempDeviceObject=tempDeviceObject->NextDevice;
Count++;
}
//actual number
*ActualNumberDeviceObjects=Count;
if(Count>DeviceObjectListSize)
{
status=STATUS_BUFFER_TOO_SMALL;
}
//
if(DeviceObjectListSize<=0)
{
KeReleaseQueuedSpinLock(0xa,OldIrql);
return status;
}
tempDeviceObjcet=DriverObjct->DeviceObject;
while(tempDeviceObcjet&&DeviceObjcetListSize) //get the DeviceObjcet pointeres
{
ObfReferenceObjct(tempDeviceObjct);
DeviceObject[i]=tempDeviceObject; //save the DeviceObejct pointer
DeviceObjcetListSize--;
}
KeReleaseQueuedSpinLock(0xa,OldIrql);
return status;
}
反汇编代码
nt!IoEnumerateDeviceObjectList:
840485f7 8bff mov edi,edi
840485f9 55 push ebp
840485fa 8bec mov ebp,esp
840485fc 51 push ecx
840485fd 51 push ecx
840485fe 56 push esi
840485ff 57 push edi
84048600 6a0a push 0Ah
84048602 33ff xor edi,edi
84048604 217df8 and dword ptr [ebp-8],edi
84048607 59 pop ecx
84048608 ff1564110484 call dword ptr [nt!_imp_KeAcquireQueuedSpinLock (84041164)]
8404860e 8b4d08 mov ecx,dword ptr [ebp+8]
84048611 8b7510 mov esi,dword ptr [ebp+10h]
84048614 8845ff mov byte ptr [ebp-1],al
84048617 8b4104 mov eax,dword ptr [ecx+4]
8404861a c1ee02 shr esi,2
8404861d eb04 jmp nt!IoEnumerateDeviceObjectList+0x2c (84048623)
nt!IoEnumerateDeviceObjectList+0x28:
8404861f 8b400c mov eax,dword ptr [eax+0Ch]
84048622 47 inc edi
nt!IoEnumerateDeviceObjectList+0x2c:
84048623 85c0 test eax,eax
84048625 75f8 jne nt!IoEnumerateDeviceObjectList+0x28 (8404861f)
nt!IoEnumerateDeviceObjectList+0x30:
84048627 8b4514 mov eax,dword ptr [ebp+14h]
8404862a 8938 mov dword ptr [eax],edi
8404862c 3bfe cmp edi,esi
8404862e 7607 jbe nt!IoEnumerateDeviceObjectList+0x40 (84048637)
nt!IoEnumerateDeviceObjectList+0x39:
84048630 c745f8230000c0 mov dword ptr [ebp-8],0C0000023h
nt!IoEnumerateDeviceObjectList+0x40:
84048637 8b7904 mov edi,dword ptr [ecx+4]
8404863a 85f6 test esi,esi
8404863c 761b jbe nt!IoEnumerateDeviceObjectList+0x62 (84048659)
nt!IoEnumerateDeviceObjectList+0x47:
8404863e 53 push ebx
8404863f 8b5d0c mov ebx,dword ptr [ebp+0Ch]
nt!IoEnumerateDeviceObjectList+0x4b:
84048642 85ff test edi,edi
84048644 7412 je nt!IoEnumerateDeviceObjectList+0x61 (84048658)
nt!IoEnumerateDeviceObjectList+0x4f:
84048646 8bcf mov ecx,edi
84048648 e8a7220700 call nt!ObfReferenceObject (840ba8f4)
8404864d 893b mov dword ptr [ebx],edi
8404864f 8b7f0c mov edi,dword ptr [edi+0Ch]
84048652 83c304 add ebx,4
84048655 4e dec esi
84048656 75ea jne nt!IoEnumerateDeviceObjectList+0x4b (84048642)
nt!IoEnumerateDeviceObjectList+0x61:
84048658 5b pop ebx
nt!IoEnumerateDeviceObjectList+0x62:
84048659 8a55ff mov dl,byte ptr [ebp-1]
8404865c 6a0a push 0Ah
8404865e 59 pop ecx
8404865f ff1560110484 call dword ptr [nt!_imp_KeReleaseQueuedSpinLock (84041160)]
84048665 8b45f8 mov eax,dword ptr [ebp-8]
84048668 5f pop edi
84048669 5e pop esi
8404866a c9 leave
8404866b c21000 ret 10h