WDM/DDK defines for OBJECT_TYPE, etc

I'm trying to obtain a filename from an OBJECT_ATTRIBUTES struct.

I've copied the function prototype for ObReferenceObjectByHandle from http://www.osronline.com/ddkx/kmarch/k107_54qa.htm. I then obtained the OBJECT_ATTRIBUTES struct definition from http://msdn2.microsoft.com/en-us/library/aa491657.aspx.

However, even though MS gives the OBJECT_ATTRIBUTES definition on MSDN, they don't give its member OBJECT_TYPE. All they say is "OBJECT_TYPE is an opaque structure that specifies the object type of a handle" (http://msdn2.microsoft.com/en-us/library/aa491647.aspx).

Am I missing something? Shouldn't this be easier? I have the DDK installed but a grep doesn't reveal the definition for _OBJECT_TYPE in any of the files.

Can someone give me a hand in obtaining all of the definitions needed to convert the OBJECT_ATTRIBUTES over to a filename? Thanks.
LVL 4
jimstarAsked:
Who is Participating?
 
jkrConnect With a Mentor Commented:
You'll find the prototype at http://www.osronline.com/showThread.cfm?link=5703 and/or http://www.nirsoft.net/kernel_struct/vista/OBJECT_TYPE.html

"KPROCESSOR_MODE" is
ntddk.h:typedef CCHAR KPROCESSOR_MODE;

and OBJECT_HANDLE_INFORMATION is defined in ntddk.h also:

typedef struct _OBJECT_HANDLE_INFORMATION {
    ULONG HandleAttributes;
    ACCESS_MASK GrantedAccess;
} OBJECT_HANDLE_INFORMATION, *POBJECT_HANDLE_INFORMATION;
0
 
jimstarAuthor Commented:
typedef NTSTATUS (*ObReferenceObjectByHandle)(
    IN HANDLE  Handle,
    IN ACCESS_MASK  DesiredAccess,
    IN POBJECT_TYPE  ObjectType  OPTIONAL, <-- missing
    IN KPROCESSOR_MODE  AccessMode,   <-- missing
    OUT PVOID  *Object,
    OUT POBJECT_HANDLE_INFORMATION  HandleInformation  OPTIONAL <-- missing
    );

typedef struct _OBJECT_ATTRIBUTES {
    ULONG Length;
    HANDLE RootDirectory;
    PUNICODE_STRING ObjectName;
    ULONG Attributes;
    PVOID SecurityDescriptor;        // Points to type SECURITY_DESCRIPTOR
    PVOID SecurityQualityOfService;  // Points to type SECURITY_QUALITY_OF_SERVICE
} OBJECT_ATTRIBUTES;
typedef OBJECT_ATTRIBUTES *POBJECT_ATTRIBUTES;


Looks like I'm missing POBJECT_TYPE (_OBJECT_TYPE), KPROCESSOR_MODE (and the associated values), and POBJECT_HANDLE_INFORMATION (and the associated struct).
0
 
jkrConnect With a Mentor Commented:
Oops, forgot 'OBJECT_TYPE'

typedef struct _OBJECT_TYPE
{
     ERESOURCE Mutex;
     LIST_ENTRY TypeList;
     UNICODE_STRING Name;
     PVOID DefaultObject;
     ULONG Index;
     ULONG TotalNumberOfObjects;
     ULONG TotalNumberOfHandles;
     ULONG HighWaterNumberOfObjects;
     ULONG HighWaterNumberOfHandles;
     OBJECT_TYPE_INITIALIZER TypeInfo;
     ULONG Key;
     EX_PUSH_LOCK ObjectLocks[32];
} OBJECT_TYPE, *POBJECT_TYPE;
0
Cloud Class® Course: Ruby Fundamentals

This course will introduce you to Ruby, as well as teach you about classes, methods, variables, data structures, loops, enumerable methods, and finishing touches.

 
jimstarAuthor Commented:
Thanks - the nirsoft site is great, with hyperlinked object types. I'm working through all of the sub-types/structs right now... there sure are a lot for this struct.
0
 
jimstarAuthor Commented:
I've spent almost two hours copying structs and types from the websites into my code, and still have more undefined subtypes. I also can't #include <ntddk.h>, etc, because it keeps giving me redefinition problems between ntstatus.h and winnt.h, for example.

