首页
社区
课程
招聘
[求助]Ring3层有办法根据设备句柄获取设备名称吗?
发表于: 2012-4-27 13:33 5623

[求助]Ring3层有办法根据设备句柄获取设备名称吗?

2012-4-27 13:33
5623
hFile := CreateFile('\\.\PhysicalDrive0',
                               GENERIC_ALL,
                               FILE_SHARE_READ or FILE_SHARE_WRITE, nil,
                               OPEN_EXISTING, 0, 0);
ZwQueryObject(
    hFile,
    ObjectNameInformation,
    @fsi,
    Sizeof(fsi),
    @rt  );

Object结构信息获取失败!求人品,求指点!

[注意]看雪招聘,专注安全领域的专业人才平台!

收藏
免费
支持
分享
最新回复 (2)
雪    币: 601
活跃值: (256)
能力值: ( LV11,RANK:190 )
在线值:
发帖
回帖
粉丝
2
POBJECT_NAME_INFORMATION oni = NULL;

oni= (POBJECT_NAME_INFORMATION)malloc(256*sizeof(WCHAR));
          status = ZwQueryObject(hFile,
                     ObjectNameInformation,
                     oni,
                     256*sizeof(WCHAR),
                     &rt);

        WCHAR obj_name[256] = {0};
        RtlCopyMemory(obj_name,oni->Name.Buffer,oni->Name.Length);
        printf("%S\n",obj_name);

------------------------------------
\Device\Harddisk0\DR0
2012-4-27 14:47
0
雪    币: 193
活跃值: (26)
能力值: ( LV9,RANK:210 )
在线值:
发帖
回帖
粉丝
3
呵呵,谢谢指教了,内存分配错误导致执行失败!现在修正了,感谢哦!
type
  PUNICODE_STRING = ^UNICODE_STRING;
  _UNICODE_STRING = record
    Length: Word;
    MaximumLength: Word;
    Buffer: PWideChar;
  end;
  UNICODE_STRING = _UNICODE_STRING;
  PCUNICODE_STRING = ^UNICODE_STRING;
  TUnicodeString = UNICODE_STRING;
  PUnicodeString = PUNICODE_STRING;

type
  _OBJECT_NAME_INFORMATION = record
    Name: UNICODE_STRING;
  end;
  OBJECT_NAME_INFORMATION = _OBJECT_NAME_INFORMATION;
  POBJECT_NAME_INFORMATION = ^OBJECT_NAME_INFORMATION;
  TObjectNameInformation = OBJECT_NAME_INFORMATION;
  PObjectNameInformation = ^OBJECT_NAME_INFORMATION;

type
  _OBJECT_INFORMATION_CLASS = (
    ObjectBasicInformation,
    ObjectNameInformation,
    ObjectTypeInformation,
    ObjectAllTypesInformation,
    ObjectHandleInformation);
  OBJECT_INFORMATION_CLASS = _OBJECT_INFORMATION_CLASS;
  TObjectInformationClass = OBJECT_INFORMATION_CLASS;

function  ZwQueryObject(ObjectHandle: THANDLE; ObjectInformationClass: OBJECT_INFORMATION_CLASS; ObjectInformation: Pointer; ObjectInformationLength: ULONG; ReturnLength: PULONG): DWORD; stdcall; external 'ntdll.dll';

function GetNameByHandle(hFile: THANDLE):string;
var
  st,rt:dword;
  fsi:POBJECT_NAME_INFORMATION;
begin
  result := '';
  fsi:=GetMemory(256*2);
  st:=ZwQueryObject(
    hFile,
    ObjectNameInformation,
    fsi,
    256*2,
    @rt
  );
  if st=0 then Result:=fsi.Name.Buffer;
  FreeMemory(fsi);
end;
2012-4-27 16:25
0
游客
登录 | 注册 方可回帖
返回

账号登录
验证码登录

忘记密码?
没有账号?立即免费注册