Hello
I'm trying to Enum loaded Drivers, and their Devices.
For Drivers, no problem. I'm trying to get the devices by walking throught the DRIVER_OBJECT struct (DeviceObject and then NextDevice from DEVICE_OBJECT)
To get the device name, I'm using IoGetDeviceProperty with DevicePropertyPhysicalDeviceObjectName value.
The problem is weird, cause sometimes it works, but sometimes not. But the device is always at the good value (verified with DeviceTree)
Here's my code
And what I'm getting in DbgView
I'm trying to Enum loaded Drivers, and their Devices.
For Drivers, no problem. I'm trying to get the devices by walking throught the DRIVER_OBJECT struct (DeviceObject and then NextDevice from DEVICE_OBJECT)
To get the device name, I'm using IoGetDeviceProperty with DevicePropertyPhysicalDeviceObjectName value.
The problem is weird, cause sometimes it works, but sometimes not. But the device is always at the good value (verified with DeviceTree)
Here's my code
Code: Select all
void DropDevices ()
{
OBJECT_ATTRIBUTES attributes;
UNICODE_STRING name;
HANDLE directory;
BYTE buf[1000];
WCHAR driverName[512];
WCHAR deviceName[512];
DWORD idx, len;
ULONG outBytes = 0;
NTSTATUS status;
PDEVICE_OBJECT device;
PDRIVER_OBJECT driverobj;
RtlInitUnicodeString(&name, L"\\Driver");
InitializeObjectAttributes(&attributes, &name, OBJ_CASE_INSENSITIVE, NULL, NULL);
ZwOpenDirectoryObject(&directory, DIRECTORY_QUERY, &attributes);
ZwQueryDirectoryObject(directory, buf, sizeof(buf), TRUE, TRUE, &idx, &len);
do
{
OBJECT_NAMETYPE_INFO *p = (OBJECT_NAMETYPE_INFO *)buf;
//Get driver name
wcscpy(driverName, L"\\Driver\\");
wcscat(driverName, p->ObjectName.Buffer);
DbgPrint("%S\n", driverName);
//Get devices
RtlInitUnicodeString(&name, driverName);
ObReferenceObjectByName(&name, 0, NULL, 0, IoDriverObjectType, KernelMode, NULL, &driverobj);
if (driverobj != NULL)
{
for (device = driverobj->DeviceObject; device != NULL; device = device->NextDevice)
{
wcscpy(deviceName, L"");
status = IoGetDeviceProperty(device, DevicePropertyPhysicalDeviceObjectName, 512, deviceName, &outBytes);
DbgPrint("[0x%x]devobj: %08X : %ws (%d)\n", status, device, deviceName, outBytes);
}
ObDereferenceObject(driverobj);
}
}
while(NT_SUCCESS(ZwQueryDirectoryObject(directory, buf, sizeof(buf), TRUE, FALSE, &idx, &len)));
}
And what I'm getting in DbgView
00000000 0.00000000 DriverEntry Called
00000001 0.00005839 Running on Windows XP
00000002 0.00008521 \Driver\Beep
00000003 0.00011873 [0xc0000010]devobj: 82544578 : (0)
00000004 0.00013745 \Driver\NDIS
00000005 0.00015672 [0xc0000010]devobj: 82789F18 : (0)
00000006 0.00017516 \Driver\KSecDD
00000007 0.00019416 [0xc0000010]devobj: 8276C6A8 : (0)
00000008 0.00021260 \Driver\Mouclass
00000009 0.00023159 [0xc0000010]devobj: 824CFC60 : (0)
00000010 0.00024947 [0xc0000010]devobj: 826483E0 : (0)
00000011 0.00026791 \Driver\Raspti
00000012 0.00028663 [0xc0000010]devobj: 82611538 : (0)
