1.原因，不多说。

好了，现在类型对象搞定了，接下来就是搞定名字了。

首先来确定存储对象名字的结构有没有发生改变，

发现结构是一样的，只是微软修改了一下第三个类型的名字，而类型并没有得到修改。

然后我们验证一下：

发现XP的方法直接找偏移量寻找到地址的方法行不通了，怎么办呢？那看看大佬 achillis 的思路，发现原来InfoMask 里面的东西才是特别重要的，这里面可以找到我们XP中3大结构的偏移量，那么对于WIN 7 32 位它是怎么去计算的呢？哈哈，WIN7 32 位真是个调皮聪明的娃，又来一个表，这表是什么玩意呢？

说的就是有对象头下的可变对象结构有5个，可有可无，一共会有2的5次方也就是32种情况，而这32种情况就是要InfoMask来锁定的，类似于位运算吧。

先定义一套来分析：

结构1：_OBJECT_HEADER_PROCESS_INFO        sizeof:0x08

结构2：_OBJECT_HEADER_QUOTA_INFO             sizeof:0x10

结构3：_OBJECT_HEADER_HANDLE_INFO           sizeof:0x08
结构4：_OBJECT_HEADER_NAME_INFO               sizeof:0x10
结构5：_OBJECT_HEADER_CREATOR_INFO        sizeof:0x10

分别为他们定义一个掩码来确定有没有此结构：

    #define OB_INFOMASK_PROCESS_INFO     0x10
    #define OB_INFOMASK_QUOTA                     0x08
    #define OB_INFOMASK_HANDLE                   0x04
    #define OB_INFOMASK_NAME                       0x02
    #define OB_INFOMASK_CREATOR_INFO      0x01 

按大佬的思路，我们怎么去验证呢？我的思路是这样的，看到上面\device\video0设备对象的infoMask = 0x2 这说明这个设备对象只存在这一个 OB_INFOMASK_NAME结构体，然后再加上对象头结构和对象体结构，如果按照累计结构定义，那对象头结构的前一段有效的可变对象头结构内存大小应该是根据掩码而定的，对于infoMask = 0x2来说，可以得到对象名结构体的地址必然是对象头地址减去它的大小，即0x884cec32-0x10得到的就是此结构首地址。

看到这一结果，真的是这样，那么，这样就得到了一种获取到对象信息的思路了。什么思路呢？首先要获取到的是对象的地址，然后接着就是从对象的地址中分析出来对象的头结构，然后从对象头结构中分析出来对象的类型，以及可变对象头结构掩码，以此确定此对象拥有什么结构，然后算有效的内存偏移，最后将结构中的有用信息分析出来。这样清晰的思路很有效，从大佬 achillis的文章中，我参照Win7 32 位获取对象信息名的API， NTKERNELAPI   PVOID NTAPI  ObQueryNameInfo(IN PVOID Object) ，我们来反汇编一下看看是这么实现根据对象取出它的名字的呢？

kd> uf ObQueryNameInfo

nt!ObQueryNameInfo:

842c9a73 8bff            mov     edi,edi

842c9a75 55              push    ebp

842c9a76 8bec            mov     ebp,esp

842c9a78 8b4508          mov     eax,dword ptr [ebp+8]； 把参数object的地址赋给eax

842c9a7b 8a48f6          mov     cl,byte ptr [eax-0Ah]；似曾相识呢，把对象地址减去0x18得到地址头对象，然后算偏移加0x00e得到地址掩码

842c9a7e 83c0e8          add     eax,0FFFFFFE8h；地址加操作，地址+ （0FFFFFF[1110 1000] 注意补码 （取反之后加1）算就是 0x18）， 

842c9a81 f6c102          test    cl,2；test 指令，判断cl寄存器中的地址掩码值得第二位有没有值，也就是说有无对象名称确认，有跳入查询

842c9a84 7411            je      nt!ObQueryNameInfo+0x24 (842c9a97)；调用下一个函数

nt!ObQueryNameInfo+0x13:

842c9a86 0fb6c9          movzx   ecx,cl；将掩码值带符号传送

842c9a89 83e103          and     ecx,3；按位与操作，和3进行与操作，则ecx专门用来判断结构4和结构5数据

842c9a8c 0fb68980141984  movzx   ecx,byte ptr nt!ObpInfoMaskToOffset (84191480)[ecx]；根据掩码算地址偏移量，0x10 或者0x20

842c9a93 2bc1            sub     eax,ecx;对象头地址减去我们得地址偏移

842c9a95 eb02            jmp     nt!ObQueryNameInfo+0x26 (842c9a99);跳转返回指令

nt!ObQueryNameInfo+0x24:；

842c9a97 33c0            xor     eax,eax；异或指令

nt!ObQueryNameInfo+0x26:

842c9a99 5d              pop     ebp

842c9a9a c20400          ret     4

看完这段汇编代码，满满的感动，没错啊，这就是我们WIN7 32 位下要获取对象的名字的方法呀。您可以不需要实现具体算法，只要调用此函数就可以在Win7 32位系统下获取到对象的名字。至于实现，那就把他们换成我们自己的玩法啦，自己玩一下哈。大佬 achillis 的文章中也已经给出了源代码，很高兴能和大佬的思路一般。请原谅小生的班门弄斧，仅为共享的大白兔敬上。代码实现如下：//WIN7_32位的机器上获取对象的名字

void GetObjectNameInWin7_32(PVOID object)

{

//传入对象,按汇编思路,先得到头结构

POBJECT_HEADER_WIN7_32 pObjectHeader;

POBJECT_HEADER_NAME_INFO_WIN7_32 pObejctHeaderNameInfo;

UCHAR InfoMask;

KdPrint(("GetObjectNameInWin7_32() Enter.\n"));

pObjectHeader = OBJECT_TO_OBJECT_HEADER_WIN7_32(object);

KdPrint(("此对象[0x%08x] 的头对象为 [0x%08x].\n", object, pObjectHeader));

//得到掩码的值

InfoMask = pObjectHeader->InfoMask;

KdPrint(("此对象[0x%08x] 的掩码为 [0x%02x]. ObpInfoMaskToOffset[InfoMask] = [0x%08x]\n", object, InfoMask, ObpInfoMaskToOffset[InfoMask]));

//根据掩码值算出我们的名字结构体地址偏移量,同时还要得到最后的名字结构体地址,这里的实现参考大佬的方法

pObejctHeaderNameInfo = (ULONG)pObjectHeader - ObpInfoMaskToOffset[InfoMask & 3];

KdPrint(("此对象[0x%08x] 的名称结构体为 : [0x%08x].\n", object, pObejctHeaderNameInfo));

//最后打印结果

KdPrint(("此对象[0x%08x] 的名称为 : [%wZ].\n", object, &(pObejctHeaderNameInfo->Name)));

}

特别说明，此处 pObejctHeaderNameInfo = (ULONG)pObjectHeader - ObpInfoMaskToOffset[InfoMask & 3];代码中有一个小细节，您要实现代码的时候要对对象的头指针进行一个简单的类型转换，不然做减法运算的时候会出现错误，至于原因，内核级代码就这样，对于指针这样的类型没有办法去实现隐士转换，导致出现计算错误，这个小细节可能会让您的代码更为正确，计算结果如下，正确。

kd> uf ObQueryNameInfo

nt!ObQueryNameInfo:

842c9a73 8bff            mov     edi,edi

842c9a75 55              push    ebp

842c9a76 8bec            mov     ebp,esp

842c9a78 8b4508          mov     eax,dword ptr [ebp+8]； 把参数object的地址赋给eax

842c9a7b 8a48f6          mov     cl,byte ptr [eax-0Ah]；似曾相识呢，把对象地址减去0x18得到地址头对象，然后算偏移加0x00e得到地址掩码

842c9a7e 83c0e8          add     eax,0FFFFFFE8h；地址加操作，地址+ （0FFFFFF[1110 1000] 注意补码 （取反之后加1）算就是 0x18）， 

842c9a81 f6c102          test    cl,2；test 指令，判断cl寄存器中的地址掩码值得第二位有没有值，也就是说有无对象名称确认，有跳入查询

842c9a84 7411            je      nt!ObQueryNameInfo+0x24 (842c9a97)；调用下一个函数

nt!ObQueryNameInfo+0x13:

842c9a86 0fb6c9          movzx   ecx,cl；将掩码值带符号传送

842c9a89 83e103          and     ecx,3；按位与操作，和3进行与操作，则ecx专门用来判断结构4和结构5数据

842c9a8c 0fb68980141984  movzx   ecx,byte ptr nt!ObpInfoMaskToOffset (84191480)[ecx]；根据掩码算地址偏移量，0x10 或者0x20

842c9a93 2bc1            sub     eax,ecx;对象头地址减去我们得地址偏移

842c9a95 eb02            jmp     nt!ObQueryNameInfo+0x26 (842c9a99);跳转返回指令

nt!ObQueryNameInfo+0x24:；

842c9a97 33c0            xor     eax,eax；异或指令

nt!ObQueryNameInfo+0x26:

842c9a99 5d              pop     ebp

842c9a9a c20400          ret     4

很高兴，能继续探究Win7 32位下对目录对象的遍历方法，到此为止，我们对于对象的操作基本明确，获取到对象的类型，对象的名称，两大重要版块信息也给出了实现方案，那就简单了，至于要实现目录对象的遍历，思路在上篇就说明清楚了，这里就不多细讲了。找到根目录作为起点，遍历出子节点对象的信息，对象地址，对象名，对象类型，如果是目录对象，继续遍历下一个子节点，知道完成遍历过程。

