不知道怎么搞得，今天调试了一天，最后发现ObReferenceObjectByName无法获得到某些设备对象。但是驱动对象一般都能得到。
就算是IoGetDeviceObjectPointer也不能得到某些驱动的设备对象
比如用上面两个函数分别去尝试获取文件系统创建的卷设备（"\\Device\\HarddiskVolume1"），都会失败。
但是如果去获取文件系统的控制设备（"\\Device\\FtContol"）又都能成功。
其次，用ObReferenceObjectByName 去获取\\Device\\Tcp"也会失败，但是IoGetDeviceObjectPointer却能成功。
这是怎么回事呢，相关代码如下：
IO_STATUS_BLOCK ioStatus;
HANDLE ntFileHandle;
OBJECT_ATTRIBUTES objectAttributes;
PDEVICE_OBJECT fileSysDevice;
PDEVICE_OBJECT hookDevice;
PDRIVER_OBJECT pDriverObject;
ULONG fileFsAttributesSize;
NTSTATUS ntStatus;
ULONG i;
PFILE_OBJECT fileObject;
ULONG Drive=2;
UNICODE_STRING deviceName_string;
WCHAR deviceName_bufer[]=L"\\Device\\Tcp";
PFILE_OBJECT FileObject;
DbgPrint("DriverEntry\r\n");
driver->DriverUnload = DriverUnload;
RtlInitUnicodeString( &deviceName_string,deviceName_bufer);
InitializeObjectAttributes( &objectAttributes, &fileNameUnicodeString,
OBJ_CASE_INSENSITIVE, NULL, NULL );
ntStatus = ObReferenceObjectByName (
&deviceName_string,
OBJ_CASE_INSENSITIVE,
NULL,
0,
IoDeviceObjectType,
KernelMode,
NULL,
&pDriverObject
);
//ntStatus=IoGetDeviceObjectPointer(&deviceName_string,FILE_ALL_ACCESS,
//&FileObject,&fileSysDevice);
if(NT_SUCCESS(ntStatus))
{
//fileSysDevice=pDriverObject->DeviceObject;
DbgPrint("RefObject :0x%.8x\r\n",fileSysDevice);
//ObDereferenceObject(FileObject);
while(fileSysDevice)
{
DbgPrint("DeviceObject :0x%.8x ",fileSysDevice);
__try{
if (fileSysDevice->DriverObject) DbgPrint("Name :%wZ \r\n",&fileSysDevice->DriverObject->DriverName);
}
__except(1)
{
DbgPrint("DriverName Error\r\n");
}
fileSysDevice=fileSysDevice->AttachedDevice;
}
}
else
{
DbgPrint("IoGetDeviceObjectPointer Error\r\n");
return STATUS_UNSUCCESSFUL;
}
return STATUS_SUCCESS;
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