00000013 0.00030479 \Driver\Fips
00000014 0.00032350 [0xc0000010]devobj: 825426C8 : (0)
00000015 0.00034222 \Driver\Kbdclass
00000016 0.00036094 [0xc0000010]devobj: 824909B0 : (0)
00000017 0.00037882 [0xc0000010]devobj: 826495C0 : (0)
00000018 0.00039698 \Driver\VgaSave
00000019 0.00041597 [0xc0000010]devobj: 8267B790 : (0)
00000020 0.00043441 \Driver\NDProxy
00000021 0.00045760 [0xc0000010]devobj: 82477ED8 : (0)
00000022 0.00047604 \Driver\Compbatt
00000023 0.00049531 [0xc0000010]devobj: 827D1898 : (0)
00000024 0.00051375 \Driver\Ptilink
00000025 0.00053247 [0xc0000010]devobj: 82611D98 : (0)
00000026 0.00055035 [0xc0000010]devobj: 82611030 : (0)
00000027 0.00056823 [0xc0000010]devobj: 8260D738 : (0)
00000028 0.00058639 \Driver\MountMgr
00000029 0.00060538 [0xc0000010]devobj: 827D0D90 : (0)
00000030 0.00062382 \Driver\wdmaud
00000031 0.00064282 [0xc0000010]devobj: 82506F10 : (0)
00000032 0.00066126 \Driver\VBoxGuest
00000033 0.00067997 [0xc0000010]devobj: 8276C308 : (0)
00000034 0.00069841 \Driver\dmload
00000035 0.00071713 [0xc0000010]devobj: 827CFF10 : (0)
00000036 0.00073557 \Driver\isapnp
00000037 0.00075624 [0x0]devobj: 827D2D20 : \Device\00000038 (34)
00000038 0.00077412 [0xc0000010]devobj: 827D2E30 : (0)
00000039 0.00079256 \Driver\atapi
00000040 0.00081435 [0x0]devobj: 827C8D98 : \Device\Ide\IdeDeviceP1T0L0-e (60)
00000041 0.00083335 [0x0]devobj: 8278EB00 : \Device\Ide\IdeDeviceP0T0L0-3 (60)
00000042 0.00085542 [0xc0000010]devobj: 8276F030 : (0)
00000043 0.00087330 [0xc0000010]devobj: 8278F030 : (0)
00000044 0.00089201 \Driver\IpNat
00000045 0.00091520 [0xc0000010]devobj: 825917A0 : (0)
00000046 0.00094286 \Driver\RasAcd
00000047 0.00096185 [0xc0000010]devobj: 82537398 : (0)
00000048 0.00098057 \Driver\PSched
00000049 0.00099957 [0xc0000010]devobj: 82476938 : (0)
00000050 0.00101745 [0xc0000010]devobj: 8260D9D0 : (0)
00000051 0.00103505 [0xc0000010]devobj: 8260D030 : (0)
00000052 0.00105377 \Driver\VBoxMouse
00000053 0.00107276 [0xc0000010]devobj: 826485F8 : (0)
00000054 0.00109092 \Driver\dmio
00000055 0.00110992 [0xc0000010]devobj: 827DFEC8 : (0)
00000056 0.00112780 [0xc0000010]devobj: 827CF9E0 : (0)
00000057 0.00114540 [0xc0000010]devobj: 827CFB48 : (0)
00000058 0.00116300 [0xc0000010]devobj: 827CFCB0 : (0)
00000059 0.00118144 \Driver\audstub
00000060 0.00120015 [0xc0000010]devobj: 826155C0 : (0)
00000061 0.00121775 [0xc0000010]devobj: 826156D0 : (0)
00000062 0.00123535 [0xc0000010]devobj: 826157E0 : (0)
00000063 0.00125295 [0xc0000010]devobj: 826158F0 : (0)
00000064 0.00127027 [0xc0000010]devobj: 82615A00 : (0)
00000065 0.00128899 \Driver\usbohci
00000066 0.00130910 [0x0]devobj: 82596360 : \Device\USBPDO-1 (34)
00000067 0.00133117 [0xc0000010]devobj: 82629028 : (0)
00000068 0.00135017 \Driver\Win32k
00000069 0.00137001 \Driver\usbhub
00000070 0.00139319 [0xc0000010]devobj: 8248E030 : (0)
00000071 0.00141107 [0xc0000010]devobj: 82481A88 : (0)
