C++ ObReferenceObjectByHandle函数代码示例

		void Thread::Thread_init()
		{
			PsCreateSystemThreadEx(&system_thread_handle,	//Thread Handle
													   0,	//KernelStackSize
									   		  stack_size,	//Stack Size
									   				   0,	//TlsDataSize
									   		  		 &Id,	//Thread ID
									   		 		NULL,	//StartContext1
									   		 		NULL,	//StartContext2
									   		 		TRUE,	//CreateSuspended
									   			   FALSE,	//DebugStack
						   (PKSTART_ROUTINE)&callback);		//StartRoutine
						   
			ObReferenceObjectByHandle(system_thread_handle, (POBJECT_TYPE)PsThreadObjectType, &system_thread_handle);

			//#define LOW_PRIORITY                      0
			//#define LOW_REALTIME_PRIORITY             16
			//#define HIGH_PRIORITY                     31
			//#define MAXIMUM_PRIORITY                  32

			KeSetBasePriorityThread((PKTHREAD)system_thread_handle, (PVOID)0); //Default the thread to low priority
			
			state = ThreadState::Unstarted;
			
			Id++; //increment Id so every thread Id is unique
		}

timeout_id_t timeout(void (*func)(void *), void* unused, hrtime_t nano)
{
	struct timeout_func *to_func;
	OBJECT_ATTRIBUTES ObjectAttributes;
	NTSTATUS st;
	HANDLE thand;
	UNREFERENCED_PARAMETER(unused);
	
	InitializeObjectAttributes(&ObjectAttributes, NULL, OBJ_KERNEL_HANDLE, NULL, NULL);
	to_func = ExAllocatePoolWithTag(NonPagedPool, sizeof(struct timeout_func), 'Tag1');
	if (to_func == NULL)
		return (timeout_id_t) NULL;
	to_func->time = nano;
	to_func->f = func;
	KeInitializeTimer(&to_func->Timer);
	to_func->Thread = NULL;
	
	st = PsCreateSystemThread(&thand, THREAD_ALL_ACCESS, &ObjectAttributes, NULL, 
		NULL, FTTimeout, (PVOID) to_func);
	
	if (st == STATUS_SUCCESS) {
		/* To wait for the thread to terminate, you need the address of the
		underlying KTHREAD object instead of the handle you get back from PsCreateSystemThread */
		ObReferenceObjectByHandle(thand, THREAD_ALL_ACCESS, NULL, KernelMode, 
			(PVOID*)&to_func->Thread, NULL);
		/* Dont need the handle once we have the address of the KTHREAD */
		ZwClose(thand);
	} else
		dprintf("fasttrap.sys: timeout() Thread creationfailed\n");

	return (timeout_id_t) to_func->Thread;
}

NTSTATUS FASTCALL
IntValidateWindowStationHandle(
   HWINSTA WindowStation,
   KPROCESSOR_MODE AccessMode,
   ACCESS_MASK DesiredAccess,
   PWINSTATION_OBJECT *Object)
{
   NTSTATUS Status;

   if (WindowStation == NULL)
   {
      ERR("Invalid window station handle\n");
      EngSetLastError(ERROR_INVALID_HANDLE);
      return STATUS_INVALID_HANDLE;
   }

   Status = ObReferenceObjectByHandle(
               WindowStation,
               DesiredAccess,
               ExWindowStationObjectType,
               AccessMode,
               (PVOID*)Object,
               NULL);

   if (!NT_SUCCESS(Status))
      SetLastNtError(Status);

   return Status;
}

NTSTATUS HelloDDKRead(IN PDEVICE_OBJECT pDevObj,
								 IN PIRP pIrp) 
{
	KdPrint(("DriverB:Enter B HelloDDKRead\n"));
	NTSTATUS ntStatus = STATUS_SUCCESS;

	UNICODE_STRING DeviceName;
	RtlInitUnicodeString( &DeviceName, L"\\Device\\MyDDKDeviceA" );

	//初始化objectAttributes
	OBJECT_ATTRIBUTES objectAttributes;
	InitializeObjectAttributes(&objectAttributes, 
							&DeviceName,
							OBJ_CASE_INSENSITIVE, 
							NULL, 
							NULL );