参考Win7 32位版本的目录对象结构体的修改，我定义如下：

typedef struct _OBJECT_DIRECTORY_WIN7_32 *POBJECT_DIRECTORY_WIN7_32;

typedef struct _OBJECT_DIRECTORY_ENTRY_WIN7_32 *POBJECT_DIRECTORY_ENTRY_WIN7_32;

typedef struct _DEVICE_MAP_WIN7_32

{

    POBJECT_DIRECTORY_WIN7_32 DosDevicesDirectory;

    POBJECT_DIRECTORY_WIN7_32 GlobalDosDevicesDirectory;

    PVOID DosDevicesDirectoryHandle;

    ULONG  ReferenceCount;

    ULONG  DriveMap;

    UCHAR DriveType[32];

 } DEVICE_MAP_WIN7_32, *PDEVICE_MAP_WIN7_32;

typedef struct _OBJECT_DIRECTORY_ENTRY_WIN7_32

{

   POBJECT_DIRECTORY_ENTRY_WIN7_32 ChainLink;

   PVOID Object; 

   ULONG HashValue;

} OBJECT_DIRECTORY_ENTRY_WIN7_32, *POBJECT_DIRECTORY_ENTRY_WIN7_32;

typedef struct _OBJECT_DIRECTORY_WIN7_32

{

    POBJECT_DIRECTORY_ENTRY_WIN7_32 HashBuckets[NUMBER_HASH_BUCKETS];

    EX_PUSH_LOCK Lock;

    PDEVICE_MAP_WIN7_32 DeviceMap;

    ULONG   SessionId;

    PVOID   NamespaceEntry;

    PVOID  SessionObject;

    ULONG  Flags;

} OBJECT_DIRECTORY_WIN7_32, *POBJECT_DIRECTORY_WIN7_32;

下面是我的融合源码（里面有XP及win7 32位下的实现），您可以拷贝到一个.c文件中进行编译，如果存在问题，请告知，编译版本和操作系统版本，如果我有时间会为您修复。

///////////////////////////////////////////////////

//作者：wo最爱吃大白兔

//时间：2018/3/30

////////////////////////////////////////////////////

#include <ntifs.h>

#define NUMBER_HASH_BUCKETS 37

//////////////////////////////////////////////////////////////////////////XP 32 位 版本//////////////////////////////////////////////////////////////////////////

typedef struct _OBJECT_DIRECTORY_XP *POBJECT_DIRECTORY_XP;

typedef struct _OBJECT_DIRECTORY_ENTRY_XP *POBJECT_DIRECTORY_ENTRY_XP;

typedef struct _OBJECT_TYPE_XP  *POBJECT_TYPE_XP;

typedef struct _DEVICE_MAP_XP

{

    POBJECT_DIRECTORY_XP DosDevicesDirectory;

    POBJECT_DIRECTORY_XP GlobalDosDevicesDirectory;

    ULONG  ReferenceCount;

    ULONG  DriveMap;

    UCHAR DriveType[32];

 } DEVICE_MAP_XP, * PDEVICE_MAP_XP;

typedef struct _OBJECT_DIRECTORY_ENTRY_XP

{

  POBJECT_DIRECTORY_ENTRY_XP ChainLink;

  PVOID Object;

} OBJECT_DIRECTORY_ENTRY_XP, *POBJECT_DIRECTORY_ENTRY_XP;

typedef struct _OBJECT_DIRECTORY_XP

{

    POBJECT_DIRECTORY_ENTRY_XP HashBuckets[NUMBER_HASH_BUCKETS];

    EX_PUSH_LOCK Lock;

    PDEVICE_MAP_XP DeviceMap;

    ULONG   SessionId;

    USHORT Reserved;

    USHORT SymbolicLinkUsageCount;

} OBJECT_DIRECTORY_XP, * POBJECT_DIRECTORY_XP;

typedef struct _OBJECT_CREATE_INFORMATION_XP 

{

   ULONG Attributes;

   PVOID RootDirectory;

   PVOID ParseContext;

   CHAR ProbeMode;

   ULONG PagedPoolCharge;

   ULONG NonPagedPoolCharge;

   ULONG SecurityDescriptorCharge;

   PVOID SecurityDescriptor;

   PSECURITY_QUALITY_OF_SERVICE SecurityQos;

   SECURITY_QUALITY_OF_SERVICE SecurityQualityOfService;

}OBJECT_CREATE_INFORMATION_XP,* POBJECT_CREATE_INFORMATION_XP;

typedef struct _OBJECT_HEADER_XP

{

    ULONG PointerCount;

    union

    {

        ULONG HandleCount;

        PVOID NextToFree;

    };

    POBJECT_TYPE_XP Type;

    UCHAR NameInfoOffset;

    UCHAR HandleInfoOffset;

    UCHAR QuotaInfoOffset;

    UCHAR Flags;

    union

    {

        POBJECT_CREATE_INFORMATION_XP ObjectCreateInfo;

        PVOID QuotaBlockCharged;

    };

    PVOID SecurityDescriptor;

    QUAD Body;

} OBJECT_HEADER_XP, * POBJECT_HEADER_XP;

typedef struct _OBJECT_HEADER_NAME_INFO_XP 

{

    POBJECT_DIRECTORY_XP Directory;

    UNICODE_STRING Name;

    ULONG QueryReferences;

} OBJECT_HEADER_NAME_INFO_XP, *POBJECT_HEADER_NAME_INFO_XP;

typedef struct _OBJECT_TYPE_INITIALIZER_XP 

{

   ERESOURCE Mutex            ; 

   LIST_ENTRY TypeList        ; 

   UNICODE_STRING Name         ;  

   PVOID DefaultObject ;

   ULONG Index ;

   ULONG TotalNumberOfObjects ;

   ULONG TotalNumberOfHandles ;

   ULONG HighWaterNumberOfObjects ;

   ULONG HighWaterNumberOfHandles ;

   struct _OBJECT_TYPE_INITIALIZER_XP *TypeInfo ;

   ULONG Key             ;

   ERESOURCE ObjectLocks[4];

   USHORT Length ;

   UCHAR UseDefaultObject ; 

   UCHAR CaseInsensitive ;

   ULONG InvalidAttributes ;

   GENERIC_MAPPING GenericMapping   ;

   ULONG ValidAccessMask ;

   UCHAR SecurityRequired ;

   UCHAR MaintainHandleCount ;

   UCHAR MaintainTypeList ;

   POOL_TYPE PoolType               ;

   ULONG DefaultPagedPoolCharge      ;

   ULONG DefaultNonPagedPoolCharge   ;

   PVOID DumpProcedure     ;

   PLONG OpenProcedure     ;

   PVOID CloseProcedure    ;

   PVOID DeleteProcedure   ; 

   PLONG ParseProcedure    ; 

   PLONG SecurityProcedure ;

   PLONG QueryNameProcedure     ;

   PUCHAR OkayToCloseProcedure  ;

} OBJECT_TYPE_INITIALIZER_XP, *POBJECT_TYPE_INITIALIZER_XP;

typedef struct _OBJECT_TYPE_XP 

{

   ERESOURCE Mutex            ; 

   LIST_ENTRY TypeList        ; 

   UNICODE_STRING Name        ;  

   PVOID DefaultObject ;

   ULONG Index ;

   ULONG TotalNumberOfObjects ;

   ULONG TotalNumberOfHandles ;

   ULONG HighWaterNumberOfObjects ;

   ULONG HighWaterNumberOfHandles ;

   OBJECT_TYPE_INITIALIZER_XP TypeInfo ;

   ULONG Key             ;

   ERESOURCE  ObjectLocks[4] ;

 } OBJECT_TYPE_XP, *POBJECT_TYPE_XP;

//获取到对象的结构体部分

#define OBJECT_TO_OBJECT_HEADER_XP( o ) \

    CONTAINING_RECORD( (o), OBJECT_HEADER_XP, Body )

//XP下根据对象的头获取到它的名字信息部分

#define OBJECT_HEADER_TO_NAME_INFO_XP( oh ) ((POBJECT_HEADER_NAME_INFO_XP) \

    ((oh)->NameInfoOffset == 0 ? NULL : ((PCHAR)(oh) - (oh)->NameInfoOffset)))

//////////////////////////////////////////////////////////////////////////WIN7 32 位 版本//////////////////////////////////////////////////////////////////////////

typedef struct _OBJECT_DIRECTORY_WIN7_32 *POBJECT_DIRECTORY_WIN7_32;

typedef struct _OBJECT_DIRECTORY_ENTRY_WIN7_32 *POBJECT_DIRECTORY_ENTRY_WIN7_32;

typedef struct _DEVICE_MAP_WIN7_32

{

    POBJECT_DIRECTORY_WIN7_32 DosDevicesDirectory;

    POBJECT_DIRECTORY_WIN7_32 GlobalDosDevicesDirectory;

    PVOID DosDevicesDirectoryHandle;

    ULONG  ReferenceCount;

    ULONG  DriveMap;

    UCHAR DriveType[32];

 } DEVICE_MAP_WIN7_32, *PDEVICE_MAP_WIN7_32;

typedef struct _OBJECT_DIRECTORY_ENTRY_WIN7_32

{

   POBJECT_DIRECTORY_ENTRY_WIN7_32 ChainLink;

   PVOID Object; 

   ULONG HashValue;

} OBJECT_DIRECTORY_ENTRY_WIN7_32, *POBJECT_DIRECTORY_ENTRY_WIN7_32;

typedef struct _OBJECT_DIRECTORY_WIN7_32

{

    POBJECT_DIRECTORY_ENTRY_WIN7_32 HashBuckets[NUMBER_HASH_BUCKETS];

    EX_PUSH_LOCK Lock;

    PDEVICE_MAP_WIN7_32 DeviceMap;

    ULONG   SessionId;

    PVOID   NamespaceEntry;

