obquery.c File Reference

#include "obp.h"

Go to the source code of this file.

Classes
struct	__OBP_SET_HANDLE_ATTRIBUTES
Defines
#define	OBP_MISSING_NAME_LITERAL   L"..."
#define	OBP_MISSING_NAME_LITERAL_SIZE   (sizeof( OBP_MISSING_NAME_LITERAL ) - sizeof( UNICODE_NULL ))
Typedefs
typedef __OBP_SET_HANDLE_ATTRIBUTES	OBP_SET_HANDLE_ATTRIBUTES
typedef __OBP_SET_HANDLE_ATTRIBUTES *	POBP_SET_HANDLE_ATTRIBUTES
Functions
BOOLEAN	ObpSetHandleAttributes (IN OUT PVOID TableEntry, IN ULONG_PTR Parameter)
NTSTATUS	NtQueryObject (IN HANDLE Handle, IN OBJECT_INFORMATION_CLASS ObjectInformationClass, OUT PVOID ObjectInformation, IN ULONG ObjectInformationLength, OUT PULONG ReturnLength OPTIONAL)
NTSTATUS NTAPI	NtSetInformationObject (IN HANDLE Handle, IN OBJECT_INFORMATION_CLASS ObjectInformationClass, IN PVOID ObjectInformation, IN ULONG ObjectInformationLength)
NTSTATUS	ObQueryNameString (IN PVOID Object, OUT POBJECT_NAME_INFORMATION ObjectNameInfo, IN ULONG Length, OUT PULONG ReturnLength)
NTSTATUS	ObQueryTypeName (IN PVOID Object, PUNICODE_STRING ObjectTypeName, IN ULONG Length, OUT PULONG ReturnLength)
NTSTATUS	ObQueryTypeInfo (IN POBJECT_TYPE ObjectType, OUT POBJECT_TYPE_INFORMATION ObjectTypeInfo, IN ULONG Length, OUT PULONG ReturnLength)
NTSTATUS	ObQueryObjectAuditingByHandle (IN HANDLE Handle, OUT PBOOLEAN GenerateOnClose)
BOOLEAN	ObpSetHandleAttributes (IN OUT PHANDLE_TABLE_ENTRY ObjectTableEntry, IN ULONG_PTR Parameter)

---

Define Documentation

#define OBP_MISSING_NAME_LITERAL   L"..."

Definition at line 709 of file obquery.c. Referenced by ObQueryNameString().

#define OBP_MISSING_NAME_LITERAL_SIZE   (sizeof( OBP_MISSING_NAME_LITERAL ) - sizeof( UNICODE_NULL ))

Definition at line 710 of file obquery.c. Referenced by ObQueryNameString().

---

Typedef Documentation

typedef struct __OBP_SET_HANDLE_ATTRIBUTES OBP_SET_HANDLE_ATTRIBUTES

typedef struct __OBP_SET_HANDLE_ATTRIBUTES * POBP_SET_HANDLE_ATTRIBUTES

Referenced by ObpSetHandleAttributes().

---

Function Documentation

NTSTATUS NtQueryObject (  IN HANDLE  Handle, IN OBJECT_INFORMATION_CLASS  ObjectInformationClass, OUT PVOID  ObjectInformation, IN ULONG  ObjectInformationLength, OUT PULONG ReturnLength  OPTIONAL )

