#include <umtypes.h>
#include <pstypes.h>
#include <obtypes.h>

Include dependency graph for obfuncs.h:

Functions
NTKERNELAPI NTSTATUS NTAPI	ObAssignSecurity (_In_ PACCESS_STATE AccessState, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ PVOID Object, _In_ POBJECT_TYPE Type)

NTKERNELAPI NTSTATUS NTAPI	ObCloseHandle (_In_ HANDLE Handle, _In_ KPROCESSOR_MODE AccessMode)

NTKERNELAPI NTSTATUS NTAPI	ObCreateObject (_In_opt_ KPROCESSOR_MODE ObjectAttributesAccessMode, _In_ POBJECT_TYPE ObjectType, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ KPROCESSOR_MODE AccessMode, _Inout_opt_ PVOID ParseContext, _In_ ULONG ObjectSize, _In_opt_ ULONG PagedPoolCharge, _In_opt_ ULONG NonPagedPoolCharge, _Out_ PVOID *Object)

NTKERNELAPI NTSTATUS NTAPI	ObCreateObjectType (_In_ PUNICODE_STRING TypeName, _In_ POBJECT_TYPE_INITIALIZER ObjectTypeInitializer, _Reserved_ PVOID Reserved, _Out_ POBJECT_TYPE *ObjectType)

NTKERNELAPI VOID NTAPI	ObDereferenceSecurityDescriptor (_Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ ULONG Count)

NTKERNELAPI ULONG NTAPI	ObGetObjectPointerCount (_In_ PVOID Object)

NTKERNELAPI NTSTATUS NTAPI	ObLogSecurityDescriptor (_In_ PSECURITY_DESCRIPTOR InputSecurityDescriptor, _Out_ PSECURITY_DESCRIPTOR *OutputSecurityDescriptor, _In_ ULONG RefBias)

NTKERNELAPI NTSTATUS NTAPI	ObOpenObjectByName (_In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ POBJECT_TYPE ObjectType, _In_ KPROCESSOR_MODE AccessMode, _In_opt_ PACCESS_STATE PassedAccessState, _In_ ACCESS_MASK DesiredAccess, _Inout_opt_ PVOID ParseContext, _Out_ PHANDLE Handle)

NTKERNELAPI NTSTATUS NTAPI	ObReferenceObjectByName (_In_ PUNICODE_STRING ObjectName, _In_ ULONG Attributes, _In_opt_ PACCESS_STATE PassedAccessState, _In_opt_ ACCESS_MASK DesiredAccess, _In_ POBJECT_TYPE ObjectType, _In_ KPROCESSOR_MODE AccessMode, _Inout_opt_ PVOID ParseContext, _Out_ PVOID *Object)

NTKERNELAPI VOID NTAPI	ObReferenceSecurityDescriptor (_In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ ULONG Count)

NTKERNELAPI NTSTATUS NTAPI	ObSetSecurityObjectByPointer (_In_ PVOID Object, _In_ SECURITY_INFORMATION SecurityInformation, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor)

NTKERNELAPI BOOLEAN NTAPI	ObFindHandleForObject (_In_ PEPROCESS Process, _In_ PVOID Object, _In_ POBJECT_TYPE ObjectType, _In_opt_ POBJECT_HANDLE_INFORMATION HandleInformation, _Out_opt_ PHANDLE Handle)

NTKERNELAPI VOID NTAPI	ObDereferenceObjectDeferDelete (_In_ PVOID Object)

NTSYSCALLAPI NTSTATUS NTAPI	NtClose (_In_ HANDLE Handle)

__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI	NtCloseObjectAuditAlarm (_In_ PUNICODE_STRING SubsystemName, _In_opt_ PVOID HandleId, _In_ BOOLEAN GenerateOnClose)

NTSYSCALLAPI NTSTATUS NTAPI	NtCreateDirectoryObject (_Out_ PHANDLE DirectoryHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)

NTSYSCALLAPI NTSTATUS NTAPI	NtCreateSymbolicLinkObject (_Out_ PHANDLE SymbolicLinkHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ PUNICODE_STRING Name)

__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI	NtDeleteObjectAuditAlarm (_In_ PUNICODE_STRING SubsystemName, _In_opt_ PVOID HandleId, _In_ BOOLEAN GenerateOnClose)

NTSYSCALLAPI NTSTATUS NTAPI	NtDuplicateObject (_In_ HANDLE SourceProcessHandle, _In_ HANDLE SourceHandle, _In_ HANDLE TargetProcessHandle, _Out_ PHANDLE TargetHandle, _In_ ACCESS_MASK DesiredAccess, _In_ ULONG HandleAttributes, _In_ ULONG Options)

NTSYSCALLAPI NTSTATUS NTAPI	NtMakePermanentObject (_In_ HANDLE Object)

NTSYSCALLAPI NTSTATUS NTAPI	NtMakeTemporaryObject (_In_ HANDLE Handle)