    PVOID  SessionObject;

    ULONG  Flags;

} OBJECT_DIRECTORY_WIN7_32, *POBJECT_DIRECTORY_WIN7_32;

typedef struct _OBJECT_CREATE_INFORMATION_WIN7_32 

{

   ULONG Attributes;

   PVOID RootDirectory;

   PVOID ParseContext;

   CHAR ProbeMode;

   ULONG PagedPoolCharge;

   ULONG NonPagedPoolCharge;

   ULONG SecurityDescriptorCharge;

   PVOID SecurityDescriptor;

   PSECURITY_QUALITY_OF_SERVICE SecurityQos;

   SECURITY_QUALITY_OF_SERVICE SecurityQualityOfService;

}OBJECT_CREATE_INFORMATION_WIN7_32,* POBJECT_CREATE_INFORMATION_WIN7_32;

typedef struct _OBJECT_HEADER_WIN7_32

{

    ULONG PointerCount;

    union

    {

        ULONG HandleCount;

        PVOID NextToFree;

    };

    EX_PUSH_LOCK Lock;

    UCHAR TypeIndex;

    UCHAR TraceFlags;

    UCHAR InfoMask;

    UCHAR Flags;

    union

    {

        POBJECT_CREATE_INFORMATION_WIN7_32 ObjectCreateInfo;

        PVOID QuotaBlockCharged;

    };

    PVOID SecurityDescriptor;

    QUAD Body;

} OBJECT_HEADER_WIN7_32, * POBJECT_HEADER_WIN7_32;

typedef struct _OBJECT_TYPE_FlAGS_WIN7_32

{  

    UCHAR CaseInsensitive : 1;  

    UCHAR UnnamedObjectsOnly : 1;  

    UCHAR UseDefaultObject : 1;  

    UCHAR SecurityRequired : 1;  

    UCHAR MaintainHandleCount : 1;  

    UCHAR MaintainTypeList : 1;  

    UCHAR SupportsObjectCallbacks : 1;  

    UCHAR CacheAligned : 1;  

}OBJECT_TYPE_FlAGS_WIN7_32, *POBJECT_TYPE_FlAGS_WIN7_32; 

typedef struct _OBJECT_TYPE_INITIALIZER_WIN7_32 

{

   USHORT Length       ;

   OBJECT_TYPE_FlAGS_WIN7_32 ObjectTypeFlags; 

   ULONG  ObjectTypeCode      ;

   ULONG  InvalidAttributes   ;

   GENERIC_MAPPING   GenericMapping;

   ULONG ValidAccessMask      ;

   ULONG RetainAccess       ;

   POOL_TYPE PoolType               ;

   ULONG DefaultPagedPoolCharge      ;

   ULONG DefaultNonPagedPoolCharge   ;

   PVOID DumpProcedure     ;

   PLONG OpenProcedure     ;

   PVOID CloseProcedure    ;

   PVOID DeleteProcedure   ; 

   PLONG ParseProcedure    ; 

   PLONG SecurityProcedure ;

   PLONG QueryNameProcedure     ;

   PUCHAR OkayToCloseProcedure  ;

} OBJECT_TYPE_INITIALIZER_WIN7_32, *POBJECT_TYPE_INITIALIZER_WIN7_32;

typedef struct _OBJECT_TYPE_WIN7_32 

{

   LIST_ENTRY TypeList        ; 

   UNICODE_STRING Name        ;  

   PVOID DefaultObject       ;

   ULONG Index         ;

   ULONG TotalNumberOfObjects ;

   ULONG TotalNumberOfHandles ;

   ULONG HighWaterNumberOfObjects ;

   ULONG HighWaterNumberOfHandles ;

   OBJECT_TYPE_INITIALIZER_WIN7_32 TypeInfo ;

   EX_PUSH_LOCK TypeLock;       

   ULONG Key             ;

   LIST_ENTRY CallbackList;

 } OBJECT_TYPE_WIN7_32, *POBJECT_TYPE_WIN7_32;

typedef struct _OBJECT_HEADER_NAME_INFO_WIN7_32

{

POBJECT_DIRECTORY_WIN7_32 Directory;

UNICODE_STRING Name;

ULONG ReferenceCount;

} OBJECT_HEADER_NAME_INFO_WIN7_32, *POBJECT_HEADER_NAME_INFO_WIN7_32;

typedef struct  _OBJECT_HEADER_CREATOR_INFO_WIN7_32

{

LIST_ENTRY TypeList;

PVOID CreatorUniqueProcess;

USHORT CreatorBackTraceIndex;

USHORT Reserved;

}OBJECT_HEADER_CREATOR_INFO_WIN7_32, *POBJECT_HEADER_CREATOR_INFO_WIN7_32;

//////////////////////////////////////////////////////////////////

typedef struct  _H_L_COUNT

{

ULONG HandleCount : 24;

ULONG LockCount : 8;

}H_L_COUNT, *P_H_L_COUNT;

typedef struct  _OBJECT_HANDLE_COUNT_ENTRY_WIN7_32

{

PEPROCESS Process;

H_L_COUNT Count;

}OBJECT_HANDLE_COUNT_ENTRY_WIN7_32, *POBJECT_HANDLE_COUNT_ENTRY_WIN7_32;

typedef struct  _OBJECT_HANDLE_COUNT_DATABASE_WIN7_32

{

ULONG CountEntries;

OBJECT_HANDLE_COUNT_ENTRY_WIN7_32 HandleCountEntries[1];

}OBJECT_HANDLE_COUNT_DATABASE_WIN7_32, *POBJECT_HANDLE_COUNT_DATABASE_WIN7_32;

typedef struct  _OBJECT_HEADER_HANDLE_INFO_WIN7_32

{

OBJECT_HANDLE_COUNT_DATABASE_WIN7_32 TypeList;

OBJECT_HANDLE_COUNT_ENTRY_WIN7_32 SingleEntry;

}OBJECT_HEADER_HANDLE_INFO_WIN7_32, *POBJECT_HEADER_HANDLE_INFO_WIN7_32;

//////////////////////////////////////////////////////////////////////

typedef struct _OBJECT_HEADER_QUOTA_INFO_WIN7_32

{

ULONG PagedPoolCharge;

ULONG NonPagedPoolCharge;

ULONG SecurityDescriptorCharge;

PVOID SecurityDescriptorQuotaBlock;

}OBJECT_HEADER_QUOTA_INFO_WIN7_32, *POBJECT_HEADER_QUOTA_INFO_WIN7_32;

typedef struct _OBJECT_HEADER_PROCESS_INFO_WIN7_32

{

PEPROCESS ExclusiveProcess;

ULONG Reserved;

}OBJECT_HEADER_PROCESS_INFO_WIN7_32, *POBJECT_HEADER_PROCESS_INFO_WIN7_32;

//获取到对象的结构体部分

#define OBJECT_TO_OBJECT_HEADER_WIN7_32( o ) \

    CONTAINING_RECORD( (o), OBJECT_HEADER_WIN7_32, Body )

//定义一套掩码用来做地址分析

#define OB_INFOMASK_PROCESS_INFO 0x10

#define OB_INFOMASK_QUOTA               0x08

#define OB_INFOMASK_HANDLE              0x04

#define OB_INFOMASK_NAME                0x02

#define OB_INFOMASK_CREATOR_INFO        0x01 

//还要做一份掩码查询表,定义一个掩码表

ULONG ObpInfoMaskToOffset[32] = { 0 };

 

void InitInfoMaskTable()

 {

ULONG i = 0;

ULONG offset = 0;

do

{

offset = 0;

if (i & OB_INFOMASK_CREATOR_INFO)

offset = sizeof(OBJECT_HEADER_CREATOR_INFO_WIN7_32);

if (i & OB_INFOMASK_NAME)

offset += sizeof(OBJECT_HEADER_NAME_INFO_WIN7_32);

if (i & OB_INFOMASK_HANDLE)

offset += sizeof(OBJECT_HEADER_HANDLE_INFO_WIN7_32);

if (i & OB_INFOMASK_QUOTA)

offset += sizeof(OBJECT_HEADER_QUOTA_INFO_WIN7_32);

if (i & OB_INFOMASK_PROCESS_INFO)

offset += sizeof(OBJECT_HEADER_PROCESS_INFO_WIN7_32);

ObpInfoMaskToOffset[i] = offset;//算出对应掩码值的最大偏移量

KdPrint(("ObpInfoMaskToOffset[%d] = [0x%08x] .\n", i, ObpInfoMaskToOffset[i]));

i++;

} while (i<32);

 }

//传入要遍历的目录

void EnumDirectoryInXp(POBJECT_DIRECTORY_XP pObejctDirectory)

{

  POBJECT_DIRECTORY_ENTRY_XP pObjectDirectoryEntry;

  POBJECT_HEADER_XP pObjectHeader;

  POBJECT_HEADER_NAME_INFO_XP pObjectHeaderNameInfo;

  int i;

    UNICODE_STRING ustrName;

  RtlInitUnicodeString(&ustrName,L"Directory");

  KdPrint(("------------------------------------正在遍历目录对象：[0x%08x]----------------------.\n",pObejctDirectory));

  for(i = 0; i < NUMBER_HASH_BUCKETS; i ++) 

  {

   pObjectDirectoryEntry = pObejctDirectory->HashBuckets[i];

   if (!MmIsAddressValid(pObjectDirectoryEntry))

   {

    //KdPrint(("-->此节点遍历目录连接对象POBJECT_DIRECTORY_ENTRY无效.\n"));

continue;

   }

   do

   {

  if (!MmIsAddressValid(pObjectDirectoryEntry->Object))

  {

//KdPrint(("-->此节点遍历到的对象pObjectDirectoryEntry->Object无效.\n"));

break;