Definition at line 58 of file obquery.c. References ALIGN_UP, _OBJECT_HEADER_NAME_INFO::Directory, EXCEPTION_EXECUTE_HANDLER, FALSE, _OBJECT_HEADER::Flags, _OBJECT_HANDLE_INFORMATION::GrantedAccess, Handle, _OBJECT_HANDLE_INFORMATION::HandleAttributes, _OBJECT_HEADER::HandleCount, KernelMode, KPROCESSOR_MODE, _OBJECT_TYPE::Name, _OBJECT_HEADER_NAME_INFO::Name, _OBJECT_HEADER_QUOTA_INFO::NonPagedPoolCharge, NT_SUCCESS, NTSTATUS(), NULL, OB_FLAG_EXCLUSIVE_OBJECT, OB_FLAG_PERMANENT_OBJECT, ObDereferenceObject, OBJ_PROTECT_CLOSE, OBJECT_HEADER_TO_NAME_INFO, OBJECT_HEADER_TO_QUOTA_INFO, OBJECT_TO_OBJECT_HEADER, OBP_MAX_DEFINED_OBJECT_TYPES, ObpAcquireDescriptorCacheReadLock(), ObpEnterRootDirectoryMutex, ObpLeaveRootDirectoryMutex, ObpObjectTypes, ObpReleaseDescriptorCacheLock(), ObpSymbolicLinkObjectType, ObQueryNameString(), ObQueryTypeInfo(), ObReferenceObjectByHandle(), PAGED_CODE, _OBJECT_HEADER_QUOTA_INFO::PagedPoolCharge, _OBJECT_HEADER::PointerCount, ProbeForWrite(), ProbeForWriteUlong, RtlLengthSecurityDescriptor(), _OBJECT_HEADER::SecurityDescriptor, Status, TRUE, and _OBJECT_HEADER::Type. Referenced by InitializeRestrictedStuff(), IopLoadDriver(), IsInterestingPath(), TestParent(), and xProtectHandle(). : This routine is used to query information about a given object Arguments: Handle - Supplies a handle to the object being queried. This value is ignored if the requested information class is for type information. ObjectInformationClass - Specifies the type of information to return ObjectInformation - Supplies an output buffer for the information being returned ObjectInformationLength - Specifies, in bytes, the length of the preceding object information buffer ReturnLength - Optionally receives the length, in bytes, used to store the object information Return Value: An appropriate status value --*/ { KPROCESSOR_MODE PreviousMode; NTSTATUS Status; PVOID Object; POBJECT_HEADER ObjectHeader; POBJECT_HEADER_QUOTA_INFO QuotaInfo; POBJECT_HEADER_NAME_INFO NameInfo; POBJECT_TYPE ObjectType; POBJECT_HEADER ObjectDirectoryHeader; POBJECT_DIRECTORY ObjectDirectory; ACCESS_MASK GrantedAccess; POBJECT_HANDLE_FLAG_INFORMATION HandleFlags; OBJECT_HANDLE_INFORMATION HandleInformation; ULONG NameInfoSize; ULONG SecurityDescriptorSize; ULONG TempReturnLength; OBJECT_BASIC_INFORMATION ObjectBasicInfo; POBJECT_TYPES_INFORMATION TypesInformation; POBJECT_TYPE_INFORMATION TypeInfo; ULONG i; PAGED_CODE(); // // Initialize our local variables // TempReturnLength = 0; // // Get previous processor mode and probe output argument if necessary. // PreviousMode = KeGetPreviousMode(); if (PreviousMode != KernelMode) { try { if (ObjectInformationClass != ObjectHandleFlagInformation) { ProbeForWrite( ObjectInformation, ObjectInformationLength, sizeof( ULONG )); } else { ProbeForWrite( ObjectInformation, ObjectInformationLength, 1 ); } // // We'll use a local temp return length variable to pass // through to the later ob query calls which will increment // its value. We can't pass the users return length directly // because the user might also be altering its value behind // our back. // if (ARGUMENT_PRESENT( ReturnLength )) { ProbeForWriteUlong( ReturnLength ); } } except( EXCEPTION_EXECUTE_HANDLER ) { return( GetExceptionCode() ); } } // // If the query is not for types information then we // will have to get the object in question. Otherwise // for types information there really isn't an object // to grab. // if (ObjectInformationClass != ObjectTypesInformation) { Status = ObReferenceObjectByHandle( Handle, 0, NULL, PreviousMode, &Object, &HandleInformation ); if (!NT_SUCCESS( Status )) { return( Status ); } GrantedAccess = HandleInformation.GrantedAccess; ObjectHeader = OBJECT_TO_OBJECT_HEADER( Object ); ObjectType = ObjectHeader->Type; } else { GrantedAccess = 0; Object = NULL; ObjectHeader = NULL; ObjectType = NULL; } // // Now process the particular information class being // requested // switch( ObjectInformationClass ) { case ObjectBasicInformation: // // Make sure the output buffer is long enough and then // fill in the appropriate fields into our local copy // of basic information. // if (ObjectInformationLength != sizeof( OBJECT_BASIC_INFORMATION )) { ObDereferenceObject( Object ); return( STATUS_INFO_LENGTH_MISMATCH ); } ObjectBasicInfo.Attributes = HandleInformation.HandleAttributes; if (ObjectHeader->Flags & OB_FLAG_PERMANENT_OBJECT) { ObjectBasicInfo.Attributes |= OBJ_PERMANENT; } if (ObjectHeader->Flags & OB_FLAG_EXCLUSIVE_OBJECT) { ObjectBasicInfo.Attributes |= OBJ_EXCLUSIVE; } ObjectBasicInfo.GrantedAccess = GrantedAccess; ObjectBasicInfo.HandleCount = ObjectHeader->HandleCount; ObjectBasicInfo.PointerCount = ObjectHeader->PointerCount; QuotaInfo = OBJECT_HEADER_TO_QUOTA_INFO( ObjectHeader ); if (QuotaInfo != NULL) { ObjectBasicInfo.PagedPoolCharge = QuotaInfo->PagedPoolCharge; ObjectBasicInfo.NonPagedPoolCharge = QuotaInfo->NonPagedPoolCharge; } else { ObjectBasicInfo.PagedPoolCharge = 0; ObjectBasicInfo.NonPagedPoolCharge = 0; } if (ObjectType == ObpSymbolicLinkObjectType) { ObjectBasicInfo.CreationTime = ((POBJECT_SYMBOLIC_LINK)Object)->CreationTime; } else { RtlZeroMemory( &ObjectBasicInfo.CreationTime, sizeof( ObjectBasicInfo.CreationTime )); } // // Compute the size of the object name string by taking its name plus // seperators and traversing up to the root adding each directories // name length plus seperators // NameInfo = OBJECT_HEADER_TO_NAME_INFO( ObjectHeader ); if ((NameInfo != NULL) && (NameInfo->Directory != NULL)) { ObpEnterRootDirectoryMutex(); ObjectDirectory = NameInfo->Directory; // // **** this "IF" is probably not needed because of the preceding // "IF" // if (ObjectDirectory) { NameInfoSize = sizeof( OBJ_NAME_PATH_SEPARATOR ) + NameInfo->Name.Length; while (ObjectDirectory) { ObjectDirectoryHeader = OBJECT_TO_OBJECT_HEADER( ObjectDirectory ); NameInfo = OBJECT_HEADER_TO_NAME_INFO( ObjectDirectoryHeader ); if ((NameInfo != NULL) && (NameInfo->Directory != NULL)) { NameInfoSize += sizeof( OBJ_NAME_PATH_SEPARATOR ) + NameInfo->Name.Length; ObjectDirectory = NameInfo->Directory; } else { break; } } NameInfoSize += sizeof( OBJECT_NAME_INFORMATION ) + sizeof( UNICODE_NULL ); } ObpLeaveRootDirectoryMutex(); } else { NameInfoSize = 0; } ObjectBasicInfo.NameInfoSize = NameInfoSize; ObjectBasicInfo.TypeInfoSize = ObjectType->Name.Length + sizeof( UNICODE_NULL ) + sizeof( OBJECT_TYPE_INFORMATION ); ObpAcquireDescriptorCacheReadLock(); if ((GrantedAccess & READ_CONTROL) && ARGUMENT_PRESENT( ObjectHeader->SecurityDescriptor )) { SecurityDescriptorSize = RtlLengthSecurityDescriptor( ObjectHeader->SecurityDescriptor); } else { SecurityDescriptorSize = 0; } ObpReleaseDescriptorCacheLock(); ObjectBasicInfo.SecurityDescriptorSize = SecurityDescriptorSize; // // Now that we've packaged up our local copy of basic info we need // to copy it into the output buffer and set the return // length // try { *(POBJECT_BASIC_INFORMATION) ObjectInformation = ObjectBasicInfo; TempReturnLength = ObjectInformationLength; } except( EXCEPTION_EXECUTE_HANDLER ) { // // Fall through, since we cannot undo what we have done. // } break; case ObjectNameInformation: // // Call a local worker routine // Status = ObQueryNameString( Object, (POBJECT_NAME_INFORMATION)ObjectInformation, ObjectInformationLength, &TempReturnLength ); break; case ObjectTypeInformation: // // Call a local worker routine // Status = ObQueryTypeInfo( ObjectType, (POBJECT_TYPE_INFORMATION)ObjectInformation, ObjectInformationLength, &TempReturnLength ); break; case ObjectTypesInformation: try { // // The first thing we do is set the return length to cover the // types info record. Later in each call to query type info // this value will be updated as necessary // TempReturnLength = sizeof( OBJECT_TYPES_INFORMATION ); // // Make sure there is enough room to hold the types info record // and if so then compute the number of defined types there are // TypesInformation = (POBJECT_TYPES_INFORMATION)ObjectInformation; if (ObjectInformationLength < sizeof( OBJECT_TYPES_INFORMATION ) ) { Status = STATUS_INFO_LENGTH_MISMATCH; } else { TypesInformation->NumberOfTypes = 0; for (i=0; i<OBP_MAX_DEFINED_OBJECT_TYPES; i++) { ObjectType = ObpObjectTypes[ i ]; if (ObjectType == NULL) { break; } TypesInformation->NumberOfTypes += 1; } } // // For each defined type we will query the type info for the // object type and adjust the TypeInfo pointer to the next // free spot // TypeInfo = (POBJECT_TYPE_INFORMATION)(TypesInformation + 1); for (i=0; i<OBP_MAX_DEFINED_OBJECT_TYPES; i++) { ObjectType = ObpObjectTypes[ i ]; if (ObjectType == NULL) { break; } Status = ObQueryTypeInfo( ObjectType, TypeInfo, ObjectInformationLength, &TempReturnLength ); if (NT_SUCCESS( Status )) { TypeInfo = (POBJECT_TYPE_INFORMATION) ((PCHAR)(TypeInfo+1) + ALIGN_UP( TypeInfo->TypeName.MaximumLength, ULONG )); } } } except( EXCEPTION_EXECUTE_HANDLER ) { Status = GetExceptionCode(); } break; case ObjectHandleFlagInformation: try { // // Set the amount of data we are going to return // TempReturnLength = sizeof(OBJECT_HANDLE_FLAG_INFORMATION); HandleFlags = (POBJECT_HANDLE_FLAG_INFORMATION)ObjectInformation; // // Make sure we have enough room for the query, and if so we'll // set the output based on the flags stored in the handle // if (ObjectInformationLength < sizeof( OBJECT_HANDLE_FLAG_INFORMATION)) { Status = STATUS_INFO_LENGTH_MISMATCH; } else { HandleFlags->Inherit = FALSE; if (HandleInformation.HandleAttributes & OBJ_INHERIT) { HandleFlags->Inherit = TRUE; } HandleFlags->ProtectFromClose = FALSE; if (HandleInformation.HandleAttributes & OBJ_PROTECT_CLOSE) { HandleFlags->ProtectFromClose = TRUE; } } } except( EXCEPTION_EXECUTE_HANDLER ) { Status = GetExceptionCode(); } break; default: // // To get to this point we must have had an object and the // information class is not defined, so we should dereference the // object and return to our user the bad status // ObDereferenceObject( Object ); return( STATUS_INVALID_INFO_CLASS ); } // // Now if the caller asked for a return length we'll set it from // our local copy // try { if (ARGUMENT_PRESENT( ReturnLength ) ) { *ReturnLength = TempReturnLength; } } except( EXCEPTION_EXECUTE_HANDLER ) { // // Fall through, since we cannot undo what we have done. // } // // In the end we can free the object if there was one and return // to our caller // if (Object != NULL) { ObDereferenceObject( Object ); } return( Status ); }

