?
Solved

WDM/DDK defines for OBJECT_TYPE, etc

Posted on 2007-10-10
17
Medium Priority
?
699 Views
Last Modified: 2012-05-07
I'm trying to obtain a filename from an OBJECT_ATTRIBUTES struct.

I've copied the function prototype for ObReferenceObjectByHandle from http://www.osronline.com/ddkx/kmarch/k107_54qa.htm. I then obtained the OBJECT_ATTRIBUTES struct definition from http://msdn2.microsoft.com/en-us/library/aa491657.aspx.

However, even though MS gives the OBJECT_ATTRIBUTES definition on MSDN, they don't give its member OBJECT_TYPE. All they say is "OBJECT_TYPE is an opaque structure that specifies the object type of a handle" (http://msdn2.microsoft.com/en-us/library/aa491647.aspx).

Am I missing something? Shouldn't this be easier? I have the DDK installed but a grep doesn't reveal the definition for _OBJECT_TYPE in any of the files.

Can someone give me a hand in obtaining all of the definitions needed to convert the OBJECT_ATTRIBUTES over to a filename? Thanks.
0
Comment
Question by:jimstar
  • 9
  • 8
17 Comments
 
LVL 4

Author Comment

by:jimstar
ID: 20050192
typedef NTSTATUS (*ObReferenceObjectByHandle)(
    IN HANDLE  Handle,
    IN ACCESS_MASK  DesiredAccess,
    IN POBJECT_TYPE  ObjectType  OPTIONAL, <-- missing
    IN KPROCESSOR_MODE  AccessMode,   <-- missing
    OUT PVOID  *Object,
    OUT POBJECT_HANDLE_INFORMATION  HandleInformation  OPTIONAL <-- missing
    );

typedef struct _OBJECT_ATTRIBUTES {
    ULONG Length;
    HANDLE RootDirectory;
    PUNICODE_STRING ObjectName;
    ULONG Attributes;
    PVOID SecurityDescriptor;        // Points to type SECURITY_DESCRIPTOR
    PVOID SecurityQualityOfService;  // Points to type SECURITY_QUALITY_OF_SERVICE
} OBJECT_ATTRIBUTES;
typedef OBJECT_ATTRIBUTES *POBJECT_ATTRIBUTES;


Looks like I'm missing POBJECT_TYPE (_OBJECT_TYPE), KPROCESSOR_MODE (and the associated values), and POBJECT_HANDLE_INFORMATION (and the associated struct).
0
 
LVL 86

Accepted Solution

by:
jkr earned 2000 total points
ID: 20050314
You'll find the prototype at http://www.osronline.com/showThread.cfm?link=5703 and/or http://www.nirsoft.net/kernel_struct/vista/OBJECT_TYPE.html

"KPROCESSOR_MODE" is
ntddk.h:typedef CCHAR KPROCESSOR_MODE;

and OBJECT_HANDLE_INFORMATION is defined in ntddk.h also:

typedef struct _OBJECT_HANDLE_INFORMATION {
    ULONG HandleAttributes;
    ACCESS_MASK GrantedAccess;
} OBJECT_HANDLE_INFORMATION, *POBJECT_HANDLE_INFORMATION;
0
 
LVL 86

Assisted Solution

by:jkr
jkr earned 2000 total points
ID: 20050320
Oops, forgot 'OBJECT_TYPE'

typedef struct _OBJECT_TYPE
{
     ERESOURCE Mutex;
     LIST_ENTRY TypeList;
     UNICODE_STRING Name;
     PVOID DefaultObject;
     ULONG Index;
     ULONG TotalNumberOfObjects;
     ULONG TotalNumberOfHandles;
     ULONG HighWaterNumberOfObjects;
     ULONG HighWaterNumberOfHandles;
     OBJECT_TYPE_INITIALIZER TypeInfo;
     ULONG Key;
     EX_PUSH_LOCK ObjectLocks[32];
} OBJECT_TYPE, *POBJECT_TYPE;
0
VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

 
LVL 4

Author Comment

by:jimstar
ID: 20050368
Thanks - the nirsoft site is great, with hyperlinked object types. I'm working through all of the sub-types/structs right now... there sure are a lot for this struct.
0
 
LVL 4

Author Comment

by:jimstar
ID: 20051224
I've spent almost two hours copying structs and types from the websites into my code, and still have more undefined subtypes. I also can't #include <ntddk.h>, etc, because it keeps giving me redefinition problems between ntstatus.h and winnt.h, for example.

Do you know of any easier way to get that function working, than to copy each struct into my code manually? Perhaps I'm missing something easy. I've never tried to include DDK headers into a non-DDK project before.
0
 
LVL 86

Assisted Solution

by:jkr
jkr earned 2000 total points
ID: 20051297
One trick is to add the DDK specific functions to their own namespace, e.g. using

namespace NT
{
extern "C"
    {
#pragma warning (   disable:    4005)
        #include <basetsd.h>
        #include <ntdef.h>
        #include <ntstatus.h>
        #include <wdm.h>
#pragma warning (   default:    4005)
    }

};

and then mapping the types in like

using NT::NTSTATUS;
using NT::UNICODE_STRING;
using NT::PUNICODE_STRING;
using NT::OBJECT_ATTRIBUTES;
0
 
LVL 4

Author Comment

by:jimstar
ID: 20051567
Appears to have cleared up except for PSINGLE_LIST_ENTRY problems. Still playing with it... if you have any ideas please let me know.