Do you know of any easier way to get that function working, than to copy each struct into my code manually? Perhaps I'm missing something easy. I've never tried to include DDK headers into a non-DDK project before.
0
 
jkrConnect With a Mentor Commented:
One trick is to add the DDK specific functions to their own namespace, e.g. using

namespace NT
{
extern "C"
    {
#pragma warning (   disable:    4005)
        #include <basetsd.h>
        #include <ntdef.h>
        #include <ntstatus.h>
        #include <wdm.h>
#pragma warning (   default:    4005)
    }

};

and then mapping the types in like

using NT::NTSTATUS;
using NT::UNICODE_STRING;
using NT::PUNICODE_STRING;
using NT::OBJECT_ATTRIBUTES;
0
 
jimstarAuthor Commented:
Appears to have cleared up except for PSINGLE_LIST_ENTRY problems. Still playing with it... if you have any ideas please let me know.

from ntddk.h:
        InterlockedPushEntrySList(&Lookaside->L.ListHead,
                                  (PSLIST_ENTRY)Entry);

1>c:\winddk\3790.1830\inc\ddk\wxp\ntddk.h(12783) : error C2664: 'InterlockedPushEntrySList' : cannot convert parameter 2 from 'NT::PSINGLE_LIST_ENTRY' to 'PSINGLE_LIST_ENTRY'
1>        Types pointed to are unrelated; conversion requires reinterpret_cast, C-style cast or function-style cast
1>c:\winddk\3790.1830\inc\ddk\wxp\ntddk.h(12932) : error C2664: 'InterlockedPushEntrySList' : cannot convert parameter 2 from 'NT::PSINGLE_LIST_ENTRY' to 'PSINGLE_LIST_ENTRY'
1>        Types pointed to are unrelated; conversion requires reinterpret_cast, C-style cast or function-style cast
.....
1>c:\winddk\3790.1830\inc\ddk\wxp\ntddk.h(12783) : error C2664: 'InterlockedPushEntrySList' : cannot convert parameter 2 from 'NT::PSINGLE_LIST_ENTRY' to 'PSINGLE_LIST_ENTRY'
1>        Types pointed to are unrelated; conversion requires reinterpret_cast, C-style cast or function-style cast
1>c:\winddk\3790.1830\inc\ddk\wxp\ntddk.h(12932) : error C2664: 'InterlockedPushEntrySList' : cannot convert parameter 2 from 'NT::PSINGLE_LIST_ENTRY' to 'PSINGLE_LIST_ENTRY'
1>        Types pointed to are unrelated; conversion requires reinterpret_cast, C-style cast or function-style cast
0
 
jkrConnect With a Mentor Commented:
Have you tried using

#include <ndis.h>

before

#include <ntddk.h>

?
0
 
jimstarAuthor Commented:
I didn't have it before, but when I added it nothing changed.
0
 
jkrConnect With a Mentor Commented:
OK, another try befor using brute force: Add

using ::PSINGLE_LIST_ENTRY;

inside the namespace compound just before

#include <ntddk.h>
0
 
jimstarAuthor Commented:
That causes an additional error:

1>c:\<pathremoved>\<filenameremoved>.h(779) : error C2874: using-declaration causes a multiple declaration of 'PSINGLE_LIST_ENTRY'
1>        c:\winddk\3790.1830\inc\wxp\winnt.h(768) : see declaration of 'PSINGLE_LIST_ENTRY'
0
 
jimstarAuthor Commented:
If I comment out the ndis.h file, like this:

//#include <ndis.h>
using ::PSINGLE_LIST_ENTRY;
#include <ntddk.h>
#include <ntstatus.h>

Then, I only get the following error:

1>c:\winddk\3790.1830\inc\wxp\ntdef.h(1140) : error C2371: 'PSINGLE_LIST_ENTRY' : redefinition; different basic types
1>        c:\winddk\3790.1830\inc\wxp\winnt.h(768) : see declaration of 'PSINGLE_LIST_ENTRY'

Lines 1138-1140 are:

typedef struct _SINGLE_LIST_ENTRY {
    struct _SINGLE_LIST_ENTRY *Next;
} SINGLE_LIST_ENTRY, *PSINGLE_LIST_ENTRY;
0
 
jkrCommented:
Can you move all Windows-related headers after the namespace section?
0
 
jimstarAuthor Commented:
Moved windows.h after the NT namespace, which produced target archetecture unknown errors. Defining _X86_ caused way more errors. Putting basetsd.h, ntdef.h, and ndis.h at the beginning of the NT namespace helped, but the old PSINGLE_LIST_ENTRY errors were still there (along with some new undefined errors in the DDK includes).

0
 
jkrConnect With a Mentor Commented:
OK, so now for the brute force: Can you change the lineswith the error to read

        (::PSLIST_ENTRY)Entry

instead (make a backup copy for the file prior to that, of course)?
0
 
jimstarAuthor Commented:
Got rid of the errors. Not sure why using the DDK calls outside of the DDK build environment is so messy. Still have to get the calls working to grab the filename, but if I have trouble with that I'll post a different question. Thanks!
0
 
jkrCommented:
You're most welcome ;o)
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.