	HANDLE hDevice;
	IO_STATUS_BLOCK status_block;
	
	//异步打开设备
	ntStatus = ZwCreateFile(&hDevice,
		FILE_READ_ATTRIBUTES,//没有设SYNCHRONIZE
		&objectAttributes,
		&status_block,
		NULL,FILE_ATTRIBUTE_NORMAL,FILE_SHARE_READ,
		FILE_OPEN_IF,0,NULL,0);

	LARGE_INTEGER offset = RtlConvertLongToLargeInteger(0);
	if (NT_SUCCESS(ntStatus))
	{
		ntStatus = ZwReadFile(hDevice,NULL,NULL,NULL,&status_block,NULL,0,&offset,NULL);
	}

	if (ntStatus==STATUS_PENDING)
	{
		KdPrint(("DriverB:ZwReadFile return STATUS_PENDING!\n"));

		PFILE_OBJECT FileObject;
		ntStatus = ObReferenceObjectByHandle(hDevice, EVENT_MODIFY_STATE, *ExEventObjectType,
						KernelMode, (PVOID*) &FileObject, NULL);
		if (NT_SUCCESS(ntStatus))
		{
			KdPrint(("DriverB:Waiting..."));
			KeWaitForSingleObject(&FileObject->Event,Executive,KernelMode,FALSE,NULL);
			KdPrint(("DriverB:Driver A Read IRP completed now!\n"));
			ObDereferenceObject(FileObject);
		}
	}
	ZwClose(hDevice);

	ntStatus = STATUS_SUCCESS;
	// 完成IRP
	pIrp->IoStatus.Status = ntStatus;
	pIrp->IoStatus.Information = 0;	// bytes xfered
	IoCompleteRequest( pIrp, IO_NO_INCREMENT );
	KdPrint(("DriverB:Leave B HelloDDKRead\n"));
	return ntStatus;
}

		void Thread::SetPriority(int priority)
		{
			if((priority != 0) && (priority != 16) && (priority != 31) && (priority != 32))
				return; //no valid values
				
			ObReferenceObjectByHandle(system_thread_handle, (POBJECT_TYPE)PsThreadObjectType, &system_thread_handle);
			KeSetBasePriorityThread((PKTHREAD)system_thread_handle, (PVOID)priority);
		}

NTSTATUS
NTAPI
Pin_fnWrite(
    PDEVICE_OBJECT DeviceObject,
    PIRP Irp)
{
    PDISPATCH_CONTEXT Context;
    PIO_STACK_LOCATION IoStack;
    PFILE_OBJECT FileObject;
    NTSTATUS Status;

    /* Get current stack location */
    IoStack = IoGetCurrentIrpStackLocation(Irp);

    /* The dispatch context is stored in the FsContext member */
    Context = (PDISPATCH_CONTEXT)IoStack->FileObject->FsContext;

    /* Sanity check */
    ASSERT(Context);

    if (Context->hMixerPin)
    {
        // FIXME
        // call kmixer to convert stream
        UNIMPLEMENTED
    }

    /* acquire real pin file object */
    Status = ObReferenceObjectByHandle(Context->Handle, GENERIC_WRITE, *IoFileObjectType, KernelMode, (PVOID*)&FileObject, NULL);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("failed\n");
        Irp->IoStatus.Information = 0;
        Irp->IoStatus.Status = Status;
        /* Complete the irp */
        IoCompleteRequest(Irp, IO_NO_INCREMENT);
        return Status;
    }

    /* skip current irp location */
    IoSkipCurrentIrpStackLocation(Irp);

    /* get next stack location */
    IoStack = IoGetNextIrpStackLocation(Irp);
    /* store file object of next device object */
    IoStack->FileObject = FileObject;
    IoStack->MajorFunction = IRP_MJ_DEVICE_CONTROL;
    //ASSERT(Irp->AssociatedIrp.SystemBuffer);

    /* now call the driver */
    Status = IoCallDriver(IoGetRelatedDeviceObject(FileObject), Irp);

    /* dereference file object */
    ObDereferenceObject(FileObject);

    return Status;

