通过NtCreateFile打开设备,获得的句柄实际上指向的是一个文件对象(FILE_OBJECT),而不是设备对象(DEVICE_OBJECT).
设备对象类型的创建过程如下,是有存在ParseProcedure的 :
RtlInitUnicodeString( &nameString, L"Device" );
objectTypeInitializer.DefaultNonPagedPoolCharge = sizeof( DEVICE_OBJECT );
objectTypeInitializer.ParseProcedure = IopParseDevice;
objectTypeInitializer.CaseInsensitive = TRUE;
objectTypeInitializer.DeleteProcedure = IopDeleteDevice;
objectTypeInitializer.SecurityProcedure = IopGetSetSecurityObject;
objectTypeInitializer.QueryNameProcedure = (OB_QUERYNAME_METHOD)NULL;
if (!NT_SUCCESS( ObCreateObjectType( &nameString,
&objectTypeInitializer,
(PSECURITY_DESCRIPTOR) NULL,
&a