NTSTATUS NTAPI NtSetInformationObject (  IN HANDLE  Handle, IN OBJECT_INFORMATION_CLASS  ObjectInformationClass, IN PVOID  ObjectInformation, IN ULONG  ObjectInformationLength )

Definition at line 545 of file obquery.c. References ASSERT, DecodeKernelHandle, ExChangeHandle(), ExSystemExceptionFilter(), FALSE, Handle, IsKernelHandle, KernelMode, KeStackAttachProcess(), KeUnstackDetachProcess(), KPROCESSOR_MODE, NTSTATUS(), __OBP_SET_HANDLE_ATTRIBUTES::ObjectInformation, ObpGetObjectTable, ObpKernelHandleTable, ObpSetHandleAttributes(), PAGED_CODE, _EPROCESS::Pcb, __OBP_SET_HANDLE_ATTRIBUTES::PreviousMode, ProbeForRead, PsGetCurrentProcess, PsInitialSystemProcess, Status, and TRUE. Referenced by xProtectHandle(). : This routine is used to set handle information about a specified handle Arguments: Handle - Supplies the handle being modified ObjectInformationClass - Specifies the class of information being modified. The only accepted value is ObjectHandleFlagInformation ObjectInformation - Supplies the buffer containing the handle flag information structure ObjectInformationLength - Specifies the length, in bytes, of the object information buffer Return Value: An appropriate status value --*/ { OBP_SET_HANDLE_ATTRIBUTES CapturedInformation; HANDLE ObjectHandle; PVOID ObjectTable; KPROCESSOR_MODE PreviousMode; NTSTATUS Status; BOOLEAN AttachedToProcess = FALSE; KAPC_STATE ApcState; PAGED_CODE(); // // Check if the information class and information length are correct. // if (ObjectInformationClass != ObjectHandleFlagInformation) { return STATUS_INVALID_INFO_CLASS; } if (ObjectInformationLength != sizeof(OBJECT_HANDLE_FLAG_INFORMATION)) { return STATUS_INFO_LENGTH_MISMATCH; } // // Get previous processor mode and probe and capture the input // buffer // CapturedInformation.PreviousMode = KeGetPreviousMode(); try { if (CapturedInformation.PreviousMode != KernelMode) { ProbeForRead(ObjectInformation, ObjectInformationLength, 1); } CapturedInformation.ObjectInformation = *(POBJECT_HANDLE_FLAG_INFORMATION)ObjectInformation; } except(ExSystemExceptionFilter()) { return GetExceptionCode(); } #if 0 // // On checked builds, check that if the Kernel handle bit is set, // then we're coming from Kernel mode. We should probably fail the // call if bit set && !Kmode // if ((Handle != NtCurrentThread()) && (Handle != NtCurrentProcess())) { ASSERT((Handle < 0 ) ? (PreviousMode == KernelMode) : TRUE); } #endif // // Get the address of the object table for the current process. Or // get the system handle table if this is a kernel handle and we are // in kernel mode // if (IsKernelHandle( Handle, CapturedInformation.PreviousMode )) { // // Make the handle look like a regular handle // ObjectHandle = DecodeKernelHandle( Handle ); // // The global kernel handle table // ObjectTable = ObpKernelHandleTable; // // Go to the system process // if (PsGetCurrentProcess() != PsInitialSystemProcess) { KeStackAttachProcess (&PsInitialSystemProcess->Pcb, &ApcState); AttachedToProcess = TRUE; } } else { ObjectTable = ObpGetObjectTable(); ObjectHandle = Handle; } // // Make the change to the handle table entry. The callback // routine will do the actual change // if (ExChangeHandle( ObjectTable, ObjectHandle, ObpSetHandleAttributes, (ULONG_PTR)&CapturedInformation) ) { Status = STATUS_SUCCESS; } else { Status = STATUS_ACCESS_DENIED; } // // If we are attached to the system process then return // back to our caller // if (AttachedToProcess) { KeUnstackDetachProcess(&ApcState); AttachedToProcess = FALSE; } // // And return to our caller // return Status; }

BOOLEAN ObpSetHandleAttributes (  IN OUT PHANDLE_TABLE_ENTRY  ObjectTableEntry, IN ULONG_PTR  Parameter )

