26 #ifndef NTOS_MODE_USER 34 #define OBJ_INHERIT 0x00000002L 35 #define OBJ_PERMANENT 0x00000010L 36 #define OBJ_EXCLUSIVE 0x00000020L 37 #define OBJ_CASE_INSENSITIVE 0x00000040L 38 #define OBJ_OPENIF 0x00000080L 39 #define OBJ_OPENLINK 0x00000100L 40 #define OBJ_KERNEL_HANDLE 0x00000200L 41 #define OBJ_FORCE_ACCESS_CHECK 0x00000400L 42 #define OBJ_VALID_ATTRIBUTES 0x000007F2L 44 #define InitializeObjectAttributes(p,n,a,r,s) { \ 45 (p)->Length = sizeof(OBJECT_ATTRIBUTES); \ 46 (p)->RootDirectory = (r); \ 47 (p)->Attributes = (a); \ 48 (p)->ObjectName = (n); \ 49 (p)->SecurityDescriptor = (s); \ 50 (p)->SecurityQualityOfService = NULL; \ 56 #define OBJ_HANDLE_TAGBITS 0x3 61 #define DIRECTORY_QUERY 0x0001 62 #define DIRECTORY_TRAVERSE 0x0002 63 #define DIRECTORY_CREATE_OBJECT 0x0004 64 #define DIRECTORY_CREATE_SUBDIRECTORY 0x0008 65 #define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xF) 70 #define OBJ_NAME_PATH_SEPARATOR L'\\' 81 ObjectHandleFlagInformation,
82 ObjectSessionInformation,
91 #define OBJ_KERNEL_EXCLUSIVE 0x00010000L 92 #define OBJ_VALID_KERNEL_ATTRIBUTES (OBJ_VALID_ATTRIBUTES | \ 97 #define OB_FLAG_CREATE_INFO 0x01 98 #define OB_FLAG_KERNEL_MODE 0x02 99 #define OB_FLAG_CREATOR_INFO 0x04 100 #define OB_FLAG_EXCLUSIVE 0x08 101 #define OB_FLAG_PERMANENT 0x10 102 #define OB_FLAG_SECURITY 0x20 103 #define OB_FLAG_SINGLE_PROCESS 0x40 104 #define OB_FLAG_DEFER_DELETE 0x80 109 #define OB_FLAG_KERNEL_EXCLUSIVE 0x40000000 111 #define OBJECT_TO_OBJECT_HEADER(o) \ 112 CONTAINING_RECORD((o), OBJECT_HEADER, Body) 114 #define OBJECT_HEADER_TO_NAME_INFO(h) \ 115 ((POBJECT_HEADER_NAME_INFO)(!(h)->NameInfoOffset ? \ 116 NULL: ((PCHAR)(h) - (h)->NameInfoOffset))) 118 #define OBJECT_HEADER_TO_HANDLE_INFO(h) \ 119 ((POBJECT_HEADER_HANDLE_INFO)(!(h)->HandleInfoOffset ? \ 120 NULL: ((PCHAR)(h) - (h)->HandleInfoOffset))) 122 #define OBJECT_HEADER_TO_QUOTA_INFO(h) \ 123 ((POBJECT_HEADER_QUOTA_INFO)(!(h)->QuotaInfoOffset ? \ 124 NULL: ((PCHAR)(h) - (h)->QuotaInfoOffset))) 126 #define OBJECT_HEADER_TO_CREATOR_INFO(h) \ 127 ((POBJECT_HEADER_CREATOR_INFO)(!((h)->Flags & \ 128 OB_FLAG_CREATOR_INFO) ? NULL: ((PCHAR)(h) - \ 129 sizeof(OBJECT_HEADER_CREATOR_INFO)))) 131 #define OBJECT_HEADER_TO_EXCLUSIVE_PROCESS(h) \ 132 ((!