    }

  pObjectHeader = OBJECT_TO_OBJECT_HEADER_XP(pObjectDirectoryEntry->Object);//根据对象来获取到对象

KdPrint(("[节点 = %02d] 此对象地址为：[0x%08x] , 对象类型为:[%wZ] ,",i,pObjectDirectoryEntry->Object,&(pObjectHeader->Type->Name)));

if (pObjectHeader->NameInfoOffset > 0)

{

   pObjectHeaderNameInfo = OBJECT_HEADER_TO_NAME_INFO_XP(pObjectHeader);//获取到对象名结构体

   KdPrint(("此对象名称为：[%wZ].\n",&(pObjectHeaderNameInfo->Name)));

   //RtlUnicodeStringCopy(&ustrName,&(pObjectName->Name));  

}

else

{

  KdPrint(("此对象没有名称.\n"));

  }

  //如果还是目录对象应该将其展开再次遍历

  if (RtlCompareUnicodeString(&(pObjectHeader->Type->Name),&ustrName,TRUE) == 0)

  {

EnumDirectoryInXp((POBJECT_DIRECTORY_XP)pObjectDirectoryEntry->Object);

  }   

  pObjectDirectoryEntry = pObjectDirectoryEntry->ChainLink;

   }while(pObjectDirectoryEntry != NULL);

}

KdPrint(("------------------------------------遍历此目录对象完成----------------------.\n"));

}

//WIN7_32位的机器上获取对象的名字

void GetObjectNameInWin7_32(PVOID object)

{

//传入对象,按汇编思路,先得到头结构

POBJECT_HEADER_WIN7_32 pObjectHeader;

POBJECT_HEADER_NAME_INFO_WIN7_32 pObejctHeaderNameInfo;

UCHAR InfoMask;

KdPrint(("GetObjectNameInWin7_32() Enter.\n"));

pObjectHeader = OBJECT_TO_OBJECT_HEADER_WIN7_32(object);

KdPrint(("此对象[0x%08x] 的头对象为 [0x%08x].\n", object, pObjectHeader));

//得到掩码的值

InfoMask = pObjectHeader->InfoMask;

KdPrint(("此对象[0x%08x] 的掩码为 [0x%02x]. ObpInfoMaskToOffset[InfoMask] = [0x%08x]\n", object, InfoMask, ObpInfoMaskToOffset[InfoMask]));

//根据掩码值算出我们的名字结构体地址偏移量,同时还要得到最后的名字结构体地址,这里的实现参考大佬的方法

pObejctHeaderNameInfo = (ULONG)pObjectHeader - ObpInfoMaskToOffset[InfoMask & 3];

KdPrint(("此对象[0x%08x] 的名称结构体为 : [0x%08x].\n", object, pObejctHeaderNameInfo));

//最后打印结果

KdPrint(("此对象[0x%08x] 的名称为 : [%wZ].\n", object, &(pObejctHeaderNameInfo->Name)));

}

NTSTATUS GetObjectName()

{

NTSTATUS status = STATUS_UNSUCCESSFUL;

PVOID  Object = 0x8844fa68;

GetObjectNameInWin7_32(Object);

//解除对象引用

return status;

}

//传入要遍历的目录

NTKERNELAPI PVOID NTAPI ObGetObjectType(IN PVOID pObject);

NTKERNELAPI PVOID NTAPI  ObQueryNameInfo(IN PVOID Object);

void EnumDirectoryInWin7_32(POBJECT_DIRECTORY_WIN7_32 pObejctDirectory)

{

  POBJECT_DIRECTORY_ENTRY_WIN7_32 pObjectDirectoryEntry;

  POBJECT_HEADER_WIN7_32 pObjectHeader;

  POBJECT_HEADER_NAME_INFO_WIN7_32 pObjectHeaderNameInfo;

  int i;

    UNICODE_STRING ustrName;

  RtlInitUnicodeString(&ustrName,L"Directory");

  KdPrint(("------------------------------------正在遍历目录对象：[0x%08x]----------------------.\n",pObejctDirectory));

  for(i = 0; i < NUMBER_HASH_BUCKETS; i ++) 

  {

   pObjectDirectoryEntry = pObejctDirectory->HashBuckets[i];

   if (!MmIsAddressValid(pObjectDirectoryEntry))

   {

    //KdPrint(("-->此节点遍历目录连接对象POBJECT_DIRECTORY_ENTRY无效.\n"));

continue;

   }

   do

   {

  if (!MmIsAddressValid(pObjectDirectoryEntry->Object))

  {

//KdPrint(("-->此节点遍历到的对象pObjectDirectoryEntry->Object无效.\n"));

break;

    }

  pObjectHeader = OBJECT_TO_OBJECT_HEADER_WIN7_32(pObjectDirectoryEntry->Object);//根据对象来获取到对象

  KdPrint(("[节点 = %02d] 此对象地址为：[0x%08x] , 对象类型为:[%wZ] ,", i, pObjectDirectoryEntry->Object,&(((POBJECT_TYPE_WIN7_32)ObGetObjectType(pObjectDirectoryEntry->Object))->Name)));

  pObjectHeaderNameInfo = ObQueryNameInfo(pObjectDirectoryEntry->Object);

  if (pObjectHeaderNameInfo != NULL)

{

  //获取到对象名结构体

   KdPrint(("此对象名称为：[%wZ].\n",&(pObjectHeaderNameInfo->Name)));  

}

else

{

  KdPrint(("此对象没有名称.\n"));

  }

  //如果还是目录对象应该将其展开再次遍历

  if (RtlCompareUnicodeString(&(((POBJECT_TYPE_WIN7_32)ObGetObjectType(pObjectDirectoryEntry->Object))->Name), &ustrName, TRUE) == 0)

  {

  EnumDirectoryInWin7_32((POBJECT_DIRECTORY_WIN7_32)pObjectDirectoryEntry->Object);

    }   

  pObjectDirectoryEntry = pObjectDirectoryEntry->ChainLink;

   }while(pObjectDirectoryEntry != NULL);

}

KdPrint(("------------------------------------遍历此目录对象完成----------------------.\n"));

}

//这个函数实现WIN7_32位版本的类型对象的遍历

NTSTATUS EnumTypeObejct()

{

NTSTATUS status = STATUS_UNSUCCESSFUL;

//定义一个表来存储类型对象的地址,大小我们可能不知道，但依据分析我就给定一个足够大的空间

POBJECT_TYPE_WIN7_32 ObTypeIndexTable[100];

/*根据WINDBG的思路，我发现地址索引值为2的时候，存储的竟然是Type类型,那思路来了

我不管那么多，我先获取到其中的一个索引值，就拿\Device\Video这个对象来说，我得到他的地址，

然后得到地址头，得到对象类型的索引值，然后取地址向前遍历找到表的首地址,可以不硬编码写的.

*/ 

    POBJECT_TYPE_WIN7_32 ObjectType ;

ULONG i = 0;

    KdPrint(("EnumTypeObejct() Enter.\n")); 

//这里我懒得写那么麻烦了,提供了思路,我这里直接硬编码了,主要是为了验证做法正确与否

memcpy(ObTypeIndexTable, 0x84190ee0, 100 * sizeof(POBJECT_TYPE_WIN7_32));

for (i = 0; i < 100;i++)

{

ObjectType = ObTypeIndexTable[i];

if (ObjectType == NULL)

{

continue;

}

//KdPrint(("EnumTypeObejct() ObTypeIndexTable[%d] = [0x%08x].\n", i, ObTypeIndexTable[i]));

KdPrint(("EnumTypeObejct() ObTypeIndexTable[%d] = [0x%08x], 对象类型名称 : [%wZ].\n", i, ObTypeIndexTable[i], &(ObTypeIndexTable[i]->Name)));

}

return status;

}

NTSTATUS EnumObject()

{

NTSTATUS status = STATUS_UNSUCCESSFUL;

OBJECT_ATTRIBUTES oaDirectory; 

UNICODE_STRING ustrDirectory; 

PVOID  DirectoryObject = NULL;

HANDLE hDirectory;

//获取目录对象

RtlInitUnicodeString(&ustrDirectory, L"\\Device");

InitializeObjectAttributes(&oaDirectory, &ustrDirectory, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);

status = ZwOpenDirectoryObject(&hDirectory, 0, &oaDirectory);

if (NT_SUCCESS(status) )

{

//提供对象句柄访问许可，获取到对应目录对象

status = ObReferenceObjectByHandle(hDirectory, 0x10000000, 0, 0, &DirectoryObject, 0);

if ( NT_SUCCESS(status) )

{

//从根目录对对象进行遍利，迭代算法

if (FALSE)

{

//如果是XP下

EnumDirectoryInXp((POBJECT_DIRECTORY_XP)DirectoryObject);

}

else

{

EnumDirectoryInWin7_32((POBJECT_DIRECTORY_WIN7_32)DirectoryObject);

}

//如果是Win732位下

//解除对象引用

ObfDereferenceObject(DirectoryObject);

}

status = ZwClose(hDirectory);

  }

return status;

}

void DriverUnload(PDRIVER_OBJECT drv)

{

  KdPrint(("DriverUnload Enter.\n")); 

}

NTSTATUS myDispatchFunction(PDEVICE_OBJECT device,PIRP irp)

{

    irp->IoStatus.Information = 0;

    irp->IoStatus.Status = STATUS_SUCCESS;

    IoCompleteRequest(irp,IO_NO_INCREMENT);

    return STATUS_SUCCESS;

}

NTSTATUS DriverEntry(PDRIVER_OBJECT driver, PUNICODE_STRING reg_path)

{

NTSTATUS status = STATUS_SUCCESS;

size_t i = 0;

    for(i=0;i<IRP_MJ_MAXIMUM_FUNCTION;i++)