}

VOID TunerScanWorkItem(IN PDEVICE_OBJECT DeviceObject,IN PVOID Context)
{
    HANDLE           handle;
    NTSTATUS          WaitStatus;

    UNREFERENCED_PARAMETER(DeviceObject); 

    PEventHandlerData EventBlock= static_cast<PEventHandlerData>( Context);

    DbgPrint("MY-Event::TunerScanWorkItem");

    OBJECT_ATTRIBUTES oa;
    InitializeObjectAttributes(&oa, NULL, OBJ_KERNEL_HANDLE, NULL, NULL);

    if (STATUS_SUCCESS != PsCreateSystemThread(&handle, THREAD_ALL_ACCESS, &oa, NULL, NULL, ScanThread, EventBlock))
    {
        return;
    }

    ObReferenceObjectByHandle(handle, THREAD_ALL_ACCESS, NULL,
        KernelMode, (PVOID*) &EventBlock->thread, NULL);

    KeSetEvent(&(EventBlock->InitEvent), 0,FALSE);
    ZwClose(handle);
    do
    {
        WaitStatus = KeWaitForSingleObject(&(EventBlock->TuneEvent),
	        Executive,
	        KernelMode,
	        FALSE,
	        NULL);
        if (!NT_SUCCESS(WaitStatus)) {
	        break;
        }
        if(EventBlock->bStopScan)
        {
	        StopPollingThread();
	        KsGenerateEvent(EventBlock->EventEntry);//fire an Event to the app that we are stopped
	        break;
        }
        CEncoderDevice* EncDevice = EventBlock->pDevice;
        EncDevice->CurrentFrequency = EventBlock->CurrentFrequency;

        KeClearEvent(&(EventBlock->TuneEvent));
        DbgPrint( "MY-TunerScanWorkItem : Firing an event from driver to the app\n");
        KsGenerateEvent(EventBlock->EventEntry);

#pragma warning(push)
#pragma warning(disable:4127)
    }while(1);
#pragma warning (pop)
    DbgPrint( "MY-TunerScanWorkItem terminating\n");
    IoFreeWorkItem(EventHandler->ThreadItem); // Release Work Item
    EventHandler->EventEntry = NULL;
    ExFreePoolWithTag(EventHandler, MS_SAMPLE_ANALOG_POOL_TAG);
    EventHandler = NULL;
}

NTSTATUS NewZwMapViewOfSection(
			       HANDLE SectionHandle,
			       HANDLE  ProcessHandle,
			       PVOID  *BaseAddress,
			       ULONG  ZeroBits,
			       ULONG  CommitSize,
			       PLARGE_INTEGER  SectionOffset,
			       PSIZE_T  ViewSize,
			       SECTION_INHERIT  InheritDisposition,
			       ULONG  AllocationType,
			       ULONG  Protect
			       ) {
  NTSTATUS status;
#ifdef DEBUG
  NTSTATUS rtn;
  PVOID Object;
  WCHAR buf[1024];

  rtn=
    ObReferenceObjectByHandle(SectionHandle,
			      0,
			      0,
			      KernelMode,
			      &Object,
			      NULL);
    
  if (rtn==STATUS_SUCCESS) {
    int bytes;
    rtn=ObQueryNameString(Object,
			  (PUNICODE_STRING)buf,
			  sizeof(buf),
			  &bytes);
    ObDereferenceObject(Object);
    if (rtn==STATUS_SUCCESS) {
      WCHAR *p = ((PUNICODE_STRING)buf)->Buffer;
      debugOutput(L"MapViewOfSection ");
      debugOutput(p);

      if ((Protect&PAGE_READWRITE) || 
	  (Protect&PAGE_EXECUTE_READWRITE)) {
	swprintf(buf,L" protect: 0x%lx\n", Protect);
	debugOutput(buf);
      }
      debugOutput(L"\n");
    }
  }
#endif

  status = (OldZwMapViewOfSection)(SectionHandle, ProcessHandle,
				   BaseAddress, ZeroBits,
				   CommitSize, SectionOffset,
				   ViewSize, InheritDisposition,
				   AllocationType,
				   Protect);
  return status;
}