NTSYSCALLAPI NTSTATUS NTAPI	NtOpenDirectoryObject (_Out_ PHANDLE FileHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)

NTSYSCALLAPI NTSTATUS NTAPI	NtOpenJobObject (_Out_ PHANDLE JobHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)

NTSYSCALLAPI NTSTATUS NTAPI	NtOpenSymbolicLinkObject (_Out_ PHANDLE SymbolicLinkHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)

NTSYSCALLAPI NTSTATUS NTAPI	NtQueryDirectoryObject (_In_ HANDLE DirectoryHandle, _Out_ PVOID Buffer, _In_ ULONG BufferLength, _In_ BOOLEAN ReturnSingleEntry, _In_ BOOLEAN RestartScan, _Inout_ PULONG Context, _Out_opt_ PULONG ReturnLength)

	_IRQL_requires_max_ (PASSIVE_LEVEL) __kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtQueryObject(_In_opt_ HANDLE Handle

_In_ OBJECT_INFORMATION_CLASS	_Out_writes_bytes_opt_ (ObjectInformationLength) PVOID ObjectInformation

_In_ SECURITY_INFORMATION	_Out_writes_bytes_opt_ (Length) PSECURITY_DESCRIPTOR SecurityDescriptor

NTSYSCALLAPI NTSTATUS NTAPI	NtQuerySymbolicLinkObject (_In_ HANDLE SymLinkObjHandle, _Out_ PUNICODE_STRING LinkTarget, _Out_opt_ PULONG DataWritten)

NTSYSCALLAPI NTSTATUS NTAPI	NtSetInformationObject (_In_ HANDLE ObjectHandle, _In_ OBJECT_INFORMATION_CLASS ObjectInformationClass, _In_ PVOID ObjectInformation, _In_ ULONG Length)

NTSYSCALLAPI NTSTATUS NTAPI	NtSetSecurityObject (_In_ HANDLE Handle, _In_ SECURITY_INFORMATION SecurityInformation, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor)

NTSYSCALLAPI NTSTATUS NTAPI	NtSignalAndWaitForSingleObject (_In_ HANDLE SignalObject, _In_ HANDLE WaitObject, _In_ BOOLEAN Alertable, _In_ PLARGE_INTEGER Time)

NTSYSCALLAPI NTSTATUS NTAPI	NtWaitForMultipleObjects (_In_ ULONG Count, _In_ HANDLE Object[], _In_ WAIT_TYPE WaitType, _In_ BOOLEAN Alertable, _In_ PLARGE_INTEGER Time)

NTSTATUS NTAPI	NtWaitForMultipleObjects32 (_In_ ULONG ObjectCount, _In_ PLONG Handles, _In_ WAIT_TYPE WaitType, _In_ BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER TimeOut)

NTSYSCALLAPI NTSTATUS NTAPI	NtWaitForSingleObject (_In_ HANDLE Object, _In_ BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER Timeout)

NTSYSAPI NTSTATUS NTAPI	ZwClose (_In_ HANDLE Handle)

NTSYSAPI NTSTATUS NTAPI	ZwCloseObjectAuditAlarm (_In_ PUNICODE_STRING SubsystemName, _In_ PVOID HandleId, _In_ BOOLEAN GenerateOnClose)

NTSYSAPI NTSTATUS NTAPI	ZwCreateDirectoryObject (_Out_ PHANDLE DirectoryHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)

NTSYSAPI NTSTATUS NTAPI	ZwCreateSymbolicLinkObject (_Out_ PHANDLE SymbolicLinkHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ PUNICODE_STRING Name)

NTSYSAPI NTSTATUS NTAPI	ZwDeleteObjectAuditAlarm (_In_ PUNICODE_STRING SubsystemName, _In_ PVOID HandleId, _In_ BOOLEAN GenerateOnClose)

NTSYSAPI NTSTATUS NTAPI	ZwMakePermanentObject (_In_ HANDLE Object)

NTSYSAPI NTSTATUS NTAPI	ZwMakeTemporaryObject (_In_ HANDLE Handle)

NTSYSAPI NTSTATUS NTAPI	ZwOpenDirectoryObject (_Out_ PHANDLE FileHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)

NTSYSAPI NTSTATUS NTAPI	ZwOpenJobObject (_Out_ PHANDLE JobHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)

NTSYSAPI NTSTATUS NTAPI	ZwOpenSymbolicLinkObject (_Out_ PHANDLE SymbolicLinkHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)

NTSYSAPI NTSTATUS NTAPI	ZwSetInformationObject (_In_ HANDLE ObjectHandle, _In_ OBJECT_INFORMATION_CLASS ObjectInformationClass, _In_ PVOID ObjectInformation, _In_ ULONG Length)

NTSYSAPI NTSTATUS NTAPI	ZwSignalAndWaitForSingleObject (_In_ HANDLE SignalObject, _In_ HANDLE WaitObject, _In_ BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER Time)