    {

        driver->MajorFunction[i] = myDispatchFunction;

    }

    driver->DriverUnload = DriverUnload;

//EnumObject();

KdPrint(("DriverEntry Enter.\n")); 

//EnumTypeObejct();

InitInfoMaskTable();

GetObjectName();

EnumObject();

    return status;

}

再次声明，此代码为本人一手所写且在Win7 32为下通过验证，如果和大佬有一样的地方，这里声明位置就是 InitInfoMaskTable（）此函数实现，参考大佬方法，其他若还有出处请大佬告知，本人有侵权必会立即修正，严重则即刻删除。

只为共享的大白兔声明，敬上各位大佬，同爱各位同仁。

typedef struct _OBJECT_DIRECTORY_WIN7_32 *POBJECT_DIRECTORY_WIN7_32;

typedef struct _OBJECT_DIRECTORY_ENTRY_WIN7_32 *POBJECT_DIRECTORY_ENTRY_WIN7_32;

typedef struct _DEVICE_MAP_WIN7_32

{

    POBJECT_DIRECTORY_WIN7_32 DosDevicesDirectory;

    POBJECT_DIRECTORY_WIN7_32 GlobalDosDevicesDirectory;

    PVOID DosDevicesDirectoryHandle;

    ULONG  ReferenceCount;

    ULONG  DriveMap;

    UCHAR DriveType[32];

 } DEVICE_MAP_WIN7_32, *PDEVICE_MAP_WIN7_32;

typedef struct _OBJECT_DIRECTORY_ENTRY_WIN7_32

{

   POBJECT_DIRECTORY_ENTRY_WIN7_32 ChainLink;

   PVOID Object; 

   ULONG HashValue;

} OBJECT_DIRECTORY_ENTRY_WIN7_32, *POBJECT_DIRECTORY_ENTRY_WIN7_32;

typedef struct _OBJECT_DIRECTORY_WIN7_32

{

    POBJECT_DIRECTORY_ENTRY_WIN7_32 HashBuckets[NUMBER_HASH_BUCKETS];

    EX_PUSH_LOCK Lock;

    PDEVICE_MAP_WIN7_32 DeviceMap;

    ULONG   SessionId;

    PVOID   NamespaceEntry;

    PVOID  SessionObject;

    ULONG  Flags;

} OBJECT_DIRECTORY_WIN7_32, *POBJECT_DIRECTORY_WIN7_32;

下面是我的融合源码（里面有XP及win7 32位下的实现），您可以拷贝到一个.c文件中进行编译，如果存在问题，请告知，编译版本和操作系统版本，如果我有时间会为您修复。

///////////////////////////////////////////////////

//作者：wo最爱吃大白兔

//时间：2018/3/30

////////////////////////////////////////////////////

#include <ntifs.h>

#define NUMBER_HASH_BUCKETS 37

//////////////////////////////////////////////////////////////////////////XP 32 位 版本//////////////////////////////////////////////////////////////////////////

typedef struct _OBJECT_DIRECTORY_XP *POBJECT_DIRECTORY_XP;

typedef struct _OBJECT_DIRECTORY_ENTRY_XP *POBJECT_DIRECTORY_ENTRY_XP;

typedef struct _OBJECT_TYPE_XP  *POBJECT_TYPE_XP;

typedef struct _DEVICE_MAP_XP

{

    POBJECT_DIRECTORY_XP DosDevicesDirectory;

    POBJECT_DIRECTORY_XP GlobalDosDevicesDirectory;

    ULONG  ReferenceCount;

    ULONG  DriveMap;

    UCHAR DriveType[32];

 } DEVICE_MAP_XP, * PDEVICE_MAP_XP;

typedef struct _OBJECT_DIRECTORY_ENTRY_XP

{

  POBJECT_DIRECTORY_ENTRY_XP ChainLink;

  PVOID Object;

} OBJECT_DIRECTORY_ENTRY_XP, *POBJECT_DIRECTORY_ENTRY_XP;

typedef struct _OBJECT_DIRECTORY_XP

{

    POBJECT_DIRECTORY_ENTRY_XP HashBuckets[NUMBER_HASH_BUCKETS];

    EX_PUSH_LOCK Lock;

    PDEVICE_MAP_XP DeviceMap;

    ULONG   SessionId;

    USHORT Reserved;

    USHORT SymbolicLinkUsageCount;

} OBJECT_DIRECTORY_XP, * POBJECT_DIRECTORY_XP;

typedef struct _OBJECT_CREATE_INFORMATION_XP 

{

   ULONG Attributes;

   PVOID RootDirectory;

   PVOID ParseContext;

   CHAR ProbeMode;

   ULONG PagedPoolCharge;

   ULONG NonPagedPoolCharge;

   ULONG SecurityDescriptorCharge;

   PVOID SecurityDescriptor;

   PSECURITY_QUALITY_OF_SERVICE SecurityQos;

   SECURITY_QUALITY_OF_SERVICE SecurityQualityOfService;

}OBJECT_CREATE_INFORMATION_XP,* POBJECT_CREATE_INFORMATION_XP;

typedef struct _OBJECT_HEADER_XP

{

    ULONG PointerCount;

    union

    {

        ULONG HandleCount;

        PVOID NextToFree;

    };

    POBJECT_TYPE_XP Type;

    UCHAR NameInfoOffset;

    UCHAR HandleInfoOffset;

    UCHAR QuotaInfoOffset;

    UCHAR Flags;

    union

    {

        POBJECT_CREATE_INFORMATION_XP ObjectCreateInfo;

        PVOID QuotaBlockCharged;

    };

    PVOID SecurityDescriptor;

    QUAD Body;

} OBJECT_HEADER_XP, * POBJECT_HEADER_XP;

typedef struct _OBJECT_HEADER_NAME_INFO_XP 

{

    POBJECT_DIRECTORY_XP Directory;

    UNICODE_STRING Name;

    ULONG QueryReferences;

} OBJECT_HEADER_NAME_INFO_XP, *POBJECT_HEADER_NAME_INFO_XP;

typedef struct _OBJECT_TYPE_INITIALIZER_XP 

{

   ERESOURCE Mutex            ; 

   LIST_ENTRY TypeList        ; 

   UNICODE_STRING Name         ;  

   PVOID DefaultObject ;

   ULONG Index ;

   ULONG TotalNumberOfObjects ;

   ULONG TotalNumberOfHandles ;

   ULONG HighWaterNumberOfObjects ;

   ULONG HighWaterNumberOfHandles ;

   struct _OBJECT_TYPE_INITIALIZER_XP *TypeInfo ;

   ULONG Key             ;

   ERESOURCE ObjectLocks[4];

   USHORT Length ;

   UCHAR UseDefaultObject ; 

   UCHAR CaseInsensitive ;

   ULONG InvalidAttributes ;

   GENERIC_MAPPING GenericMapping   ;

   ULONG ValidAccessMask ;

   UCHAR SecurityRequired ;

   UCHAR MaintainHandleCount ;

   UCHAR MaintainTypeList ;

   POOL_TYPE PoolType               ;

   ULONG DefaultPagedPoolCharge      ;

   ULONG DefaultNonPagedPoolCharge   ;

   PVOID DumpProcedure     ;

   PLONG OpenProcedure     ;

   PVOID CloseProcedure    ;

   PVOID DeleteProcedure   ; 

   PLONG ParseProcedure    ; 

   PLONG SecurityProcedure ;

   PLONG QueryNameProcedure     ;

   PUCHAR OkayToCloseProcedure  ;

} OBJECT_TYPE_INITIALIZER_XP, *POBJECT_TYPE_INITIALIZER_XP;

typedef struct _OBJECT_TYPE_XP 

{

   ERESOURCE Mutex            ; 

   LIST_ENTRY TypeList        ; 

   UNICODE_STRING Name        ;  

   PVOID DefaultObject ;

   ULONG Index ;

   ULONG TotalNumberOfObjects ;

   ULONG TotalNumberOfHandles ;

   ULONG HighWaterNumberOfObjects ;

   ULONG HighWaterNumberOfHandles ;

   OBJECT_TYPE_INITIALIZER_XP TypeInfo ;

   ULONG Key             ;

   ERESOURCE  ObjectLocks[4] ;

 } OBJECT_TYPE_XP, *POBJECT_TYPE_XP;

//获取到对象的结构体部分

#define OBJECT_TO_OBJECT_HEADER_XP( o ) \

    CONTAINING_RECORD( (o), OBJECT_HEADER_XP, Body )

//XP下根据对象的头获取到它的名字信息部分

#define OBJECT_HEADER_TO_NAME_INFO_XP( oh ) ((POBJECT_HEADER_NAME_INFO_XP) \

    ((oh)->NameInfoOffset == 0 ? NULL : ((PCHAR)(oh) - (oh)->NameInfoOffset)))

//////////////////////////////////////////////////////////////////////////WIN7 32 位 版本//////////////////////////////////////////////////////////////////////////

typedef struct _OBJECT_DIRECTORY_WIN7_32 *POBJECT_DIRECTORY_WIN7_32;

typedef struct _OBJECT_DIRECTORY_ENTRY_WIN7_32 *POBJECT_DIRECTORY_ENTRY_WIN7_32;

typedef struct _DEVICE_MAP_WIN7_32

{

    POBJECT_DIRECTORY_WIN7_32 DosDevicesDirectory;

    POBJECT_DIRECTORY_WIN7_32 GlobalDosDevicesDirectory;

    PVOID DosDevicesDirectoryHandle;

    ULONG  ReferenceCount;

    ULONG  DriveMap;

    UCHAR DriveType[32];