NTSTATUS
OobEditInit(
   _Out_ STREAM_EDITOR* streamEditor
   )
{
   NTSTATUS status = STATUS_SUCCESS;

   HANDLE threadHandle;
   
   streamEditor->editInline = FALSE;

   KeInitializeSpinLock(&streamEditor->oobEditInfo.editLock);   

   KeInitializeEvent(
      &streamEditor->oobEditInfo.editEvent,
      NotificationEvent,
      FALSE
      );

  streamEditor->oobEditInfo.busyThreshold = 32 * 1024;
  streamEditor->oobEditInfo.editState = OOB_EDIT_IDLE;

  InitializeListHead(&streamEditor->oobEditInfo.outgoingDataQueue);


   status = PsCreateSystemThread(
               &threadHandle,
               THREAD_ALL_ACCESS,
               NULL,
               NULL,
               NULL,
               StreamOobEditWorker,
               &gStreamEditor
               );

   if (!NT_SUCCESS(status))
   {
      goto Exit;
   }

   status = ObReferenceObjectByHandle(
               threadHandle,
               0,
               NULL,
               KernelMode,
               &gThreadObj,
               NULL
               );
   NT_ASSERT(NT_SUCCESS(status));

   ZwClose(threadHandle);

Exit:

   return status;
}

NTSTATUS
NTAPI
NtQueryInformationPort(
    IN HANDLE PortHandle OPTIONAL,
    IN PORT_INFORMATION_CLASS PortInformationClass,
    OUT PVOID PortInformation,
    IN ULONG Length,
    OUT PULONG ReturnLength OPTIONAL
    )
{
    KPROCESSOR_MODE PreviousMode;
    NTSTATUS Status;
    PLPCP_PORT_OBJECT PortObject;

    PAGED_CODE();

    //
    // Get previous processor mode and probe output argument if necessary.
    //

    PreviousMode = KeGetPreviousMode();
    if (PreviousMode != KernelMode) {
        try {
            ProbeForWrite( PortInformation,
                           Length,
                           sizeof( ULONG )
                         );

            if (ARGUMENT_PRESENT( ReturnLength )) {
                ProbeForWriteUlong( ReturnLength );
                }
            }
        except( EXCEPTION_EXECUTE_HANDLER ) {
            return( GetExceptionCode() );
            }
        }

    if (ARGUMENT_PRESENT( PortHandle )) {
        Status = ObReferenceObjectByHandle( PortHandle,
                                            GENERIC_READ,
                                            LpcPortObjectType,
                                            PreviousMode,
                                            &PortObject,
                                            NULL
                                          );
        if (!NT_SUCCESS( Status )) {
            return( Status );
            }

        ObDereferenceObject( PortObject );
        return STATUS_SUCCESS;
        }
    else {
        return STATUS_INVALID_INFO_CLASS;
        }
}

EXTERN_C static NTSTATUS ScvnpWriteFile(_In_ PCFLT_RELATED_OBJECTS FltObjects,
                                        _In_ const wchar_t *OutPathW,
                                        _In_ void *Buffer,
                                        _In_ ULONG BufferSize,
                                        _In_ ULONG CreateDisposition) {
  PAGED_CODE();

  UNICODE_STRING outPath = {};
  RtlInitUnicodeString(&outPath, OutPathW);
  OBJECT_ATTRIBUTES objAttr = RTL_INIT_OBJECT_ATTRIBUTES(
      &outPath, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE);

  HANDLE fileHandle = nullptr;
  IO_STATUS_BLOCK ioStatus = {};
  auto status = FltCreateFile(
      FltObjects->Filter, FltObjects->Instance, &fileHandle, GENERIC_WRITE,
      &objAttr, &ioStatus, nullptr, FILE_ATTRIBUTE_NORMAL, 0, CreateDisposition,
      FILE_SEQUENTIAL_ONLY | FILE_SYNCHRONOUS_IO_NONALERT |
          FILE_NON_DIRECTORY_FILE,
      nullptr, 0, 0);
  if (status == STATUS_OBJECT_NAME_COLLISION ||
      status == STATUS_DELETE_PENDING) {
    return status;
  }
  if (!NT_SUCCESS(status)) {
    LOG_ERROR_SAFE("FltCreateFile failed (%08x) for %S", status, OutPathW);
    return status;
  }

