能力值：
( LV11，RANK：190 )
|
-
-
2 楼
ObQueryNameString查不到么
|
能力值：
( LV2，RANK：10 )
|
-
-
3 楼
何为总是问完问题才想到出呢
为何总是自己想出才有回答呢
NtQueryObject （ObjectNameInformation）;
解决了还是谢谢LS
|
能力值：
( LV2，RANK：10 )
|
-
-
4 楼
楼主用的是什么工具啊 
|
能力值：
( LV5，RANK：60 )
|
-
-
5 楼
贴上一段，仅在XP Professional SP2上测试通过。
typedef struct _OBJECT_DIRECTORY_INFORMATION {
UNICODE_STRING Name;
UNICODE_STRING TypeName;
} OBJECT_DIRECTORY_INFORMATION, *POBJECT_DIRECTORY_INFORMATION;
typedef NTSTATUS (*ZwQueryDirectoryObject)(HANDLE DirectoryHandle, PVOID Buffer, ULONG Length, BOOLEAN ReturnSingleEntry, BOOLEAN RestartScan, PULONG Context, PULONG ReturnLength);
VOID PrintBaseNamedObjects()
{
// 获取ZwQueryDirectoryObject函数地址
UNICODE_STRING ustrQueryFunc;
RtlInitUnicodeString(&ustrQueryFunc, L"ZwQueryDirectoryObject");
ZwQueryDirectoryObject pfnQuery = (ZwQueryDirectoryObject)MmGetSystemRoutineAddress(&ustrQueryFunc);
if(pfnQuery != NULL)
{
// 打开"\BaseNameObjects"对象目录
UNICODE_STRING ustrBaseNamedObjects;
RtlInitUnicodeString(&ustrBaseNamedObjects, L"\\BaseNamedObjects");
OBJECT_ATTRIBUTES oa;
InitializeObjectAttributes(&oa, &ustrBaseNamedObjects, OBJ_CASE_INSENSITIVE, NULL, NULL);
HANDLE hDirectory;
NTSTATUS status = ZwOpenDirectoryObject(&hDirectory, DIRECTORY_QUERY, &oa);
if(NT_SUCCESS(status))
{
POBJECT_DIRECTORY_INFORMATION pBuffer = NULL;
ULONG ulLength = 0x400;
ULONG ulContext = 0; // Search的上下文
// 循环获取"\BaseNameObjects"对象目录下信息
do
{
if(pBuffer != NULL)
{
ExFreePool(pBuffer);
pBuffer = NULL;
ulLength *= 2; // 成倍增加
}
pBuffer = (POBJECT_DIRECTORY_INFORMATION)ExAllocatePool(NonPagedPool, ulLength);
if(pBuffer != NULL)
{
status = pfnQuery(hDirectory, pBuffer, ulLength, FALSE, TRUE, &ulContext, NULL);
}
else
{
status = STATUS_BUFFER_TOO_SMALL;
}
} while (STATUS_MORE_ENTRIES == status || STATUS_BUFFER_TOO_SMALL == status);
if(NT_SUCCESS(status))
{
POBJECT_DIRECTORY_INFORMATION pInfo = pBuffer;
// 循环处理每个OBJECT_DIRECTORY_INFORMATION
while(pInfo != NULL && pInfo->Name.Length != 0 && pInfo->TypeName.Length != 0)
{
KdPrint(("Name: %ws, TypeName: %ws.\n", pInfo->Name.Buffer, pInfo->TypeName.Buffer));
++pInfo;
}
}
if(pBuffer != NULL)
{
ExFreePool(pBuffer);
pBuffer = NULL;
}
ZwClose(hDirectory);
}
else
{
KdPrint(("ZwOpenDirectoryObject Failed!\n"));
}
}
else
{
KdPrint(("MmGetSystemRoutineAddress Failed!\n"));
}
}
|
|
|
|