 } DEVICE_MAP_WIN7_32, *PDEVICE_MAP_WIN7_32;

typedef struct _OBJECT_DIRECTORY_ENTRY_WIN7_32

{

   POBJECT_DIRECTORY_ENTRY_WIN7_32 ChainLink;

   PVOID Object; 

   ULONG HashValue;

} OBJECT_DIRECTORY_ENTRY_WIN7_32, *POBJECT_DIRECTORY_ENTRY_WIN7_32;

typedef struct _OBJECT_DIRECTORY_WIN7_32

{

    POBJECT_DIRECTORY_ENTRY_WIN7_32 HashBuckets[NUMBER_HASH_BUCKETS];

    EX_PUSH_LOCK Lock;

    PDEVICE_MAP_WIN7_32 DeviceMap;

    ULONG   SessionId;

    PVOID   NamespaceEntry;

    PVOID  SessionObject;

    ULONG  Flags;

} OBJECT_DIRECTORY_WIN7_32, *POBJECT_DIRECTORY_WIN7_32;

typedef struct _OBJECT_CREATE_INFORMATION_WIN7_32 

{

   ULONG Attributes;

   PVOID RootDirectory;

   PVOID ParseContext;

   CHAR ProbeMode;

   ULONG PagedPoolCharge;

   ULONG NonPagedPoolCharge;

   ULONG SecurityDescriptorCharge;

   PVOID SecurityDescriptor;

   PSECURITY_QUALITY_OF_SERVICE SecurityQos;

   SECURITY_QUALITY_OF_SERVICE SecurityQualityOfService;

}OBJECT_CREATE_INFORMATION_WIN7_32,* POBJECT_CREATE_INFORMATION_WIN7_32;

typedef struct _OBJECT_HEADER_WIN7_32

{

    ULONG PointerCount;

    union

    {

        ULONG HandleCount;

        PVOID NextToFree;

    };

    EX_PUSH_LOCK Lock;

    UCHAR TypeIndex;

    UCHAR TraceFlags;

    UCHAR InfoMask;

    UCHAR Flags;

    union

    {

        POBJECT_CREATE_INFORMATION_WIN7_32 ObjectCreateInfo;

        PVOID QuotaBlockCharged;

    };

    PVOID SecurityDescriptor;

    QUAD Body;

} OBJECT_HEADER_WIN7_32, * POBJECT_HEADER_WIN7_32;

typedef struct _OBJECT_TYPE_FlAGS_WIN7_32

{  

    UCHAR CaseInsensitive : 1;  

    UCHAR UnnamedObjectsOnly : 1;  

    UCHAR UseDefaultObject : 1;  

    UCHAR SecurityRequired : 1;  

    UCHAR MaintainHandleCount : 1;  

    UCHAR MaintainTypeList : 1;  

    UCHAR SupportsObjectCallbacks : 1;  

    UCHAR CacheAligned : 1;  

}OBJECT_TYPE_FlAGS_WIN7_32, *POBJECT_TYPE_FlAGS_WIN7_32; 

typedef struct _OBJECT_TYPE_INITIALIZER_WIN7_32 

{

   USHORT Length       ;

   OBJECT_TYPE_FlAGS_WIN7_32 ObjectTypeFlags; 

   ULONG  ObjectTypeCode      ;

   ULONG  InvalidAttributes   ;

   GENERIC_MAPPING   GenericMapping;

   ULONG ValidAccessMask      ;

   ULONG RetainAccess       ;

   POOL_TYPE PoolType               ;

   ULONG DefaultPagedPoolCharge      ;

   ULONG DefaultNonPagedPoolCharge   ;

   PVOID DumpProcedure     ;

   PLONG OpenProcedure     ;

   PVOID CloseProcedure    ;

   PVOID DeleteProcedure   ; 

   PLONG ParseProcedure    ; 

   PLONG SecurityProcedure ;

   PLONG QueryNameProcedure     ;

   PUCHAR OkayToCloseProcedure  ;

} OBJECT_TYPE_INITIALIZER_WIN7_32, *POBJECT_TYPE_INITIALIZER_WIN7_32;

typedef struct _OBJECT_TYPE_WIN7_32 

{

   LIST_ENTRY TypeList        ; 

   UNICODE_STRING Name        ;  

   PVOID DefaultObject       ;

   ULONG Index         ;

   ULONG TotalNumberOfObjects ;

   ULONG TotalNumberOfHandles ;

   ULONG HighWaterNumberOfObjects ;

   ULONG HighWaterNumberOfHandles ;

   OBJECT_TYPE_INITIALIZER_WIN7_32 TypeInfo ;

   EX_PUSH_LOCK TypeLock;       

   ULONG Key             ;

   LIST_ENTRY CallbackList;

 } OBJECT_TYPE_WIN7_32, *POBJECT_TYPE_WIN7_32;

typedef struct _OBJECT_HEADER_NAME_INFO_WIN7_32

{

POBJECT_DIRECTORY_WIN7_32 Directory;

UNICODE_STRING Name;

ULONG ReferenceCount;

} OBJECT_HEADER_NAME_INFO_WIN7_32, *POBJECT_HEADER_NAME_INFO_WIN7_32;

typedef struct  _OBJECT_HEADER_CREATOR_INFO_WIN7_32

{

LIST_ENTRY TypeList;

PVOID CreatorUniqueProcess;

USHORT CreatorBackTraceIndex;

USHORT Reserved;

}OBJECT_HEADER_CREATOR_INFO_WIN7_32, *POBJECT_HEADER_CREATOR_INFO_WIN7_32;

//////////////////////////////////////////////////////////////////

typedef struct  _H_L_COUNT

{

ULONG HandleCount : 24;

ULONG LockCount : 8;

}H_L_COUNT, *P_H_L_COUNT;

typedef struct  _OBJECT_HANDLE_COUNT_ENTRY_WIN7_32

{

PEPROCESS Process;

H_L_COUNT Count;

}OBJECT_HANDLE_COUNT_ENTRY_WIN7_32, *POBJECT_HANDLE_COUNT_ENTRY_WIN7_32;

typedef struct  _OBJECT_HANDLE_COUNT_DATABASE_WIN7_32

{

ULONG CountEntries;

OBJECT_HANDLE_COUNT_ENTRY_WIN7_32 HandleCountEntries[1];

}OBJECT_HANDLE_COUNT_DATABASE_WIN7_32, *POBJECT_HANDLE_COUNT_DATABASE_WIN7_32;

typedef struct  _OBJECT_HEADER_HANDLE_INFO_WIN7_32

{

OBJECT_HANDLE_COUNT_DATABASE_WIN7_32 TypeList;

OBJECT_HANDLE_COUNT_ENTRY_WIN7_32 SingleEntry;

}OBJECT_HEADER_HANDLE_INFO_WIN7_32, *POBJECT_HEADER_HANDLE_INFO_WIN7_32;

//////////////////////////////////////////////////////////////////////

typedef struct _OBJECT_HEADER_QUOTA_INFO_WIN7_32

{

ULONG PagedPoolCharge;

ULONG NonPagedPoolCharge;

ULONG SecurityDescriptorCharge;

PVOID SecurityDescriptorQuotaBlock;

}OBJECT_HEADER_QUOTA_INFO_WIN7_32, *POBJECT_HEADER_QUOTA_INFO_WIN7_32;

typedef struct _OBJECT_HEADER_PROCESS_INFO_WIN7_32

{

PEPROCESS ExclusiveProcess;

ULONG Reserved;

}OBJECT_HEADER_PROCESS_INFO_WIN7_32, *POBJECT_HEADER_PROCESS_INFO_WIN7_32;

//获取到对象的结构体部分

#define OBJECT_TO_OBJECT_HEADER_WIN7_32( o ) \

    CONTAINING_RECORD( (o), OBJECT_HEADER_WIN7_32, Body )

//定义一套掩码用来做地址分析

#define OB_INFOMASK_PROCESS_INFO 0x10

#define OB_INFOMASK_QUOTA               0x08

#define OB_INFOMASK_HANDLE              0x04

#define OB_INFOMASK_NAME                0x02

#define OB_INFOMASK_CREATOR_INFO        0x01 

//还要做一份掩码查询表,定义一个掩码表

ULONG ObpInfoMaskToOffset[32] = { 0 };

 

void InitInfoMaskTable()

 {

ULONG i = 0;

ULONG offset = 0;

do

{

offset = 0;

if (i & OB_INFOMASK_CREATOR_INFO)

offset = sizeof(OBJECT_HEADER_CREATOR_INFO_WIN7_32);

if (i & OB_INFOMASK_NAME)

offset += sizeof(OBJECT_HEADER_NAME_INFO_WIN7_32);

if (i & OB_INFOMASK_HANDLE)

offset += sizeof(OBJECT_HEADER_HANDLE_INFO_WIN7_32);

if (i & OB_INFOMASK_QUOTA)

offset += sizeof(OBJECT_HEADER_QUOTA_INFO_WIN7_32);

if (i & OB_INFOMASK_PROCESS_INFO)

offset += sizeof(OBJECT_HEADER_PROCESS_INFO_WIN7_32);

ObpInfoMaskToOffset[i] = offset;//算出对应掩码值的最大偏移量

KdPrint(("ObpInfoMaskToOffset[%d] = [0x%08x] .\n", i, ObpInfoMaskToOffset[i]));

i++;

} while (i<32);

 }

//传入要遍历的目录

void EnumDirectoryInXp(POBJECT_DIRECTORY_XP pObejctDirectory)

{

  POBJECT_DIRECTORY_ENTRY_XP pObjectDirectoryEntry;

  POBJECT_HEADER_XP pObjectHeader;

  POBJECT_HEADER_NAME_INFO_XP pObjectHeaderNameInfo;

  int i;

    UNICODE_STRING ustrName;