Definition at line 1469 of file obquery.c. References FALSE, _OBJECT_HEADER::Flags, _OBJECT_TYPE_INITIALIZER::InvalidAttributes, KernelMode, OB_FLAG_KERNEL_OBJECT, OBJ_HANDLE_ATTRIBUTES, OBJ_PROTECT_CLOSE, __OBP_SET_HANDLE_ATTRIBUTES::ObjectInformation, POBP_SET_HANDLE_ATTRIBUTES, __OBP_SET_HANDLE_ATTRIBUTES::PreviousMode, TRUE, _OBJECT_HEADER::Type, and _OBJECT_TYPE::TypeInfo. : This is the call back routine for the ExChangeHandle from NtSetInformationObject Arguments: ObjectTableEntry - Supplies a pointer to the object table entry being modified Parameter - Supplies a pointer to the OBJECT_HANDLE_FLAG_INFORMATION structure to set into the table entry Return Value: Returns TRUE if the operation is successful otherwise FALSE --*/ { POBP_SET_HANDLE_ATTRIBUTES ObjectInformation; POBJECT_HEADER ObjectHeader; ObjectInformation = (POBP_SET_HANDLE_ATTRIBUTES)Parameter; // // Get a pointer to the object type via the object header and if the // caller has asked for inherit but the object type says that inherit // is an invalid flag then return false // ObjectHeader = (POBJECT_HEADER)(((ULONG_PTR)(ObjectTableEntry->Object)) & ~OBJ_HANDLE_ATTRIBUTES); if ((ObjectInformation->ObjectInformation.Inherit) && ((ObjectHeader->Type->TypeInfo.InvalidAttributes & OBJ_INHERIT) != 0)) { return FALSE; } // // User mode cannot set the object attributes for kernel objects // if ((ObjectHeader->Flags & OB_FLAG_KERNEL_OBJECT) && (ObjectInformation->PreviousMode != KernelMode)) { return FALSE; } // // For each piece of information (inheriit and protect from close) that // is in the object information buffer we'll set or clear the bits in // the object table entry. The bits modified are the low order bits of // used to store the pointer to the object header. // if (ObjectInformation->ObjectInformation.Inherit) { ObjectTableEntry->ObAttributes |= OBJ_INHERIT; } else { ObjectTableEntry->ObAttributes &= ~OBJ_INHERIT; } if (ObjectInformation->ObjectInformation.ProtectFromClose) { ObjectTableEntry->ObAttributes |= OBJ_PROTECT_CLOSE; } else { ObjectTableEntry->ObAttributes &= ~OBJ_PROTECT_CLOSE; } // // And return to our caller // return TRUE; }

BOOLEAN ObpSetHandleAttributes (  IN OUT PVOID  TableEntry, IN ULONG_PTR  Parameter )

Referenced by NtSetInformationObject().

NTSTATUS ObQueryNameString (  IN PVOID  Object, OUT POBJECT_NAME_INFORMATION  ObjectNameInfo, IN ULONG  Length, OUT PULONG  ReturnLength )