NTSYSAPI NTSTATUS NTAPI	ZwWaitForMultipleObjects (_In_ ULONG Count, _In_ HANDLE Object[], _In_ WAIT_TYPE WaitType, _In_ BOOLEAN Alertable, _In_ PLARGE_INTEGER Time)

Variables
_In_ OBJECT_INFORMATION_CLASS	ObjectInformationClass

_In_ OBJECT_INFORMATION_CLASS _In_ ULONG	ObjectInformationLength

_In_ OBJECT_INFORMATION_CLASS _In_ ULONG _Out_opt_ PULONG	ReturnLength

_In_ SECURITY_INFORMATION	SecurityInformation

_In_ SECURITY_INFORMATION _In_ ULONG	Length

_In_ SECURITY_INFORMATION _In_ ULONG _Out_ PULONG	LengthNeeded

_In_ HANDLE	SourceHandle

_In_ HANDLE _In_opt_ HANDLE	TargetProcessHandle

_In_ HANDLE _In_opt_ HANDLE _Out_opt_ PHANDLE	TargetHandle

_In_ HANDLE _In_opt_ HANDLE _Out_opt_ PHANDLE _In_ ACCESS_MASK	DesiredAccess

_In_ HANDLE _In_opt_ HANDLE _Out_opt_ PHANDLE _In_ ACCESS_MASK _In_ ULONG	HandleAttributes

_In_ HANDLE _In_opt_ HANDLE _Out_opt_ PHANDLE _In_ ACCESS_MASK _In_ ULONG _In_ ULONG	Options

_Out_ PVOID	Buffer

_Out_ PVOID _In_ ULONG	BufferLength

_Out_ PVOID _In_ ULONG _In_ BOOLEAN	ReturnSingleEntry

_Out_ PVOID _In_ ULONG _In_ BOOLEAN _In_ BOOLEAN	RestartScan

_Out_ PVOID _In_ ULONG _In_ BOOLEAN _In_ BOOLEAN _Inout_ PULONG	Context

Function Documentation

◆ _IRQL_requires_max_()

_IRQL_requires_max_ ( PASSIVE_LEVEL )

Definition at line 64 of file Messaging.c.

 {
     PFLT_SERVER_PORT_OBJECT PortObject;
     NTSTATUS Status;
 
     /* The caller must allow at least one connection */
     if (MaxConnections == 0)
     {
         return STATUS_INVALID_PARAMETER;
     }
 
     /* The request must be for a kernel handle */
     if (!(ObjectAttributes->Attributes & OBJ_KERNEL_HANDLE))
     {
         return STATUS_INVALID_PARAMETER;
     }
 
     /*
      * Get rundown protection on the target to stop the owner
      * from unloading whilst this port object is open. It gets
      * removed in the FltpServerPortClose callback
      */
     Status = FltObjectReference(Filter);
     if (!NT_SUCCESS(Status))
     {
         return Status;
     }
 
     /* Create the server port object for this filter */
     Status = ObCreateObject(KernelMode,
                             ServerPortObjectType,
                             ObjectAttributes,
                             KernelMode,
                             NULL,
                             sizeof(FLT_SERVER_PORT_OBJECT),
                             0,
                             0,
                             (PVOID *)&PortObject);
     if (NT_SUCCESS(Status))
     {
         /* Zero out the struct */
         RtlZeroMemory(PortObject, sizeof(FLT_SERVER_PORT_OBJECT));
 
         /* Increment the ref count on the target filter */
         FltpObjectPointerReference((PFLT_OBJECT)Filter);
 
         /* Setup the filter port object */
         PortObject->Filter = Filter;
         PortObject->ConnectNotify = ConnectNotifyCallback;
         PortObject->DisconnectNotify = DisconnectNotifyCallback;
         PortObject->MessageNotify = MessageNotifyCallback;
         PortObject->Cookie = ServerPortCookie;
         PortObject->MaxConnections = MaxConnections;
 
         /* Insert the object */
         Status = ObInsertObject(PortObject,
                                 NULL,
                                 STANDARD_RIGHTS_ALL | FILE_READ_DATA,
                                 0,
                                 NULL,
                                 (PHANDLE)ServerPort);
         if (NT_SUCCESS(Status))
         {
             /* Lock the connection list */
             ExAcquireFastMutex(&Filter->ConnectionList.mLock);
 
             /* Add the new port object to the connection list and increment the count */
             InsertTailList(&Filter->ConnectionList.mList, &PortObject->FilterLink);
             Filter->ConnectionList.mCount++;
 
             /* Unlock the connection list*/
             ExReleaseFastMutex(&Filter->ConnectionList.mLock);
         }
     }
 
     if (!NT_SUCCESS(Status))
     {
         /* Allow the filter to be cleaned up */
         FltObjectDereference(Filter);
     }
 
     return Status;
 }

◆ _Out_writes_bytes_opt_() [1/2]

