ObReferenceObjectByName蓝屏问题

来源：互联网发布：邓老师c语言视频教程编辑：程序博客网时间：2024/05/16 07:03

在拖了几天，调了快一天之后，问题终于在新年的第一天解决，庆贺一下O(∩_∩)O~

在“北极星2003”的CSDN博客上看到说用ObReferenceObjectByName来输出驱动程序的基本信息，结果我去测试的时候无情的蓝屏了。找了好久，终于发现了原因所在。因为博客上的代码是C++，而ObReferenceObjectByName是NativeAPI，所以需要做一个声明，C++用了extern “C”，而我的是C语言，用了ifdef宏定义，忘了加extern了，结果导致了蓝屏。

用WinDbg调试的时候，已进入ObReferenceObjectByName函数，系统就崩溃了，根本无法继续调试。还好最后发现了问题的所在。下面把代码贴出来

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970

#include <ntddk.h> // 注意对于NativeAPI的声明// C语言要加上extern// C++要加上extern "C"extern NTSTATUS ObReferenceObjectByName(IN PUNICODE_STRING ObjectPath,IN ULONG Attributes,IN PACCESS_STATE PassedAccessState OPTIONAL,IN ACCESS_MASK DesiredAccess OPTIONAL,IN POBJECT_TYPE ObjectType,IN KPROCESSOR_MODE AccessMode,IN OUT PVOID ParseContext OPTIONAL,OUT PVOID *ObjectPtr);extern POBJECT_TYPE *IoDeviceObjectType; // 卸载例程VOID DriverUnload(PDRIVER_OBJECT pDriverObject){DbgPrint("--------------------------------\n");} // 获取信息NTSTATUS GetInfo(){NTSTATUSstatus = STATUS_UNSUCCESSFUL;PDRIVER_OBJECTpTestObject = NULL;UNICODE_STRINGuniDriverName;WCHARDriverNameBuffer[] = L"\\Driver\\HelloDDK"; RtlInitUnicodeString(&uniDriverName, DriverNameBuffer);status = ObReferenceObjectByName(&uniDriverName,OBJ_CASE_INSENSITIVE,NULL,0,*IoDeviceObjectType,KernelMode,NULL,&pTestObject);if(!NT_SUCCESS(status)){DbgPrint("ObReferenceObjectByName Failure!\n");return status;} DbgPrint("Driver Name: %wZ\n", &uniDriverName);DbgPrint("Load Address: 0x%08X\n", pTestObject->DriverStart);DbgPrint("Driver Size: %d\n", pTestObject->DriverSize);DbgPrint("Driver Object: 0x%08X\n", pTestObject->DriverExtension->DriverObject);DbgPrint("FastIo Dispatch: 0x%08X\n", pTestObject->FastIoDispatch);DbgPrint("StartIo Entry: 0x%08X\n", pTestObject->DriverStartIo);DbgPrint("Add Device Entry:: 0x%08X\n", pTestObject->DriverExtension->AddDevice);DbgPrint("Unload Routine: 0x%08X\n", pTestObject->DriverUnload); ObDereferenceObject(pTestObject); return status;} NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath){NTSTATUS status;DbgPrint("--------------------------------\n");pDriverObject->DriverUnload = DriverUnload;;GetInfo(); return STATUS_SUCCESS;}