  RtlInitUnicodeString(&ustrName,L"Directory");

  KdPrint(("------------------------------------正在遍历目录对象：[0x%08x]----------------------.\n",pObejctDirectory));

  for(i = 0; i < NUMBER_HASH_BUCKETS; i ++) 

  {

   pObjectDirectoryEntry = pObejctDirectory->HashBuckets[i];

   if (!MmIsAddressValid(pObjectDirectoryEntry))

   {

    //KdPrint(("-->此节点遍历目录连接对象POBJECT_DIRECTORY_ENTRY无效.\n"));

continue;

   }

   do

   {

  if (!MmIsAddressValid(pObjectDirectoryEntry->Object))

  {

//KdPrint(("-->此节点遍历到的对象pObjectDirectoryEntry->Object无效.\n"));

break;

    }

  pObjectHeader = OBJECT_TO_OBJECT_HEADER_XP(pObjectDirectoryEntry->Object);//根据对象来获取到对象

KdPrint(("[节点 = %02d] 此对象地址为：[0x%08x] , 对象类型为:[%wZ] ,",i,pObjectDirectoryEntry->Object,&(pObjectHeader->Type->Name)));

if (pObjectHeader->NameInfoOffset > 0)

{

   pObjectHeaderNameInfo = OBJECT_HEADER_TO_NAME_INFO_XP(pObjectHeader);//获取到对象名结构体

   KdPrint(("此对象名称为：[%wZ].\n",&(pObjectHeaderNameInfo->Name)));

   //RtlUnicodeStringCopy(&ustrName,&(pObjectName->Name));  

}

else

{

  KdPrint(("此对象没有名称.\n"));

  }

  //如果还是目录对象应该将其展开再次遍历

  if (RtlCompareUnicodeString(&(pObjectHeader->Type->Name),&ustrName,TRUE) == 0)

  {

EnumDirectoryInXp((POBJECT_DIRECTORY_XP)pObjectDirectoryEntry->Object);

  }   

  pObjectDirectoryEntry = pObjectDirectoryEntry->ChainLink;

   }while(pObjectDirectoryEntry != NULL);

}

KdPrint(("------------------------------------遍历此目录对象完成----------------------.\n"));

}

//WIN7_32位的机器上获取对象的名字

void GetObjectNameInWin7_32(PVOID object)

{

//传入对象,按汇编思路,先得到头结构

POBJECT_HEADER_WIN7_32 pObjectHeader;

POBJECT_HEADER_NAME_INFO_WIN7_32 pObejctHeaderNameInfo;

UCHAR InfoMask;

KdPrint(("GetObjectNameInWin7_32() Enter.\n"));

pObjectHeader = OBJECT_TO_OBJECT_HEADER_WIN7_32(object);

KdPrint(("此对象[0x%08x] 的头对象为 [0x%08x].\n", object, pObjectHeader));

//得到掩码的值

InfoMask = pObjectHeader->InfoMask;

KdPrint(("此对象[0x%08x] 的掩码为 [0x%02x]. ObpInfoMaskToOffset[InfoMask] = [0x%08x]\n", object, InfoMask, ObpInfoMaskToOffset[InfoMask]));

//根据掩码值算出我们的名字结构体地址偏移量,同时还要得到最后的名字结构体地址,这里的实现参考大佬的方法

pObejctHeaderNameInfo = (ULONG)pObjectHeader - ObpInfoMaskToOffset[InfoMask & 3];

KdPrint(("此对象[0x%08x] 的名称结构体为 : [0x%08x].\n", object, pObejctHeaderNameInfo));

//最后打印结果

KdPrint(("此对象[0x%08x] 的名称为 : [%wZ].\n", object, &(pObejctHeaderNameInfo->Name)));

}

NTSTATUS GetObjectName()

{

NTSTATUS status = STATUS_UNSUCCESSFUL;

PVOID  Object = 0x8844fa68;

GetObjectNameInWin7_32(Object);

//解除对象引用

return status;

}

//传入要遍历的目录

NTKERNELAPI PVOID NTAPI ObGetObjectType(IN PVOID pObject);

NTKERNELAPI PVOID NTAPI  ObQueryNameInfo(IN PVOID Object);

void EnumDirectoryInWin7_32(POBJECT_DIRECTORY_WIN7_32 pObejctDirectory)

{

  POBJECT_DIRECTORY_ENTRY_WIN7_32 pObjectDirectoryEntry;

  POBJECT_HEADER_WIN7_32 pObjectHeader;

  POBJECT_HEADER_NAME_INFO_WIN7_32 pObjectHeaderNameInfo;

  int i;

    UNICODE_STRING ustrName;

  RtlInitUnicodeString(&ustrName,L"Directory");

  KdPrint(("------------------------------------正在遍历目录对象：[0x%08x]----------------------.\n",pObejctDirectory));

  for(i = 0; i < NUMBER_HASH_BUCKETS; i ++) 

  {

   pObjectDirectoryEntry = pObejctDirectory->HashBuckets[i];

   if (!MmIsAddressValid(pObjectDirectoryEntry))

   {

    //KdPrint(("-->此节点遍历目录连接对象POBJECT_DIRECTORY_ENTRY无效.\n"));

continue;

   }

   do

   {

  if (!MmIsAddressValid(pObjectDirectoryEntry->Object))

  {

//KdPrint(("-->此节点遍历到的对象pObjectDirectoryEntry->Object无效.\n"));

break;

    }

  pObjectHeader = OBJECT_TO_OBJECT_HEADER_WIN7_32(pObjectDirectoryEntry->Object);//根据对象来获取到对象

  KdPrint(("[节点 = %02d] 此对象地址为：[0x%08x] , 对象类型为:[%wZ] ,", i, pObjectDirectoryEntry->Object,&(((POBJECT_TYPE_WIN7_32)ObGetObjectType(pObjectDirectoryEntry->Object))->Name)));

  pObjectHeaderNameInfo = ObQueryNameInfo(pObjectDirectoryEntry->Object);

  if (pObjectHeaderNameInfo != NULL)

{

  //获取到对象名结构体

   KdPrint(("此对象名称为：[%wZ].\n",&(pObjectHeaderNameInfo->Name)));  

}

else

{

  KdPrint(("此对象没有名称.\n"));

  }

  //如果还是目录对象应该将其展开再次遍历

  if (RtlCompareUnicodeString(&(((POBJECT_TYPE_WIN7_32)ObGetObjectType(pObjectDirectoryEntry->Object))->Name), &ustrName, TRUE) == 0)

  {

  EnumDirectoryInWin7_32((POBJECT_DIRECTORY_WIN7_32)pObjectDirectoryEntry->Object);

    }   

  pObjectDirectoryEntry = pObjectDirectoryEntry->ChainLink;

   }while(pObjectDirectoryEntry != NULL);

}

KdPrint(("------------------------------------遍历此目录对象完成----------------------.\n"));

}

//这个函数实现WIN7_32位版本的类型对象的遍历

NTSTATUS EnumTypeObejct()

{

NTSTATUS status = STATUS_UNSUCCESSFUL;

//定义一个表来存储类型对象的地址,大小我们可能不知道，但依据分析我就给定一个足够大的空间

POBJECT_TYPE_WIN7_32 ObTypeIndexTable[100];

/*根据WINDBG的思路，我发现地址索引值为2的时候，存储的竟然是Type类型,那思路来了

我不管那么多，我先获取到其中的一个索引值，就拿\Device\Video这个对象来说，我得到他的地址，

然后得到地址头，得到对象类型的索引值，然后取地址向前遍历找到表的首地址,可以不硬编码写的.

*/ 

    POBJECT_TYPE_WIN7_32 ObjectType ;

ULONG i = 0;

    KdPrint(("EnumTypeObejct() Enter.\n")); 

//这里我懒得写那么麻烦了,提供了思路,我这里直接硬编码了,主要是为了验证做法正确与否

memcpy(ObTypeIndexTable, 0x84190ee0, 100 * sizeof(POBJECT_TYPE_WIN7_32));

for (i = 0; i < 100;i++)

{

ObjectType = ObTypeIndexTable[i];

if (ObjectType == NULL)

{

continue;

}

//KdPrint(("EnumTypeObejct() ObTypeIndexTable[%d] = [0x%08x].\n", i, ObTypeIndexTable[i]));

KdPrint(("EnumTypeObejct() ObTypeIndexTable[%d] = [0x%08x], 对象类型名称 : [%wZ].\n", i, ObTypeIndexTable[i], &(ObTypeIndexTable[i]->Name)));

}

return status;

}

NTSTATUS EnumObject()

{

NTSTATUS status = STATUS_UNSUCCESSFUL;

OBJECT_ATTRIBUTES oaDirectory; 

UNICODE_STRING ustrDirectory; 

PVOID  DirectoryObject = NULL;

HANDLE hDirectory;

//获取目录对象

RtlInitUnicodeString(&ustrDirectory, L"\\Device");

InitializeObjectAttributes(&oaDirectory, &ustrDirectory, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);

status = ZwOpenDirectoryObject(&hDirectory, 0, &oaDirectory);

if (NT_SUCCESS(status) )

{

//提供对象句柄访问许可，获取到对应目录对象

status = ObReferenceObjectByHandle(hDirectory, 0x10000000, 0, 0, &DirectoryObject, 0);

if ( NT_SUCCESS(status) )

{

//从根目录对对象进行遍利，迭代算法

if (FALSE)

{

//如果是XP下

EnumDirectoryInXp((POBJECT_DIRECTORY_XP)DirectoryObject);

}

else

{

EnumDirectoryInWin7_32((POBJECT_DIRECTORY_WIN7_32)DirectoryObject);