Definition at line 713 of file obquery.c. References _OBJECT_HEADER_NAME_INFO::Directory, EXCEPTION_EXECUTE_HANDLER, _OBJECT_HEADER_NAME_INFO::Name, NTSTATUS(), NULL, OBJECT_HEADER_TO_NAME_INFO, OBJECT_TO_OBJECT_HEADER, OBP_MISSING_NAME_LITERAL, OBP_MISSING_NAME_LITERAL_SIZE, ObpBeginTypeSpecificCallOut, ObpEndTypeSpecificCallOut, ObpEnterRootDirectoryMutex, ObpLeaveRootDirectoryMutex, ObpRootDirectoryObject, PAGED_CODE, _OBJECT_TYPE_INITIALIZER::QueryNameProcedure, Status, String, _OBJECT_HEADER::Type, _OBJECT_TYPE::TypeInfo, and USHORT. Referenced by CcWriteBehind(), IoGetDeviceProperty(), IopBuildCmResourceList(), IopCaptureObjectName(), IopErrorLogThread(), IopQueryName(), IopRaiseHardError(), MmGetFileNameForSection(), NtQueryObject(), NtQueryVirtualMemory(), ObGetObjectInformation(), and SepQueryNameString(). : This routine processes a query of an object's name information Arguments: Object - Supplies the object being queried ObjectNameInfo - Supplies the buffer to store the name string information Length - Specifies the length, in bytes, of the original object name info buffer. ReturnLength - Contains the number of bytes already used up in the object name info. On return this receives an updated byte count. (Length minus ReturnLength) is really now many bytes are left in the output buffer. The buffer supplied to this call may actually be offset within the original users buffer Return Value: An appropriate status value --*/ { NTSTATUS Status; POBJECT_HEADER ObjectHeader; POBJECT_HEADER_NAME_INFO NameInfo; POBJECT_HEADER ObjectDirectoryHeader; POBJECT_DIRECTORY ObjectDirectory; ULONG NameInfoSize; PUNICODE_STRING String; PWCH StringBuffer; ULONG NameSize; PAGED_CODE(); // // Get the object header and name info record if it exists // ObjectHeader = OBJECT_TO_OBJECT_HEADER( Object ); NameInfo = OBJECT_HEADER_TO_NAME_INFO( ObjectHeader ); // // If the object type has a query name callback routine then // that is how we get the name // if (ObjectHeader->Type->TypeInfo.QueryNameProcedure != NULL) { try { KIRQL SaveIrql; ObpBeginTypeSpecificCallOut( SaveIrql ); ObpEndTypeSpecificCallOut( SaveIrql, "Query", ObjectHeader->Type, Object ); Status = (*ObjectHeader->Type->TypeInfo.QueryNameProcedure)( Object, (BOOLEAN)((NameInfo != NULL) && (NameInfo->Name.Length != 0)), ObjectNameInfo, Length, ReturnLength ); } except( EXCEPTION_EXECUTE_HANDLER ) { Status = GetExceptionCode(); } return( Status ); } // // Otherwise, the object type does not specify a query name // procedure so we get to do the work. The first thing // to check is if the object doesn't even have a name. If // object doesn't have a name then we'll return an empty name // info structure. // if ((NameInfo == NULL) || (NameInfo->Name.Buffer == NULL)) { // // Compute the length of our return buffer, set the output // if necessary and make sure the supplied buffer is large // enough // NameInfoSize = sizeof( OBJECT_NAME_INFORMATION ); try { *ReturnLength = NameInfoSize; } except( EXCEPTION_EXECUTE_HANDLER ) { return( GetExceptionCode() ); } if (Length < NameInfoSize) { return( STATUS_INFO_LENGTH_MISMATCH ); } // // Initialize the output buffer to be an empty string // and then return to our caller // try { ObjectNameInfo->Name.Length = 0; ObjectNameInfo->Name.MaximumLength = 0; ObjectNameInfo->Name.Buffer = NULL; } except( EXCEPTION_EXECUTE_HANDLER ) { // // Fall through, since we cannot undo what we have done. // // **** This should probably get the exception code and return // that value // } return( STATUS_SUCCESS ); } // // First lock the directory mutex to stop before we chase stuff down // ObpEnterRootDirectoryMutex(); try { // // The object does have a name but now see if this is // just the root directory object in which case the name size // is only the "\" character // if (Object == ObpRootDirectoryObject) { NameSize = sizeof( OBJ_NAME_PATH_SEPARATOR ); } else { // // The named object is not the root so for every directory // working out way up we'll add its size to the name keeping // track of "\" characters inbetween each component. We first // start with the object name itself and then move on to // the directories // ObjectDirectory = NameInfo->Directory; NameSize = sizeof( OBJ_NAME_PATH_SEPARATOR ) + NameInfo->Name.Length; // // While we are not at the root we'll keep moving up // while ((ObjectDirectory != ObpRootDirectoryObject) && (ObjectDirectory)) { // // Get the name information for this directory // ObjectDirectoryHeader = OBJECT_TO_OBJECT_HEADER( ObjectDirectory ); NameInfo = OBJECT_HEADER_TO_NAME_INFO( ObjectDirectoryHeader ); if ((NameInfo != NULL) && (NameInfo->Directory != NULL)) { // // This directory has a name so add it to the accomulated // size and move up the tree // NameSize += sizeof( OBJ_NAME_PATH_SEPARATOR ) + NameInfo->Name.Length; ObjectDirectory = NameInfo->Directory; } else { // // This directory does not have a name so we'll give it // the "..." name and stop the loop // NameSize += sizeof( OBJ_NAME_PATH_SEPARATOR ) + OBP_MISSING_NAME_LITERAL_SIZE; break; } } } // // At this point NameSize is the number of bytes we need to store the // name of the object from the root down. The total buffer size we are // going to need will include this size, plus object name information // structure, plus an ending null character // NameInfoSize = NameSize + sizeof( OBJECT_NAME_INFORMATION ) + sizeof( UNICODE_NULL ); // // Set the output size and make sure the supplied buffer is large enough // to hold the information // try { *ReturnLength = NameInfoSize; } except( EXCEPTION_EXECUTE_HANDLER ) { Status = GetExceptionCode(); leave; } if (Length < NameInfoSize) { Status = STATUS_INFO_LENGTH_MISMATCH; leave; } // // **** the following IF isn't necessary because name info size is // already guaranteed to be nonzero from about 23 lines above // if (NameInfoSize != 0) { // // Set the String buffer to point to the byte right after the // last byte in the output string. This following logic actually // fills in the buffer backwards working from the name back to the // root // StringBuffer = (PWCH)ObjectNameInfo; StringBuffer = (PWCH)((PCH)StringBuffer + NameInfoSize); NameInfo = OBJECT_HEADER_TO_NAME_INFO( ObjectHeader ); try { // // Terminate the string with a null and backup one unicode // character // *--StringBuffer = UNICODE_NULL; // // If the object in question is not the root directory // then we are going to put its name in the string buffer // When we finally reach the root directory we'll append on // the final "\" // if (Object != ObpRootDirectoryObject) { // // Add in the objects name // String = &NameInfo->Name; StringBuffer = (PWCH)((PCH)StringBuffer - String->Length); RtlMoveMemory( StringBuffer, String->Buffer, String->Length ); // // While we are not at the root directory we'll keep // moving up // ObjectDirectory = NameInfo->Directory; while ((ObjectDirectory != ObpRootDirectoryObject) && (ObjectDirectory)) { // // Get the name information for this directory // ObjectDirectoryHeader = OBJECT_TO_OBJECT_HEADER( ObjectDirectory ); NameInfo = OBJECT_HEADER_TO_NAME_INFO( ObjectDirectoryHeader ); // // Tack on the "\" between the last name we added and // this new name // *--StringBuffer = OBJ_NAME_PATH_SEPARATOR; // // Preappend the directory name, if it has one, and // move up to the next directory. // if ((NameInfo != NULL) && (NameInfo->Directory != NULL)) { String = &NameInfo->Name; StringBuffer = (PWCH)((PCH)StringBuffer - String->Length); RtlMoveMemory( StringBuffer, String->Buffer, String->Length ); ObjectDirectory = NameInfo->Directory; } else { // // The directory is nameless so use the "..." for // its name and break out of the loop // StringBuffer = (PWCH)((PCH)StringBuffer - OBP_MISSING_NAME_LITERAL_SIZE); RtlMoveMemory( StringBuffer, OBP_MISSING_NAME_LITERAL, OBP_MISSING_NAME_LITERAL_SIZE ); break; } } } // // Tack on the "\" for the root directory and then set the // output unicode string variable to have the right size // and point to the right spot. // *--StringBuffer = OBJ_NAME_PATH_SEPARATOR; ObjectNameInfo->Name.Length = (USHORT)NameSize; ObjectNameInfo->Name.MaximumLength = (USHORT)(NameSize+sizeof( UNICODE_NULL )); ObjectNameInfo->Name.Buffer = StringBuffer; } except( EXCEPTION_EXECUTE_HANDLER ) { // // Fall through, since we cannot undo what we have done. // // **** This should probably get the exception code and return // that value // } } Status = STATUS_SUCCESS; } finally { ObpLeaveRootDirectoryMutex(); } return Status; }