_In_ OBJECT_INFORMATION_CLASS _Out_writes_bytes_opt_ ( ObjectInformationLength )

◆ _Out_writes_bytes_opt_() [2/2]

_In_ SECURITY_INFORMATION _Out_writes_bytes_opt_ ( Length )

◆ NtClose()

NTSYSCALLAPI NTSTATUS NTAPI NtClose ( _In_ HANDLE Handle )

◆ NtCloseObjectAuditAlarm()

__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtCloseObjectAuditAlarm	(	_In_ PUNICODE_STRING	SubsystemName,
		_In_opt_ PVOID	HandleId,
		_In_ BOOLEAN	GenerateOnClose
	)

◆ NtCreateDirectoryObject()

NTSYSCALLAPI NTSTATUS NTAPI NtCreateDirectoryObject	(	_Out_ PHANDLE	DirectoryHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

◆ NtCreateSymbolicLinkObject()

NTSYSCALLAPI NTSTATUS NTAPI NtCreateSymbolicLinkObject	(	_Out_ PHANDLE	SymbolicLinkHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes,
		_In_ PUNICODE_STRING	Name
	)

◆ NtDeleteObjectAuditAlarm()

__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtDeleteObjectAuditAlarm	(	_In_ PUNICODE_STRING	SubsystemName,
		_In_opt_ PVOID	HandleId,
		_In_ BOOLEAN	GenerateOnClose
	)

◆ NtDuplicateObject()

NTSYSCALLAPI NTSTATUS NTAPI NtDuplicateObject	(	_In_ HANDLE	SourceProcessHandle,
		_In_ HANDLE	SourceHandle,
		_In_ HANDLE	TargetProcessHandle,
		_Out_ PHANDLE	TargetHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ ULONG	HandleAttributes,
		_In_ ULONG	Options
	)

◆ NtMakePermanentObject()

NTSYSCALLAPI NTSTATUS NTAPI NtMakePermanentObject ( _In_ HANDLE Object )

◆ NtMakeTemporaryObject()

NTSYSCALLAPI NTSTATUS NTAPI NtMakeTemporaryObject ( _In_ HANDLE Handle )

◆ NtOpenDirectoryObject()

NTSYSCALLAPI NTSTATUS NTAPI NtOpenDirectoryObject	(	_Out_ PHANDLE	FileHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

◆ NtOpenJobObject()

NTSYSCALLAPI NTSTATUS NTAPI NtOpenJobObject	(	_Out_ PHANDLE	JobHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

◆ NtOpenSymbolicLinkObject()

NTSYSCALLAPI NTSTATUS NTAPI NtOpenSymbolicLinkObject	(	_Out_ PHANDLE	SymbolicLinkHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

◆ NtQueryDirectoryObject()

NTSYSCALLAPI NTSTATUS NTAPI NtQueryDirectoryObject	(	_In_ HANDLE	DirectoryHandle,
		_Out_ PVOID	Buffer,
		_In_ ULONG	BufferLength,
		_In_ BOOLEAN	ReturnSingleEntry,
		_In_ BOOLEAN	RestartScan,
		_Inout_ PULONG	Context,
		_Out_opt_ PULONG	ReturnLength
	)

◆ NtQuerySymbolicLinkObject()

NTSYSCALLAPI NTSTATUS NTAPI NtQuerySymbolicLinkObject	(	_In_ HANDLE	SymLinkObjHandle,
		_Out_ PUNICODE_STRING	LinkTarget,
		_Out_opt_ PULONG	DataWritten
	)

◆ NtSetInformationObject()

NTSYSCALLAPI NTSTATUS NTAPI NtSetInformationObject	(	_In_ HANDLE	ObjectHandle,
		_In_ OBJECT_INFORMATION_CLASS	ObjectInformationClass,
		_In_ PVOID	ObjectInformation,
		_In_ ULONG	Length
	)

◆ NtSetSecurityObject()

NTSYSCALLAPI NTSTATUS NTAPI NtSetSecurityObject	(	_In_ HANDLE	Handle,
		_In_ SECURITY_INFORMATION	SecurityInformation,
		_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor
	)

◆ NtSignalAndWaitForSingleObject()

NTSYSCALLAPI NTSTATUS NTAPI NtSignalAndWaitForSingleObject	(	_In_ HANDLE	SignalObject,
		_In_ HANDLE	WaitObject,
		_In_ BOOLEAN	Alertable,
		_In_ PLARGE_INTEGER	Time
	)

◆ NtWaitForMultipleObjects()

NTSYSCALLAPI NTSTATUS NTAPI NtWaitForMultipleObjects	(	_In_ ULONG	Count,
		_In_ HANDLE	Object[],
		_In_ WAIT_TYPE	WaitType,
		_In_ BOOLEAN	Alertable,
		_In_ PLARGE_INTEGER	Time
	)