  PFILE_OBJECT fileObject = nullptr;
  status = ObReferenceObjectByHandle(fileHandle, 0, nullptr, KernelMode,
                                     reinterpret_cast<void **>(&fileObject),
                                     nullptr);
  if (!NT_SUCCESS(status)) {
    LOG_ERROR_SAFE("ObReferenceObjectByHandle failed (%08x) for %S", status,
                   OutPathW);
    goto End;
  }

  status = FltWriteFile(FltObjects->Instance, fileObject, nullptr, BufferSize,
                        Buffer, 0, nullptr, nullptr, nullptr);
  if (!NT_SUCCESS(status)) {
    LOG_ERROR_SAFE("FltWriteFile failed (%08x) for %S", status, OutPathW);
    goto End;
  }

End:
  if (fileObject) {
    ObDereferenceObject(fileObject);
  }
  if (fileHandle) {
    FltClose(fileHandle);
  }
  return status;
}

NTSTATUS
NtClearEvent (
    __in HANDLE EventHandle
    )

/*++

Routine Description:

    This function sets an event object to a Not-Signaled state.

Arguments:

    EventHandle - Supplies a handle to an event object.

Return Value:

    NTSTATUS.

--*/

{

    PVOID Event;
    NTSTATUS Status;

    //
    // Reference event object by handle.
    //

    Status = ObReferenceObjectByHandle(EventHandle,
                                       EVENT_MODIFY_STATE,
                                       ExEventObjectType,
                                       KeGetPreviousMode(),
                                       &Event,
                                       NULL);

    //
    // If the reference was successful, then set the state of the event
    // object to Not-Signaled and dereference event object.
    //

    if (NT_SUCCESS(Status)) {
        PERFINFO_DECLARE_OBJECT(Event);
        KeClearEvent((PKEVENT)Event);
        ObDereferenceObject(Event);
    }

    //
    // Return service status.
    //

    return Status;
}

//Hook 后的新函数
NTSTATUS
NewZwCreateFile(
    OUT PHANDLE  FileHandle,
    IN ACCESS_MASK  DesiredAccess,
    IN POBJECT_ATTRIBUTES  ObjectAttributes,
    OUT PIO_STATUS_BLOCK  IoStatusBlock,
    IN PLARGE_INTEGER  AllocationSize  OPTIONAL,
    IN ULONG  FileAttributes,
    IN ULONG  ShareAccess,
    IN ULONG  CreateDisposition,
    IN ULONG  CreateOptions,
    IN PVOID  EaBuffer  OPTIONAL,
    IN ULONG  EaLength
)
{
    NTSTATUS ntStatus = STATUS_SUCCESS;
    PFILE_OBJECT file;
    OBJECT_HANDLE_INFORMATION info;

    //调用原函数
    ntStatus = OldZwCreateFile(
                   FileHandle,
                   DesiredAccess,
                   ObjectAttributes,
                   IoStatusBlock,
                   AllocationSize,
                   FileAttributes,
                   ShareAccess,
                   CreateDisposition,
                   CreateOptions,
                   EaBuffer,
                   EaLength
               );

    DbgPrint("SSDT: ZwCreateFile Invoked (%u) !", ulCount++);

    /////////////////////// 通过 Handle 得到文件名
    ObReferenceObjectByHandle(ObjectAttributes->RootDirectory, 0, 0, \
                              KernelMode, &file, &info );
    DbgPrint("SSDT: FileHandle %08X", FileHandle);
    if(file)
    {
        DbgPrint("SSDT: FileName = %ws%ws", \
                 file->FileName, ObjectAttributes->ObjectName->Buffer);