NTSTATUS ObQueryObjectAuditingByHandle (  IN HANDLE  Handle, OUT PBOOLEAN  GenerateOnClose )

Definition at line 1319 of file obquery.c. References ExMapHandleToPointer(), ExUnlockHandleTableEntry(), FALSE, Handle, KeEnterCriticalRegion, KeLeaveCriticalRegion, NTSTATUS(), NULL, _HANDLE_TABLE_ENTRY::ObAttributes, OBJ_AUDIT_OBJECT_CLOSE, ObpGetObjectTable, ObpValidateIrql, PAGED_CODE, Status, and TRUE. : This routine tells the caller if the indicated handle will generate an audit if it is closed Arguments: Handle - Supplies the handle being queried GenerateOnClose - Receives TRUE if the handle will generate an audit if closed and FALSE otherwise Return Value: An appropriate status value --*/ { PHANDLE_TABLE ObjectTable; PHANDLE_TABLE_ENTRY ObjectTableEntry; PVOID Object; ULONG CapturedGrantedAccess; ULONG CapturedAttributes; NTSTATUS Status; PAGED_CODE(); // // Protect ourselves from being interrupted while we hold a handle table // entry lock // KeEnterCriticalRegion(); try { ObpValidateIrql( "ObQueryObjectAuditingByHandle" ); // // For the current process we'll grab its object table and // then get the object table entry // ObjectTable = ObpGetObjectTable(); ObjectTableEntry = ExMapHandleToPointer( ObjectTable, Handle ); // // If we were given a valid handle we'll look at the attributes // stored in the object table entry to decide if we generate // an audit on close // if (ObjectTableEntry != NULL) { CapturedAttributes = ObjectTableEntry->ObAttributes; if (CapturedAttributes & OBJ_AUDIT_OBJECT_CLOSE) { *GenerateOnClose = TRUE; } else { *GenerateOnClose = FALSE; } ExUnlockHandleTableEntry( ObjectTable, ObjectTableEntry ); Status = STATUS_SUCCESS; } else { Status = STATUS_INVALID_HANDLE; } } finally { KeLeaveCriticalRegion(); } return Status; }

NTSTATUS ObQueryTypeInfo (  IN POBJECT_TYPE  ObjectType, OUT POBJECT_TYPE_INFORMATION  ObjectTypeInfo, IN ULONG  Length, OUT PULONG  ReturnLength )