}

//如果是Win732位下

//解除对象引用

ObfDereferenceObject(DirectoryObject);

}

status = ZwClose(hDirectory);

  }

return status;

}

void DriverUnload(PDRIVER_OBJECT drv)

{

  KdPrint(("DriverUnload Enter.\n")); 

}

NTSTATUS myDispatchFunction(PDEVICE_OBJECT device,PIRP irp)

{

    irp->IoStatus.Information = 0;

    irp->IoStatus.Status = STATUS_SUCCESS;

    IoCompleteRequest(irp,IO_NO_INCREMENT);

    return STATUS_SUCCESS;

}

NTSTATUS DriverEntry(PDRIVER_OBJECT driver, PUNICODE_STRING reg_path)

{

NTSTATUS status = STATUS_SUCCESS;

size_t i = 0;

    for(i=0;i<IRP_MJ_MAXIMUM_FUNCTION;i++)

    {

        driver->MajorFunction[i] = myDispatchFunction;

    }

    driver->DriverUnload = DriverUnload;

//EnumObject();

KdPrint(("DriverEntry Enter.\n")); 

//EnumTypeObejct();

InitInfoMaskTable();

GetObjectName();

EnumObject();

    return status;

}

再次声明，此代码为本人一手所写且在Win7 32为下通过验证，如果和大佬有一样的地方，这里声明位置就是 InitInfoMaskTable（）此函数实现，参考大佬方法，其他若还有出处请大佬告知，本人有侵权必会立即修正，严重则即刻删除。

只为共享的大白兔声明，敬上各位大佬，同爱各位同仁。

///////////////////////////////////////////////////

//作者：wo最爱吃大白兔

//时间：2018/3/30

////////////////////////////////////////////////////

#include <ntifs.h>

#define NUMBER_HASH_BUCKETS 37

//////////////////////////////////////////////////////////////////////////XP 32 位 版本//////////////////////////////////////////////////////////////////////////

typedef struct _OBJECT_DIRECTORY_XP *POBJECT_DIRECTORY_XP;

typedef struct _OBJECT_DIRECTORY_ENTRY_XP *POBJECT_DIRECTORY_ENTRY_XP;

typedef struct _OBJECT_TYPE_XP  *POBJECT_TYPE_XP;

typedef struct _DEVICE_MAP_XP

{

    POBJECT_DIRECTORY_XP DosDevicesDirectory;

    POBJECT_DIRECTORY_XP GlobalDosDevicesDirectory;

    ULONG  ReferenceCount;

    ULONG  DriveMap;

    UCHAR DriveType[32];

 } DEVICE_MAP_XP, * PDEVICE_MAP_XP;

typedef struct _OBJECT_DIRECTORY_ENTRY_XP

{

  POBJECT_DIRECTORY_ENTRY_XP ChainLink;

  PVOID Object;

} OBJECT_DIRECTORY_ENTRY_XP, *POBJECT_DIRECTORY_ENTRY_XP;

typedef struct _OBJECT_DIRECTORY_XP

{

    POBJECT_DIRECTORY_ENTRY_XP HashBuckets[NUMBER_HASH_BUCKETS];

    EX_PUSH_LOCK Lock;

    PDEVICE_MAP_XP DeviceMap;

    ULONG   SessionId;

    USHORT Reserved;

    USHORT SymbolicLinkUsageCount;

} OBJECT_DIRECTORY_XP, * POBJECT_DIRECTORY_XP;

typedef struct _OBJECT_CREATE_INFORMATION_XP 

{

   ULONG Attributes;

   PVOID RootDirectory;

   PVOID ParseContext;

   CHAR ProbeMode;

   ULONG PagedPoolCharge;

   ULONG NonPagedPoolCharge;

   ULONG SecurityDescriptorCharge;

   PVOID SecurityDescriptor;

   PSECURITY_QUALITY_OF_SERVICE SecurityQos;

   SECURITY_QUALITY_OF_SERVICE SecurityQualityOfService;

}OBJECT_CREATE_INFORMATION_XP,* POBJECT_CREATE_INFORMATION_XP;

typedef struct _OBJECT_HEADER_XP

{

    ULONG PointerCount;

    union

    {

        ULONG HandleCount;

        PVOID NextToFree;

    };

    POBJECT_TYPE_XP Type;

    UCHAR NameInfoOffset;

    UCHAR HandleInfoOffset;

    UCHAR QuotaInfoOffset;

    UCHAR Flags;

    union

    {

        POBJECT_CREATE_INFORMATION_XP ObjectCreateInfo;

        PVOID QuotaBlockCharged;

    };

    PVOID SecurityDescriptor;

    QUAD Body;

} OBJECT_HEADER_XP, * POBJECT_HEADER_XP;

typedef struct _OBJECT_HEADER_NAME_INFO_XP 

{

    POBJECT_DIRECTORY_XP Directory;

    UNICODE_STRING Name;

    ULONG QueryReferences;

} OBJECT_HEADER_NAME_INFO_XP, *POBJECT_HEADER_NAME_INFO_XP;

typedef struct _OBJECT_TYPE_INITIALIZER_XP 

{

   ERESOURCE Mutex            ; 

   LIST_ENTRY TypeList        ; 

   UNICODE_STRING Name         ;  

   PVOID DefaultObject ;

   ULONG Index ;

   ULONG TotalNumberOfObjects ;

   ULONG TotalNumberOfHandles ;

   ULONG HighWaterNumberOfObjects ;

   ULONG HighWaterNumberOfHandles ;

   struct _OBJECT_TYPE_INITIALIZER_XP *TypeInfo ;

   ULONG Key             ;

   ERESOURCE ObjectLocks[4];

   USHORT Length ;

   UCHAR UseDefaultObject ; 

   UCHAR CaseInsensitive ;

   ULONG InvalidAttributes ;

   GENERIC_MAPPING GenericMapping   ;

   ULONG ValidAccessMask ;

   UCHAR SecurityRequired ;

   UCHAR MaintainHandleCount ;

   UCHAR MaintainTypeList ;

   POOL_TYPE PoolType               ;

   ULONG DefaultPagedPoolCharge      ;

   ULONG DefaultNonPagedPoolCharge   ;

   PVOID DumpProcedure     ;

   PLONG OpenProcedure     ;

   PVOID CloseProcedure    ;

   PVOID DeleteProcedure   ; 

   PLONG ParseProcedure    ; 

   PLONG SecurityProcedure ;

   PLONG QueryNameProcedure     ;

   PUCHAR OkayToCloseProcedure  ;

} OBJECT_TYPE_INITIALIZER_XP, *POBJECT_TYPE_INITIALIZER_XP;

typedef struct _OBJECT_TYPE_XP 

{

   ERESOURCE Mutex            ; 

   LIST_ENTRY TypeList        ; 

   UNICODE_STRING Name        ;  

   PVOID DefaultObject ;

   ULONG Index ;

   ULONG TotalNumberOfObjects ;

   ULONG TotalNumberOfHandles ;

   ULONG HighWaterNumberOfObjects ;

   ULONG HighWaterNumberOfHandles ;

   OBJECT_TYPE_INITIALIZER_XP TypeInfo ;

   ULONG Key             ;

   ERESOURCE  ObjectLocks[4] ;

 } OBJECT_TYPE_XP, *POBJECT_TYPE_XP;

//获取到对象的结构体部分

#define OBJECT_TO_OBJECT_HEADER_XP( o ) \

    CONTAINING_RECORD( (o), OBJECT_HEADER_XP, Body )

//XP下根据对象的头获取到它的名字信息部分

#define OBJECT_HEADER_TO_NAME_INFO_XP( oh ) ((POBJECT_HEADER_NAME_INFO_XP) \

    ((oh)->NameInfoOffset == 0 ? NULL : ((PCHAR)(oh) - (oh)->NameInfoOffset)))

//////////////////////////////////////////////////////////////////////////WIN7 32 位 版本//////////////////////////////////////////////////////////////////////////

typedef struct _OBJECT_DIRECTORY_WIN7_32 *POBJECT_DIRECTORY_WIN7_32;

typedef struct _OBJECT_DIRECTORY_ENTRY_WIN7_32 *POBJECT_DIRECTORY_ENTRY_WIN7_32;

typedef struct _DEVICE_MAP_WIN7_32

{

    POBJECT_DIRECTORY_WIN7_32 DosDevicesDirectory;

    POBJECT_DIRECTORY_WIN7_32 GlobalDosDevicesDirectory;

    PVOID DosDevicesDirectoryHandle;

    ULONG  ReferenceCount;

    ULONG  DriveMap;

    UCHAR DriveType[32];

 } DEVICE_MAP_WIN7_32, *PDEVICE_MAP_WIN7_32;

typedef struct _OBJECT_DIRECTORY_ENTRY_WIN7_32

{

   POBJECT_DIRECTORY_ENTRY_WIN7_32 ChainLink;

   PVOID Object; 

   ULONG HashValue;

} OBJECT_DIRECTORY_ENTRY_WIN7_32, *POBJECT_DIRECTORY_ENTRY_WIN7_32;

typedef struct _OBJECT_DIRECTORY_WIN7_32

{

    POBJECT_DIRECTORY_ENTRY_WIN7_32 HashBuckets[NUMBER_HASH_BUCKETS];

    EX_PUSH_LOCK Lock;

    PDEVICE_MAP_WIN7_32 DeviceMap;

    ULONG   SessionId;

    PVOID   NamespaceEntry;

    PVOID  SessionObject;

    ULONG  Flags;

} OBJECT_DIRECTORY_WIN7_32, *POBJECT_DIRECTORY_WIN7_32;

typedef struct _OBJECT_CREATE_INFORMATION_WIN7_32 

{

   ULONG Attributes;

   PVOID RootDirectory;

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)