((h)->Flags & OB_FLAG_EXCLUSIVE)) ? \ 133 NULL: (((POBJECT_HEADER_QUOTA_INFO)((PCHAR)(h) - \ 134 (h)->QuotaInfoOffset))->ExclusiveProcess)) 153 #define DUPLICATE_SAME_ATTRIBUTES 0x00000004 158 #define NUMBER_HASH_BUCKETS 37 163 #define DOSDEVICE_DRIVE_UNKNOWN 0 164 #define DOSDEVICE_DRIVE_CALCULATE 1 165 #define DOSDEVICE_DRIVE_REMOVABLE 2 166 #define DOSDEVICE_DRIVE_FIXED 3 167 #define DOSDEVICE_DRIVE_REMOTE 4 168 #define DOSDEVICE_DRIVE_CDROM 5 169 #define DOSDEVICE_DRIVE_RAMDISK 6 180 #ifndef NTOS_MODE_USER 316 #ifdef NTOS_MODE_USER 402 #if (NTDDI_VERSION >= NTDDI_WS03) 410 #if (NTDDI_VERSION < NTDDI_WINXP) 415 #if (NTDDI_VERSION < NTDDI_WINXP) 421 #if (NTDDI_VERSION == NTDDI_WINXP) 549 #endif // !NTOS_MODE_USER
struct _OBJECT_CREATE_INFORMATION * POBJECT_CREATE_INFORMATION
PDEVICE_MAP NTSYSAPI ObSystemDeviceMap
OB_DUMP_METHOD DumpProcedure
#define NUMBER_HASH_BUCKETS
struct _OBJECT_HANDLE_COUNT_ENTRY * POBJECT_HANDLE_COUNT_ENTRY
IN CINT OUT PVOID IN ULONG OUT PULONG ReturnLength
struct _OBJECT_HEADER_HANDLE_INFO * POBJECT_HEADER_HANDLE_INFO
struct _OBJECT_DIRECTORY * POBJECT_DIRECTORY
_In_ ULONG _In_ ULONG _In_ ULONG Length
OB_OKAYTOCLOSE_METHOD OkayToCloseProcedure
POBJECT_HANDLE_COUNT_DATABASE HandleCountDatabase
struct _OBJECT_SYMBOLIC_LINK * POBJECT_SYMBOLIC_LINK
_In_ USHORT _In_ ULONG _In_ PSOCKADDR _In_ PSOCKADDR _Reserved_ ULONG _In_opt_ PVOID _In_opt_ const WSK_CLIENT_CONNECTION_DISPATCH _In_opt_ PEPROCESS _In_opt_ PETHREAD _In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor
struct _OBJECT_HANDLE_ATTRIBUTE_INFORMATION * POBJECT_HANDLE_ATTRIBUTE_INFORMATION
struct _DEVICE_MAP * PDEVICE_MAP
POBJECT_DIRECTORY Directory
ULONG DosDeviceDriveIndex
struct _OBJECT_HEADER_CREATOR_INFO * POBJECT_HEADER_CREATOR_INFO
struct _OBJECT_BASIC_INFORMATION * POBJECT_BASIC_INFORMATION
struct _OBJECT_ALL_TYPES_INFORMATION OBJECT_ALL_TYPES_INFORMATION
struct _OBJECT_HANDLE_COUNT_DATABASE * POBJECT_HANDLE_COUNT_DATABASE
struct _OBJECT_TYPE_INITIALIZER OBJECT_TYPE_INITIALIZER
ULONG TotalNumberOfHandles
LARGE_INTEGER CreationTime
struct _OBJECT_NAME_INFORMATION * POBJECT_NAME_INFORMATION
struct _OBJECT_HANDLE_COUNT_ENTRY OBJECT_HANDLE_COUNT_ENTRY
struct _OBJECT_DIRECTORY_INFORMATION * POBJECT_DIRECTORY_INFORMATION
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
struct _OBJECT_HEADER OBJECT_HEADER
struct _OBJECT_HEADER * POBJECT_HEADER
struct _OB_DUMP_CONTROL * POB_DUMP_CONTROL
struct _OBJECT_TYPE_INFORMATION OBJECT_TYPE_INFORMATION