from ntddk.h:
        InterlockedPushEntrySList(&Lookaside->L.ListHead,
                                  (PSLIST_ENTRY)Entry);

1>c:\winddk\3790.1830\inc\ddk\wxp\ntddk.h(12783) : error C2664: 'InterlockedPushEntrySList' : cannot convert parameter 2 from 'NT::PSINGLE_LIST_ENTRY' to 'PSINGLE_LIST_ENTRY'
1>        Types pointed to are unrelated; conversion requires reinterpret_cast, C-style cast or function-style cast
1>c:\winddk\3790.1830\inc\ddk\wxp\ntddk.h(12932) : error C2664: 'InterlockedPushEntrySList' : cannot convert parameter 2 from 'NT::PSINGLE_LIST_ENTRY' to 'PSINGLE_LIST_ENTRY'
1>        Types pointed to are unrelated; conversion requires reinterpret_cast, C-style cast or function-style cast
.....
1>c:\winddk\3790.1830\inc\ddk\wxp\ntddk.h(12783) : error C2664: 'InterlockedPushEntrySList' : cannot convert parameter 2 from 'NT::PSINGLE_LIST_ENTRY' to 'PSINGLE_LIST_ENTRY'
1>        Types pointed to are unrelated; conversion requires reinterpret_cast, C-style cast or function-style cast
1>c:\winddk\3790.1830\inc\ddk\wxp\ntddk.h(12932) : error C2664: 'InterlockedPushEntrySList' : cannot convert parameter 2 from 'NT::PSINGLE_LIST_ENTRY' to 'PSINGLE_LIST_ENTRY'
1>        Types pointed to are unrelated; conversion requires reinterpret_cast, C-style cast or function-style cast
0
 
LVL 86

Assisted Solution

by:jkr
jkr earned 2000 total points
ID: 20051662
Have you tried using

#include <ndis.h>

before

#include <ntddk.h>

?
0
 
LVL 4

Author Comment

by:jimstar
ID: 20051745
I didn't have it before, but when I added it nothing changed.
0
 
LVL 86

Assisted Solution

by:jkr
jkr earned 2000 total points
ID: 20051859
OK, another try befor using brute force: Add

using ::PSINGLE_LIST_ENTRY;

inside the namespace compound just before

#include <ntddk.h>
0
 
LVL 4

Author Comment

by:jimstar
ID: 20051939
That causes an additional error:

1>c:\<pathremoved>\<filenameremoved>.h(779) : error C2874: using-declaration causes a multiple declaration of 'PSINGLE_LIST_ENTRY'
1>        c:\winddk\3790.1830\inc\wxp\winnt.h(768) : see declaration of 'PSINGLE_LIST_ENTRY'
0
 
LVL 4

Author Comment

by:jimstar
ID: 20052001
If I comment out the ndis.h file, like this:

//#include <ndis.h>
using ::PSINGLE_LIST_ENTRY;
#include <ntddk.h>
#include <ntstatus.h>

Then, I only get the following error:

1>c:\winddk\3790.1830\inc\wxp\ntdef.h(1140) : error C2371: 'PSINGLE_LIST_ENTRY' : redefinition; different basic types
1>        c:\winddk\3790.1830\inc\wxp\winnt.h(768) : see declaration of 'PSINGLE_LIST_ENTRY'

Lines 1138-1140 are:

typedef struct _SINGLE_LIST_ENTRY {
    struct _SINGLE_LIST_ENTRY *Next;
} SINGLE_LIST_ENTRY, *PSINGLE_LIST_ENTRY;
0
 
LVL 86

Expert Comment

by:jkr
ID: 20052039
Can you move all Windows-related headers after the namespace section?
0
 
LVL 4

Author Comment

by:jimstar
ID: 20052164
Moved windows.h after the NT namespace, which produced target archetecture unknown errors. Defining _X86_ caused way more errors. Putting basetsd.h, ntdef.h, and ndis.h at the beginning of the NT namespace helped, but the old PSINGLE_LIST_ENTRY errors were still there (along with some new undefined errors in the DDK includes).

0
 
LVL 86

Assisted Solution

by:jkr
jkr earned 2000 total points
ID: 20052206
OK, so now for the brute force: Can you change the lineswith the error to read

        (::PSLIST_ENTRY)Entry

instead (make a backup copy for the file prior to that, of course)?
0
 
LVL 4

Author Comment

by:jimstar
ID: 20052271
Got rid of the errors. Not sure why using the DDK calls outside of the DDK build environment is so messy. Still have to get the calls working to grab the filename, but if I have trouble with that I'll post a different question. Thanks!
0
 
LVL 86

Expert Comment

by:jkr
ID: 20052358
You're most welcome ;o)
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Basic understanding on "OO- Object Orientation" is needed for designing a logical solution to solve a problem. Basic OOAD is a prerequisite for a coder to ensure that they follow the basic design of OO. This would help developers to understand the b…
Examines three attack vectors, specifically, the different types of malware used in malicious attacks, web application attacks, and finally, network based attacks.  Concludes by examining the means of securing and protecting critical systems and inf…
Video by: Grant
The goal of this video is to provide viewers with basic examples to understand and use nested-loops in the C programming language.
The goal of the video will be to teach the user the concept of local variables and scope. An example of a locally defined variable will be given as well as an explanation of what scope is in C++. The local variable and concept of scope will be relat…
Suggested Courses

862 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question