◆ NtWaitForMultipleObjects32()

NTSTATUS NTAPI NtWaitForMultipleObjects32	(	_In_ ULONG	ObjectCount,
		_In_ PLONG	Handles,
		_In_ WAIT_TYPE	WaitType,
		_In_ BOOLEAN	Alertable,
		_In_opt_ PLARGE_INTEGER	TimeOut
	)

◆ NtWaitForSingleObject()

NTSYSCALLAPI NTSTATUS NTAPI NtWaitForSingleObject	(	_In_ HANDLE	Object,
		_In_ BOOLEAN	Alertable,
		_In_opt_ PLARGE_INTEGER	Timeout
	)

◆ ObAssignSecurity()

NTKERNELAPI NTSTATUS NTAPI ObAssignSecurity	(	_In_ PACCESS_STATE	AccessState,
		_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_In_ PVOID	Object,
		_In_ POBJECT_TYPE	Type
	)

◆ ObCloseHandle()

NTKERNELAPI NTSTATUS NTAPI ObCloseHandle	(	_In_ HANDLE	Handle,
		_In_ KPROCESSOR_MODE	AccessMode
	)

◆ ObCreateObject()

NTKERNELAPI NTSTATUS NTAPI ObCreateObject	(	_In_opt_ KPROCESSOR_MODE	ObjectAttributesAccessMode,
		_In_ POBJECT_TYPE	ObjectType,
		_In_opt_ POBJECT_ATTRIBUTES	ObjectAttributes,
		_In_ KPROCESSOR_MODE	AccessMode,
		_Inout_opt_ PVOID	ParseContext,
		_In_ ULONG	ObjectSize,
		_In_opt_ ULONG	PagedPoolCharge,
		_In_opt_ ULONG	NonPagedPoolCharge,
		_Out_ PVOID *	Object
	)

◆ ObCreateObjectType()

NTKERNELAPI NTSTATUS NTAPI ObCreateObjectType	(	_In_ PUNICODE_STRING	TypeName,
		_In_ POBJECT_TYPE_INITIALIZER	ObjectTypeInitializer,
		_Reserved_ PVOID	Reserved,
		_Out_ POBJECT_TYPE *	ObjectType
	)

◆ ObDereferenceObjectDeferDelete()

NTKERNELAPI VOID NTAPI ObDereferenceObjectDeferDelete ( _In_ PVOID Object )

◆ ObDereferenceSecurityDescriptor()

NTKERNELAPI VOID NTAPI ObDereferenceSecurityDescriptor	(	_Inout_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_In_ ULONG	Count
	)

◆ ObFindHandleForObject()

NTKERNELAPI BOOLEAN NTAPI ObFindHandleForObject	(	_In_ PEPROCESS	Process,
		_In_ PVOID	Object,
		_In_ POBJECT_TYPE	ObjectType,
		_In_opt_ POBJECT_HANDLE_INFORMATION	HandleInformation,
		_Out_opt_ PHANDLE	Handle
	)

◆ ObGetObjectPointerCount()

NTKERNELAPI ULONG NTAPI ObGetObjectPointerCount ( _In_ PVOID Object )

◆ ObLogSecurityDescriptor()

NTKERNELAPI NTSTATUS NTAPI ObLogSecurityDescriptor	(	_In_ PSECURITY_DESCRIPTOR	InputSecurityDescriptor,
		_Out_ PSECURITY_DESCRIPTOR *	OutputSecurityDescriptor,
		_In_ ULONG	RefBias
	)

◆ ObOpenObjectByName()

NTKERNELAPI NTSTATUS NTAPI ObOpenObjectByName	(	_In_ POBJECT_ATTRIBUTES	ObjectAttributes,
		_In_ POBJECT_TYPE	ObjectType,
		_In_ KPROCESSOR_MODE	AccessMode,
		_In_opt_ PACCESS_STATE	PassedAccessState,
		_In_ ACCESS_MASK	DesiredAccess,
		_Inout_opt_ PVOID	ParseContext,
		_Out_ PHANDLE	Handle
	)

◆ ObReferenceObjectByName()

NTKERNELAPI NTSTATUS NTAPI ObReferenceObjectByName	(	_In_ PUNICODE_STRING	ObjectName,
		_In_ ULONG	Attributes,
		_In_opt_ PACCESS_STATE	PassedAccessState,
		_In_opt_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_TYPE	ObjectType,
		_In_ KPROCESSOR_MODE	AccessMode,
		_Inout_opt_ PVOID	ParseContext,
		_Out_ PVOID *	Object
	)

◆ ObReferenceSecurityDescriptor()

NTKERNELAPI VOID NTAPI ObReferenceSecurityDescriptor	(	_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_In_ ULONG	Count
	)

◆ ObSetSecurityObjectByPointer()