BOOLEAN MaintainHandleCount
struct _OBP_LOOKUP_CONTEXT OBP_LOOKUP_CONTEXT
_In_ PEPROCESS _In_ KPROCESSOR_MODE AccessMode
struct _OBP_LOOKUP_CONTEXT * POBP_LOOKUP_CONTEXT
struct _OBJECT_DIRECTORY_ENTRY OBJECT_DIRECTORY_ENTRY
_In_ WDF_WMI_PROVIDER_CONTROL Control
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ SECURITY_INFORMATION SecurityInformation
_Reserved_ PVOID Reserved
OB_CLOSE_METHOD CloseProcedure
NTSTATUS(NTAPI * OB_PARSE_METHOD)(_In_ PVOID ParseObject, _In_ PVOID ObjectType, _Inout_ PACCESS_STATE AccessState, _In_ KPROCESSOR_MODE AccessMode, _In_ ULONG Attributes, _Inout_ PUNICODE_STRING CompleteName, _Inout_ PUNICODE_STRING RemainingName, _Inout_opt_ PVOID Context, _In_opt_ PSECURITY_QUALITY_OF_SERVICE SecurityQos, _Out_ PVOID *Object)
POBJECT_DIRECTORY GlobalDosDevicesDirectory
struct _EPROCESS * Process
struct _OBJECT_HEADER_QUOTA_INFO OBJECT_HEADER_QUOTA_INFO
struct _OBJECT_BASIC_INFORMATION OBJECT_BASIC_INFORMATION
OBJECT_HANDLE_COUNT_ENTRY SingleEntry
DWORD * PSECURITY_INFORMATION
OB_PARSE_METHOD ParseProcedure
UNICODE_STRING LinkTarget
_In_opt_ PVOID _In_opt_ PUNICODE_STRING _In_ PSECURITY_DESCRIPTOR _In_ PACCESS_STATE AccessState
struct _OBJECT_HANDLE_ATTRIBUTE_INFORMATION OBJECT_HANDLE_ATTRIBUTE_INFORMATION
VOID(NTAPI * OB_DUMP_METHOD)(_In_ PVOID Object, _In_opt_ POB_DUMP_CONTROL Control)
USHORT SymbolicLinkUsageCount
struct _OBJECT_TYPE_INITIALIZER * POBJECT_TYPE_INITIALIZER
OB_OPEN_METHOD OpenProcedure
struct _OBJECT_HEADER_NAME_INFO * POBJECT_HEADER_NAME_INFO
struct _OBJECT_TYPE_INFORMATION * POBJECT_TYPE_INFORMATION
ULONG HighWaterNumberOfObjects
struct _DEVICE_MAP DEVICE_MAP
OBJECT_HANDLE_COUNT_ENTRY HandleCountEntries[1]
OBJECT_TYPE_INITIALIZER TypeInfo
VOID(NTAPI * OB_DELETE_METHOD)(_In_ PVOID Object)
ULONG HighWaterNumberOfHandles
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object
struct _OBJECT_DIRECTORY_ENTRY * HashBuckets[NUMBER_HASH_BUCKETS]
struct _OBJECT_DIRECTORY_INFORMATION OBJECT_DIRECTORY_INFORMATION
enum _OB_OPEN_REASON OB_OPEN_REASON
struct _DEVICE_MAP * DeviceMap
ULONG DefaultPagedPoolCharge
struct _OBJECT_HEADER_QUOTA_INFO * POBJECT_HEADER_QUOTA_INFO
static GENERIC_MAPPING GenericMapping
ULONG TotalNumberOfObjects
UNICODE_STRING LinkTargetRemaining
GENERIC_MAPPING GenericMapping
