获取内核对象的引用计数

正规的方法可以用 ZwQueryObject 。但是该函数用起来比较麻烦。

事实上还有一个方便的函数

VOID ObReferenceObject(
_In_ PVOID Object
);

Return value
ObReferenceObject returns a value that is reserved for system use. Drivers must treat this value as VOID.

打开反汇编一看：

nt!ObfReferenceObject:
8086bf7c 803de0088a8000 cmp byte ptr [nt!KiEnableTimerWatchdog+0xafc (808a08e0)],0
8086bf83 56 push esi
8086bf84 8d71e8 lea esi,[ecx-18h]
8086bf87 7408 je nt!ObfReferenceObject+0x15 (8086bf91)
8086bf89 6a01 push 1
8086bf8b 56 push esi
8086bf8c e8a3feffff call nt!NtFreeVirtualMemory+0x14ea2 (8086be34)
8086bf91 33c0 xor eax,eax
8086bf93 40 inc eax
8086bf94 f00fc106 lock xadd dword ptr [esi],eax
8086bf98 40 inc eax
8086bf99 5e pop esi
8086bf9a c3 ret //eax = new reference count

虽然该函数的返回值声明为void，事实上 就是引用计数。