A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #14824  by Vrtule
 Sun Jul 22, 2012 4:01 pm
Hello,

I have a problem to translate name of device object to address of the object. I know, that this service is, for device objects, provided by IoGetDeviceObjectPointer, however, I cannot use the routine because of other circumstances.

Hence I thought of ObReferenceObjectByName. The routine seems to work fine for various types of objects, except the devices. Even though I specfiy *IoDeviceObjectType which should be the object type for devices, I get STATUS_OBJECT_TYPE_MISMATCH error code.

Had someone more success with the ObReferenceObjectByName routine applied to device objects than me? I would appreciate any kind of help.

I know that I can use my own implementation of some Object Manager routines, however, I would prefer more "documented/legitimate" way to achieve my task.

Thanks in advance
 #14830  by Vrtule
 Mon Jul 23, 2012 8:21 am
Yes, my problem is nearly the same although I would be satisfied even with the pointer to the top device in the device stack. It seems that I will try to use the second method of those you suggested in the end of your post.
 #15265  by Vrtule
 Mon Aug 20, 2012 5:41 pm
@Tigzy:

Thanks for the link.

IoGetDeviceProperty returns information about the target device from the registry. I think I have found a sencence like this in the documentation. I am using ObQueryNameString to get the name of the device.