NTSTATUS(NTAPI * OB_SECURITY_METHOD)(_In_ PVOID Object, _In_ SECURITY_OPERATION_CODE OperationType, _In_ PSECURITY_INFORMATION SecurityInformation, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _Inout_ PULONG CapturedLength, _Inout_ PSECURITY_DESCRIPTOR *ObjectSecurityDescriptor, _In_ POOL_TYPE PoolType, _In_ PGENERIC_MAPPING GenericMapping)
struct _OB_DUMP_CONTROL OB_DUMP_CONTROL
OB_SECURITY_METHOD SecurityProcedure
struct _OBJECT_DIRECTORY_ENTRY * ChainLink
VOID(NTAPI * OB_CLOSE_METHOD)(_In_opt_ PEPROCESS Process, _In_ PVOID Object, _In_ ACCESS_MASK GrantedAccess, _In_ ULONG ProcessHandleCount, _In_ ULONG SystemHandleCount)
NTSTATUS(NTAPI * OB_QUERYNAME_METHOD)(_In_ PVOID Object, _In_ BOOLEAN HasObjectName, _Out_ POBJECT_NAME_INFORMATION ObjectNameInfo, _In_ ULONG Length, _Out_ PULONG ReturnLength, _In_ KPROCESSOR_MODE AccessMode)
struct _OBJECT_HEADER_NAME_INFO OBJECT_HEADER_NAME_INFO
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
struct _OBJECT_ALL_TYPES_INFORMATION * POBJECT_ALL_TYPES_INFORMATION
struct tagContext Context
struct _OBJECT_DIRECTORY_ENTRY * POBJECT_DIRECTORY_ENTRY
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ _Strict_type_match_ POOL_TYPE PoolType
OB_QUERYNAME_METHOD QueryNameProcedure
BOOLEAN(NTAPI * OB_OKAYTOCLOSE_METHOD)(_In_opt_ PEPROCESS Process, _In_ PVOID Object, _In_ HANDLE Handle, _In_ KPROCESSOR_MODE AccessMode)
struct _OBJECT_CREATE_INFORMATION OBJECT_CREATE_INFORMATION
POBJECT_DIRECTORY DosDevicesDirectory
struct _OBJECT_HEADER_HANDLE_INFO OBJECT_HEADER_HANDLE_INFO
_In_ PSECURITY_SUBJECT_CONTEXT _In_ BOOLEAN _In_ ACCESS_MASK _In_ ACCESS_MASK _Outptr_opt_ PPRIVILEGE_SET _In_ PGENERIC_MAPPING _In_ KPROCESSOR_MODE _Out_ PACCESS_MASK GrantedAccess
_OBJECT_INFORMATION_CLASS
OB_DELETE_METHOD DeleteProcedure
PVOID PVOID PWCHAR PVOID USHORT PULONG Reason
struct _OBJECT_SYMBOLIC_LINK OBJECT_SYMBOLIC_LINK
NTSTATUS(NTAPI * OB_OPEN_METHOD)(_In_ OB_OPEN_REASON Reason, _In_opt_ PEPROCESS Process, _In_ PVOID ObjectBody, _In_ ACCESS_MASK GrantedAccess, _In_ ULONG HandleCount)
ULONG DefaultNonPagedPoolCharge
struct _OBJECT_NAME_INFORMATION OBJECT_NAME_INFORMATION
struct _OBJECT_HEADER_CREATOR_INFO OBJECT_HEADER_CREATOR_INFO
struct _OBJECT_TYPE OBJECT_TYPE
struct _OBJECT_HANDLE_COUNT_DATABASE OBJECT_HANDLE_COUNT_DATABASE
_Must_inspect_result_ _In_ WDFDMAENABLER _In_ _In_opt_ PWDF_OBJECT_ATTRIBUTES Attributes
_Inout_ PFCB _Inout_ PUNICODE_STRING RemainingName
struct _OBJECT_DIRECTORY OBJECT_DIRECTORY