NTKERNELAPI NTSTATUS NTAPI ObSetSecurityObjectByPointer	(	_In_ PVOID	Object,
		_In_ SECURITY_INFORMATION	SecurityInformation,
		_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor
	)

◆ ZwClose()

NTSYSAPI NTSTATUS NTAPI ZwClose ( _In_ HANDLE Handle )

Referenced by __drv_maxIRQL(), _Function_class_(), _IRQL_requires_max_(), _Success_(), acpi_create_registry_table(), acpi_create_volatile_registry_tables(), ACPIDispatchDeviceControl(), AcpiOsExecute(), AdvancedErrorChecks(), AfdCloseSocket(), allow_degraded_mount(), ApphelpCacheRead(), ApphelpCacheWrite(), BasicBehaviorChecks(), BehaviorChecks(), BroadcastOpen(), BuildWindowStationNameList(), CheckForDeviceDesc(), ClasspIsMediaChangeDisabledDueToHardwareLimitation(), ClasspIsMediaChangeDisabledForClass(), ClasspMediaChangeDeviceInstanceOverride(), ClassPnp(), ClasspScanForSpecialInRegistry(), Close(), CloseKey(), ClosePin(), CloseRemoteDatabase(), CmBattAddDevice(), CmBattCreateFdo(), CmLoadKey(), CmpCloseHiveFiles(), CmpCreateEvent(), CmpInitHiveFromFile(), CmpInitializeHiveList(), CmpInitializeMachineDependentConfiguration(), CmpLinkHiveToMaster(), CmpLinkKeyToHive(), CmpOpenHiveFiles(), CompBattGetDeviceObjectPointer(), CreateClientPort(), CreateDeviceFromRegistry(), CreateDiskDeviceObject(), CreateGreenFdo(), CreateMixerPinAndSetFormat(), CreatePinCallback(), CreateRemoteDatabaseWorker(), FxSystemThread::CreateThread(), DiskAddDevice(), DiskCreateFdo(), DiskRemoveDevice(), DriverEntry(), EngLoadModuleEx(), EnumDeviceKeys(), EnumerateBusKey(), EnumerateDevices(), EnumerateSoundDevices(), EnumerateSubkey(), ExCreateCallback(), ExpGetCurrentUserUILanguage(), ExpSetCurrentUserUILanguage(), ExpUuidLoadSequenceNumber(), ExpUuidSaveSequenceNumber(), Ext2StartReaper(), ExtractFont(), FatGetCompatibilityModeValue(), FatIsFujitsuFMR(), FdoCreateRawParallelPdo(), FdoRemoveAdapter(), FileSectionViewPermissionCheck(), FindDeviceDescForAdapter(), FindProductName(), FindScsiAdapter(), FinishThread(), FreeGlobalData(), fs_ignored(), FsRecRegisterFs(), FsRtlDeregisterUncProvider(), FsRtlGetTunnelParameterValue(), FsRtlInitializeWorkerThread(), FsRtlpIsDfsEnabled(), FsRtlRegisterUncProvider(), FsRtlTest_StartTest(), get_registry_value(), GetFilterAltitude(), GetObjectType(), GetProcessorInformation(), HalpDmaAllocateChildAdapter(), HalpGetChipHacks(), HalpGetNMICrashFlag(), HalpMarkAcpiHal(), HalpMarkChipsetDecode(), HalpQueryPciRegistryInfo(), HalpReportSerialNumber(), i8042StoreSMBiosTables(), InitDisplayDriver(), InitializeProvider(), InitMetrics(), InitUserImpl(), InitVideo(), IntGdiAddFontResourceEx(), IntGetFullFileName(), IntLoadFontsInRegistry(), IntLoadFontSubstList(), IntLoadSystemFonts(), IntVideoPortMapPhysicalMemory(), IoCreateDriver(), IoCreateSymbolicLink(), IoCreateUnprotectedSymbolicLink(), IoDeleteSymbolicLink(), IoGetDeviceInterfaces(), IoOpenDeviceInterfaceRegistryKey(), IoOpenDeviceRegistryKey(), IopBootLog(), IopCreateDeviceKeyPath(), IopCreateEvent(), IopCreateFile(), IopCreateLogFile(), IopCreateRegistryKeyEx(), IopEnumerateDetectedDevices(), IopGetDeviceObjectPointer(), IopGetParentIdPrefix(), IopInitializeBuiltinDriver(), IopInitializeDriverModule(), IopInitializePlugPlayServices(), IopInstallCriticalDevice(), IopIsFirmwareMapperDisabled(), IopLoadUnloadDriverWorker(), IopLogWorker(), IopOpenInterfaceKey(), IopQueryBusDescription(), IopQueryDeviceCapabilities(), IopQueryDeviceDescription(), IopSaveBootLogToFile(), IopSetDeviceInstanceData(), IopSetServiceEnumData(), IopStartRamdisk(), IopUpdateControlKeyWithResources(), IopUpdateResourceMap(), IopUpdateRootKey(), IopWriteLogFile(), IoQueryDeviceDescription(), IoRegisterDeviceInterface(), IoReportDetectedDevice(), IoReportHalResourceUsage(), IoSetDeviceInterfaceState(), IoSetSystemPartition(), KdbpCliInit(), KdbpSymLoadModuleSymbols(), KeI386VdmInitialize(), KsCacheMedium(), KsFilterFactoryUpdateCacheData(), KsMapModuleName(), KspEnumerateBusRegistryKeys(), KspInstallInterface(), KspReadMediaCategory(), KspScanBus(), KsRegisterFilterWithNoKSPins(), LogMessage(), LsaDeregisterLogonProcess(), LsaRegisterLogonProcess(), main(), MiCreateMemoryEvent(), MiShutdownSystem(), MmCheckSystemImage(), MmInitBsmThread(), MmLoadSystemImage(), MountMgrMountedDeviceArrival(), MountMgrQuerySymbolicLink(), MountMgrValidateBackPointer(), MupCloseUncProvider(), MupGetProviderInformation(), MuppIsDfsEnabled(), Mx::MxClose(), ndisBindMiniportsToProtocol(), NdisCloseConfiguration(), NdisCloseFile(), NdisIPnPStartDevice(), NdisOpenConfiguration(), NdisOpenConfigurationKeyByIndex(), NdisOpenConfigurationKeyByName(), NdisOpenProtocolConfiguration(), nfs41_CreateConnection(), nfs41_DeleteConnection(), NtCreatePagingFile(), ObtClose(), ObtCreateObjectTypes(), OnlineMountedVolumes(), OpenDevice(), OpenRegistryHandlesFromSymbolicLink(), OpenSubkey(), PageFileBehaviorChecks(), PciAcpiFindRsdt(), PciAddDevice(), PciGetBiosConfig(), PciGetIrqRoutingTableFromRegistry(), PciGetRegistryValue(), PciSaveBiosConfig(), PcNewRegistryKey(), Phase1InitializationDiscard(), PiAttachFilterDriversCallback(), PiCallDriverAddDevice(), PICE_close(), PiGetDeviceRegistryProperty(), PiInitCacheGroupInformation(), PiInitializeDevNode(), Pin_fnClose(), PiStartDeviceFinal(), PnpDeviceObjectToDeviceInstance(), PopAddRemoveSysCapsCallback(), PopFlushVolumes(), PopFlushVolumeWorker(), PopReadShutdownPolicy(), ProcessorSetFriendlyName(), PsLocateSystemDll(), QueryVolumeName(), read_group_mappings(), read_mappings(), read_registry(), ReadIpConfiguration(), ReconcileThisDatabaseWithMasterWorker(), registry_load_volume_options(), registry_mark_volume_mounted(), registry_mark_volume_unmounted_path(), RegistryInitAdapterKey(), RegistryInitLunKey(), RtlAcquirePrivilege(), RtlAdjustPrivilege(), RtlCheckRegistryKey(), RtlCreateBootStatusDataFile(), RtlCreateSystemVolumeInformationFolder(), RtlCreateUserProcess(), RtlFormatCurrentUserKeyPath(), RtlGetNtProductType(), RtlImpersonateSelf(), RtlpCloseRegistryHandle(), RtlpMapFile(), RtlpSysVolTakeOwnership(), RtlQueryRegistryValues(), RtlReleasePrivilege(), RtlUnlockBootStatusData(), RxGetRegistryParameters(), RxInitializeDispatcher(), RxReadRegistryParameters(), RxSpinUpWorkerThread(), ScsiPortInitialize(), SearchForLegacyDrivers(), SeGetLogonIdDeviceMap(), SepCleanupLUIDDeviceMapDirectory(), SepInitializationPhase1(), SepRegQueryHelper(), SerenumDetectLegacyDevice(), SerenumDetectPnpDevice(), SerialPnpStartDevice(), SermouseDetectLegacyDevice(), SharedMemoryFree(), SimpleErrorChecks(), SpiCreatePortConfig(), SpiInitOpenKeys(), START_TEST(), sys_shutdown(), SysAudio_Shutdown(), SystemProcessTest(), SystemProcessWorker(), TdiCloseDevice(), TdiOpenDevice(), TestCreateEvent(), TestEventConcurrent(), TestPhysicalMemorySection(), TestSymlinks(), TestTcpConnect(), UDFDismountDevice(), uninit(), UpdateGeometry(), USBAudioInitComponentId(), USBAudioRegCreateMediaCategoriesKey(), USBD_GetPdoRegistryParameter(), USBH_SetPdoRegistryParameter(), USBH_WriteFailReasonID(), USBPORT_GetRegistryKeyValueFullInfo(), USBPORT_SetRegistryKeyValue(), UserChangeDisplaySettings(), UserEnumDisplayDevices(), UserEnumRegistryDisplaySettings(), UserGetLanguageID(), UserLoadImage(), UserLoadKbdFile(), UserProcessDestroy(), VdmpInitialize(), VfatSetRenameInformation(), VfdCloseImage(), VfdCreateDevice(), VfdDeleteDevice(), VfdOpenImage(), ViCreateDriveLetter(), ViMountImage(), WdfDeleteKmdfVersionFromRegistry(), WdfWriteKmdfVersionToRegistry(), WdmAudCleanup(), WdmAudIoctlClose(), WdmAudOpenSysAudioDevices(), WorkerThread(), xHalIoAssignDriveLetters(), and CRegistryKey::~CRegistryKey().

