四。目录对象结构(ObpLookupDirectoryEntry、ObpLookupObjectName) (一)

最新推荐文章于 2024-11-14 13:49:39 发布

wzsy

最新推荐文章于 2024-11-14 13:49:39 发布

阅读量1.9k

点赞数

文章标签： object struct 数据结构 attributes header buffer

四。目录对象结构(ObpLookupDirectoryEntry、ObpLookupObjectName) (一)

2010年05月11日星期二 14:31

第一篇在分析ObCreateObjectType函数中出现了ObpLookupDirectoryEntry。
这个函数的作用是查询指定的目录对象中是否包含某对象。

目录对象的数据结构是OBJECT_DIRECTORY
typedef struct _OBJECT_DIRECTORY {
    struct _OBJECT_DIRECTORY_ENTRY *HashBuckets[ NUMBER_HASH_BUCKETS ];
    EX_PUSH_LOCK Lock;
    struct _DEVICE_MAP *DeviceMap;
    ULONG SessionId;
} OBJECT_DIRECTORY, *POBJECT_DIRECTORY;

HashBuckets是一个根据哈希数组
哈希值是根据对象的名字计算出来的

typedef struct _OBJECT_DIRECTORY_ENTRY {
    struct _OBJECT_DIRECTORY_ENTRY *ChainLink;
    PVOID Object;
    ULONG HashValue;
} OBJECT_DIRECTORY_ENTRY, *POBJECT_DIRECTORY_ENTRY;

_OBJECT_DIRECTORY_ENTRY.ChainLink 把有相同哈希值的对象串联在一起

+-----------------------+
|    OBJECT_DIRECTORY   |
|        HashBuckets[37]+--+ (37个指针, 分别指向37个_OBJECT_DIRECTORY_ENTRY结构)
|                  Lock | | (HashValue相同的_OBJECT_DIRECTORY_ENTRY结构使用ChainLink串联起来)
+-----------------------+ | (这里只画出了一个指针)
+--------------------------+
V
+-----------------------+ +->+-----------------------+
|_OBJECT_DIRECTORY_ENTRY| | |_OBJECT_DIRECTORY_ENTRY|
|              ChainLink+--+ |              ChainLink+->.....
|                 Object|     |                 Object|
|              HashValue|     |              HashValue|
+-----------------------+     +-----------------------+

下面开始分析ObpLookupDirectoryEntry函数
PVOID
ObpLookupDirectoryEntry (
    IN POBJECT_DIRECTORY Directory,            //目录对象
    IN PUNICODE_STRING Name,                   //搜索的名字
    IN ULONG Attributes,                       //指定是否区分大小写
    IN BOOLEAN SearchShadow,                   //是否搜索shadow directory
    OUT POBP_LOOKUP_CONTEXT LookupContext      //查询详细信息通过这个结构返回
    ) {
    ......
    // 一些参数检测
    ......

    // 根据名字计算一个哈希值, WcharLength是名字长度, Buffer指向Name->Buffer
    HashIndex = 0;
    while (WcharLength--) {
        Wchar = *Buffer++;
        HashIndex += (HashIndex << 1) + (HashIndex >> 1);
        if (Wchar < 'a') {
            HashIndex += Wchar;
        } else if (Wchar > 'z') {
            HashIndex += RtlUpcaseUnicodeChar( ( WCHAR )Wchar );
        } else {
            HashIndex += (Wchar - ('a'-'A'));
        }
    }
    HashValue = HashIndex;
    HashIndex %= NUMBER_HASH_BUCKETS;
    LookupContext->HashIndex = ( USHORT )HashIndex;
    LookupContext->HashValue = HashValue;

    while (1) {
        // 获取对应的哈希表项
        HeadDirectoryEntry = (POBJECT_DIRECTORY_ENTRY *)&Directory->HashBuckets[ HashIndex ];
        LookupBucket = HeadDirectoryEntry;

        // 这个函数给目录上共享锁, _OBJECT_DIRECTORY.Lock 是共享锁数据结构
        if (!LookupContext->DirectoryLocked) {
            ObpLockDirectoryShared( Directory, LookupContext);
        }

// 遍历 _OBJECT_DIRECTORY_ENTRY.ChainLink 链表
        while ((DirectoryEntry = *HeadDirectoryEntry) != NULL ) {

            if (DirectoryEntry->HashValue == HashValue) {
                // 比较对象名称
                ObjectHeader = OBJECT_TO_OBJECT_HEADER( DirectoryEntry->Object );
                NameInfo = OBJECT_HEADER_TO_NAME_INFO_EXISTS( ObjectHeader );
                if (RtlEqualUnicodeString( Name,
                                           &NameInfo->Name,
                                           CaseInSensitive )) {
                    break ;
                }
            }

            HeadDirectoryEntry = &DirectoryEntry->ChainLink;
        }

        if (DirectoryEntry) {
            // 找到了对象所在的DirectoryEntry, 返回对应的OBJECT
            if (HeadDirectoryEntry != LookupBucket) {
                if ( LookupContext->DirectoryLocked
                        ||
                     ExTryConvertPushLockSharedToExclusive(&Directory->Lock)) {

                    *HeadDirectoryEntry = DirectoryEntry->ChainLink;
                    DirectoryEntry->ChainLink = *LookupBucket;
                    *LookupBucket = DirectoryEntry;
                }
            }
            Object = DirectoryEntry->Object;
            goto UPDATECONTEXT;
        } else {
            // 没有找到对象的DirectoryEntry
            if (!LookupContext->DirectoryLocked) {
                ObpUnlockDirectory( Directory, LookupContext );
            }
            if (SearchShadow && Directory->DeviceMap != NULL ) {
                POBJECT_DIRECTORY NewDirectory;

                NewDirectory = ObpGetShadowDirectory (Directory);
                if (NewDirectory != NULL ) {
                    Directory = NewDirectory;
                    continue ;
                }
            }
            goto UPDATECONTEXT;
        }
    }
UPDATECONTEXT:
    .....
    return Object;
}

看过了查找指定目录下是否有指定名称的对象的函数后
再来看看一个功能更强大的函数ObpLookupObjectName
它可以根据路径来查找对象, 路径里还可以包含符号链接等。。。总之很复杂很强大。。。