Definition at line 1216 of file obquery.c. References ALIGN_UP, EXCEPTION_EXECUTE_HANDLER, NTSTATUS(), and Status. Referenced by NtQueryObject(). : This routine processes the query for object type information Arguments: Object - Supplies a pointer to the object type being queried ObjectTypeInfo - Supplies the buffer to store the type information Length - Specifies the length, in bytes, of the object type information buffer ReturnLength - Contains the number of bytes already used up in the object type information buffer. On return this receives an updated byte count (Length minus ReturnLength) is really now many bytes are left in the output buffer. The buffer supplied to this call may actually be offset within the original users buffer Return Value: An appropriate status value --*/ { NTSTATUS Status; try { // // The total number of bytes needed for this query includes the // object type information structure plus the name of the type // rounded up to a ulong boundary // *ReturnLength += sizeof( *ObjectTypeInfo ) + ALIGN_UP( ObjectType->Name.MaximumLength, ULONG ); // // Make sure the buffer is large enough for this information and // then fill in the record // if (Length < *ReturnLength) { Status = STATUS_INFO_LENGTH_MISMATCH; } else { ObjectTypeInfo->TotalNumberOfObjects = ObjectType->TotalNumberOfObjects; ObjectTypeInfo->TotalNumberOfHandles = ObjectType->TotalNumberOfHandles; ObjectTypeInfo->HighWaterNumberOfObjects = ObjectType->HighWaterNumberOfObjects; ObjectTypeInfo->HighWaterNumberOfHandles = ObjectType->HighWaterNumberOfHandles; ObjectTypeInfo->InvalidAttributes = ObjectType->TypeInfo.InvalidAttributes; ObjectTypeInfo->GenericMapping = ObjectType->TypeInfo.GenericMapping; ObjectTypeInfo->ValidAccessMask = ObjectType->TypeInfo.ValidAccessMask; ObjectTypeInfo->SecurityRequired = ObjectType->TypeInfo.SecurityRequired; ObjectTypeInfo->MaintainHandleCount = ObjectType->TypeInfo.MaintainHandleCount; ObjectTypeInfo->PoolType = ObjectType->TypeInfo.PoolType; ObjectTypeInfo->DefaultPagedPoolCharge = ObjectType->TypeInfo.DefaultPagedPoolCharge; ObjectTypeInfo->DefaultNonPagedPoolCharge = ObjectType->TypeInfo.DefaultNonPagedPoolCharge; // // The type name goes right after this structure. We cannot use // rtl routine like RtlCopyUnicodeString that might use the local // memory to keep state, because this is the user buffer and it // could be changing by user // ObjectTypeInfo->TypeName.Buffer = (PWSTR)(ObjectTypeInfo+1); ObjectTypeInfo->TypeName.Length = ObjectType->Name.Length; ObjectTypeInfo->TypeName.MaximumLength = ObjectType->Name.MaximumLength; RtlMoveMemory( (PWSTR)(ObjectTypeInfo+1), ObjectType->Name.Buffer, ObjectType->Name.Length ); ((PWSTR)(ObjectTypeInfo+1))[ ObjectType->Name.Length/sizeof(WCHAR) ] = UNICODE_NULL; Status = STATUS_SUCCESS; } } except( EXCEPTION_EXECUTE_HANDLER ) { Status = GetExceptionCode(); } return Status; }

NTSTATUS ObQueryTypeName (  IN PVOID  Object, PUNICODE_STRING  ObjectTypeName, IN ULONG  Length, OUT PULONG  ReturnLength )

Definition at line 1082 of file obquery.c. References EXCEPTION_EXECUTE_HANDLER, _OBJECT_TYPE::Name, OBJECT_TO_OBJECT_HEADER, PAGED_CODE, String, _OBJECT_HEADER::Type, and USHORT. Referenced by ObGetObjectInformation(), and SepQueryTypeString(). : This routine processes a query of an object's type name Arguments: Object - Supplies the object being queried ObjectTypeName - Supplies the buffer to store the type name string information Length - Specifies the length, in bytes, of the object type name buffer ReturnLength - Contains the number of bytes already used up in the object type name buffer. On return this receives an updated byte count (Length minus ReturnLength) is really now many bytes are left in the output buffer. The buffer supplied to this call may actually be offset within the original users buffer Return Value: An appropriate status value --*/ { POBJECT_TYPE ObjectType; POBJECT_HEADER ObjectHeader; ULONG TypeNameSize; PUNICODE_STRING String; PWCH StringBuffer; ULONG NameSize; PAGED_CODE(); // // From the object get its object type and from that get the size of // the object type name. The total size for we need for the output // buffer must fit the name, a terminating null, and a preceding // unicode string structure // ObjectHeader = OBJECT_TO_OBJECT_HEADER( Object ); ObjectType = ObjectHeader->Type; NameSize = ObjectType->Name.Length; TypeNameSize = NameSize + sizeof( UNICODE_NULL ) + sizeof( UNICODE_STRING ); // // Update the number of bytes we need and make sure the output buffer is // large enough // // **** to be consistent with all our callers and other routines in // this module this should probably be a "+=" and not just "=" // try { *ReturnLength = TypeNameSize; } except( EXCEPTION_EXECUTE_HANDLER ) { return( GetExceptionCode() ); } if (Length < TypeNameSize) { return( STATUS_INFO_LENGTH_MISMATCH ); } // // **** this IF is probably not needed because of the earlier computation // of type name size // if (TypeNameSize != 0) { // // Set string buffer to point to the one byte beyond the // buffer that we're going to fill in // StringBuffer = (PWCH)ObjectTypeName; StringBuffer = (PWCH)((PCH)StringBuffer + TypeNameSize); String = &ObjectType->Name; try { // // Tack on the terminating null character and copy over // the type name // *--StringBuffer = UNICODE_NULL; StringBuffer = (PWCH)((PCH)StringBuffer - String->Length); RtlMoveMemory( StringBuffer, String->Buffer, String->Length ); // // Now set the preceding unicode string to have the right // lengths and to point to this buffer // ObjectTypeName->Length = (USHORT)NameSize; ObjectTypeName->MaximumLength = (USHORT)(NameSize+sizeof( UNICODE_NULL )); ObjectTypeName->Buffer = StringBuffer; } except( EXCEPTION_EXECUTE_HANDLER ) { // // Fall through, since we cannot undo what we have done. // } } return( STATUS_SUCCESS ); }

---