        ObDereferenceObject(file);	//减少引用计数
    }
    else
    {
        DbgPrint("SSDT: FileName = %ws",ObjectAttributes->ObjectName->Buffer);
    }

    return ntStatus;
}

NTSTATUS
NTAPI
Pin_fnDeviceIoControl(
    PDEVICE_OBJECT DeviceObject,
    PIRP Irp)
{
    PDISPATCH_CONTEXT Context;
    NTSTATUS Status;
    ULONG BytesReturned;
    PFILE_OBJECT FileObject = NULL;
    PIO_STACK_LOCATION IoStack;

    DPRINT("Pin_fnDeviceIoControl called DeviceObject %p Irp %p\n", DeviceObject, Irp);

    /* Get current stack location */
    IoStack = IoGetCurrentIrpStackLocation(Irp);

    /* The dispatch context is stored in the FsContext member */
    Context = (PDISPATCH_CONTEXT)IoStack->FileObject->FsContext;

    /* Sanity check */
    ASSERT(Context);

    /* acquire real pin file object */
    Status = ObReferenceObjectByHandle(Context->Handle, GENERIC_WRITE, *IoFileObjectType, KernelMode, (PVOID*)&FileObject, NULL);
    if (!NT_SUCCESS(Status))
    {
        Irp->IoStatus.Information = 0;
        Irp->IoStatus.Status = Status;
        /* Complete the irp */
        IoCompleteRequest(Irp, IO_NO_INCREMENT);
        return Status;
    }

    /* Re-dispatch the request to the real target pin */
    Status = KsSynchronousIoControlDevice(FileObject, KernelMode, IoStack->Parameters.DeviceIoControl.IoControlCode,
                                          IoStack->Parameters.DeviceIoControl.Type3InputBuffer,
                                          IoStack->Parameters.DeviceIoControl.InputBufferLength,
                                          Irp->UserBuffer,
                                          IoStack->Parameters.DeviceIoControl.OutputBufferLength,
                                          &BytesReturned);
    /* release file object */
    ObDereferenceObject(FileObject);

    /* Save status and information */
    Irp->IoStatus.Information = BytesReturned;
    Irp->IoStatus.Status = Status;
    /* Complete the irp */
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    /* Done */
    return Status;
}

BOOLEAN
xixfs_NetEvtTerminate(PNETEVTCTX	NetEvtCtx) {
	VOID			*ThreadObject ;	
	LARGE_INTEGER	TimeOut ;
	NTSTATUS		ntStatus ;

	PAGED_CODE();
	DebugTrace(DEBUG_LEVEL_TRACE, DEBUG_TARGET_HOSTCOM,
		("Exit xixfs_NetEvtTerminate \n"));

	ASSERT(KeGetCurrentIrql() <= PASSIVE_LEVEL) ;

	KeSetEvent(&NetEvtCtx->ShutdownEvent, IO_NO_INCREMENT, FALSE) ;
	ntStatus = ObReferenceObjectByHandle(
			NetEvtCtx->HThread,
			FILE_READ_DATA,
			NULL,
			KernelMode,
			&ThreadObject,
			NULL
		) ;
	if(!NT_SUCCESS(ntStatus)) {
		DebugTrace(DEBUG_LEVEL_ERROR, DEBUG_TARGET_ALL, 
			( "[LFS] xixfs_NetEvtTerminate: referencing to the thread object failed\n")) ;
		goto out ;
	}

	TimeOut.QuadPart = - 20 * 10000 ;		// 20 sec
	ntStatus = KeWaitForSingleObject(
			ThreadObject,
			Executive,
			KernelMode,
			FALSE,
			&TimeOut
		) ;
	if(!NT_SUCCESS(ntStatus)) {
		DebugTrace(DEBUG_LEVEL_ERROR, DEBUG_TARGET_ALL, 
			( "[LFS] xixfs_NetEvtTerminate: waiting for the thread failed\n")) ;
	}

	ObDereferenceObject(ThreadObject) ;

	DebugTrace(DEBUG_LEVEL_INFO, DEBUG_TARGET_HOSTCOM,
		( "[LFS] xixfs_NetEvtTerminate: Shut down successfully.\n")) ;


out:
	DebugTrace(DEBUG_LEVEL_TRACE, DEBUG_TARGET_HOSTCOM,
		("Exit xixfs_NetEvtTerminate \n"));

	return TRUE ;
}