◆ ZwCloseObjectAuditAlarm()

NTSYSAPI NTSTATUS NTAPI ZwCloseObjectAuditAlarm	(	_In_ PUNICODE_STRING	SubsystemName,
		_In_ PVOID	HandleId,
		_In_ BOOLEAN	GenerateOnClose
	)

◆ ZwCreateDirectoryObject()

NTSYSAPI NTSTATUS NTAPI ZwCreateDirectoryObject	(	_Out_ PHANDLE	DirectoryHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

Referenced by CreateDiskDeviceObject(), DiskCreateFdo(), ObtCreateDirectory(), SeGetLogonIdDeviceMap(), SepInitializationPhase1(), START_TEST(), and UserCreateWinstaDirectory().

◆ ZwCreateSymbolicLinkObject()

NTSYSAPI NTSTATUS NTAPI ZwCreateSymbolicLinkObject	(	_Out_ PHANDLE	SymbolicLinkHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes,
		_In_ PUNICODE_STRING	Name
	)

Referenced by IoCreateSymbolicLink(), IoCreateUnprotectedSymbolicLink(), SeGetLogonIdDeviceMap(), and START_TEST().

◆ ZwDeleteObjectAuditAlarm()

NTSYSAPI NTSTATUS NTAPI ZwDeleteObjectAuditAlarm	(	_In_ PUNICODE_STRING	SubsystemName,
		_In_ PVOID	HandleId,
		_In_ BOOLEAN	GenerateOnClose
	)

◆ ZwMakePermanentObject()

NTSYSAPI NTSTATUS NTAPI ZwMakePermanentObject ( _In_ HANDLE Object )

◆ ZwMakeTemporaryObject()

NTSYSAPI NTSTATUS NTAPI ZwMakeTemporaryObject ( _In_ HANDLE Handle )

Referenced by CreateDiskDeviceObject(), DiskCreateFdo(), DiskRemoveDevice(), IoDeleteSymbolicLink(), ObtClose(), SepCleanupLUIDDeviceMapDirectory(), and TestReference().

◆ ZwOpenDirectoryObject()

NTSYSAPI NTSTATUS NTAPI ZwOpenDirectoryObject	(	_Out_ PHANDLE	FileHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

Referenced by BuildWindowStationNameList(), CheckDirectorySecurity__(), LdrpInitializeProcess(), SepCleanupLUIDDeviceMapDirectory(), and TestObRootSecurity().

◆ ZwOpenJobObject()

NTSYSAPI NTSTATUS NTAPI ZwOpenJobObject	(	_Out_ PHANDLE	JobHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

◆ ZwOpenSymbolicLinkObject()

NTSYSAPI NTSTATUS NTAPI ZwOpenSymbolicLinkObject	(	_Out_ PHANDLE	SymbolicLinkHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

Referenced by ExtractFont(), get_system_root(), IoDeleteSymbolicLink(), IopStoreSystemPartitionInformation(), MountMgrMountedDeviceArrival(), MountMgrQuerySymbolicLink(), NotificationCallback(), SepCleanupLUIDDeviceMapDirectory(), START_TEST(), TestRelativeNames(), and ViCreateDriveLetter().

◆ ZwSetInformationObject()

NTSYSAPI NTSTATUS NTAPI ZwSetInformationObject	(	_In_ HANDLE	ObjectHandle,
		_In_ OBJECT_INFORMATION_CLASS	ObjectInformationClass,
		_In_ PVOID	ObjectInformation,
		_In_ ULONG	Length
	)

◆ ZwSignalAndWaitForSingleObject()

NTSYSAPI NTSTATUS NTAPI ZwSignalAndWaitForSingleObject	(	_In_ HANDLE	SignalObject,
		_In_ HANDLE	WaitObject,
		_In_ BOOLEAN	Alertable,
		_In_opt_ PLARGE_INTEGER	Time
	)

◆ ZwWaitForMultipleObjects()

NTSYSAPI NTSTATUS NTAPI ZwWaitForMultipleObjects	(	_In_ ULONG	Count,
		_In_ HANDLE	Object[],
		_In_ WAIT_TYPE	WaitType,
		_In_ BOOLEAN	Alertable,
		_In_ PLARGE_INTEGER	Time
	)