00000072 0.00143733 \Driver\swenum
00000073 0.00145801 [0x0]devobj: 82516880 : \Device\KSENUM#0000000a (48)
00000074 0.00147700 [0x0]devobj: 8259B378 : \Device\KSENUM#00000002 (48)
00000075 0.00149600 [0x0]devobj: 824B5760 : \Device\KSENUM#00000001 (48)
00000076 0.00151360 [0xc0000010]devobj: 8248FF10 : (0)
00000077 0.00153232 \Driver\rdpdr
00000078 0.00155104 [0xc0000010]devobj: 82491418 : (0)
00000079 0.00156891 [0xc0000010]devobj: 82490030 : (0)
00000080 0.00159098 [0xc0000010]devobj: 82491538 : (0)
00000081 0.00160998 \Driver\HTTP
00000082 0.00162870 [0xc0000010]devobj: 824AE960 : (0)
00000083 0.00164630 [0xc0000010]devobj: 824AFAF8 : (0)
00000084 0.00166390 [0xc0000010]devobj: 8272A030 : (0)
00000085 0.00168234 \Driver\RDPCDD
00000086 0.00170608 [0xc0000010]devobj: 823E8490 : (0)
00000087 0.00172508 \Driver\Update
00000088 0.00174408 [0xc0000010]devobj: 8248FA38 : (0)
00000089 0.00176307 \Driver\RasPppoe
00000090 0.00178207 [0xc0000010]devobj: 82613680 : (0)
00000091 0.00180051 \Driver\TermDD
00000092 0.00181951 [0xc0000010]devobj: 824CF030 : (0)
00000093 0.00183738 [0xc0000010]devobj: 82490DA0 : (0)
00000094 0.00185582 [0xc0000010]devobj: 82490F10 : (0)
00000095 0.00187426 \Driver\Ftdisk
00000096 0.00189465 [0x0]devobj: 827C8900 : \Device\HarddiskVolume1 (48)
00000097 0.00191253 [0xc0000010]devobj: 827D0888 : (0)
00000098 0.00193153 \Driver\sysaudio
00000099 0.00195025 [0xc0000010]devobj: 8249AE10 : (0)
00000100 0.00196924 \Driver\Rasl2tp
00000101 0.00198796 [0xc0000010]devobj: 82614030 : (0)
00000102 0.00200724 \Driver\ParVdm
00000103 0.00202596 [0xc0000010]devobj: 822E8C60 : (0)
00000104 0.00204495 \Driver\PptpMiniport
00000105 0.00206395 [0xc0000010]devobj: 826109D0 : (0)
00000106 0.00209189 \Driver\WMIxWDM
00000107 0.00211088 [0xc0000010]devobj: 827E5580 : (0)
00000108 0.00212988 \Driver\ACPI_HAL
00000109 0.00215446 [0x0]devobj: 827E5960 : \Device\00000033 (34)
00000110 0.00217234 [0xc0000010]devobj: 827E5A80 : (0)
00000111 0.00219106 \Driver\PCnet
00000112 0.00221006 [0xc0000010]devobj: 82632950 : (0)
00000113 0.00222933 \Driver\NetBT
00000114 0.00224805 [0xc0000010]devobj: 8267A460 : (0)
00000115 0.00226593 [0xc0000010]devobj: 82582030 : (0)
00000116 0.00228353 [0xc0000010]devobj: 8266AAA8 : (0)
00000117 0.00230253 \Driver\Cdrom
00000118 0.00232124 [0xc0000010]devobj: 82635998 : (0)
00000119 0.00234024 \Driver\mssmbios
00000120 0.00235924 [0xc0000010]devobj: 8248F430 : (0)
00000121 0.00237824 \Driver\kmixer
00000122 0.00239695 [0xc0000010]devobj: 8231F708 : (0)
00000123 0.00241623 \Driver\Wanarp
00000124 0.00243495 [0xc0000010]devobj: 824F4438 : (0)
00000125 0.00245394 \Driver\Tcpip
00000126 0.00247294 [0xc0000010]devobj: 82538438 : (0)
00000127 0.00249054 [0xc0000010]devobj: 82475498 : (0)
00000128 0.00250814 [0xc0000010]devobj: 82481970 : (0)
00000129 0.00252574 [0xc0000010]devobj: 826A3C38 : (0)
00000130 0.00254362 [0xc0000010]devobj: 825D44D8 : (0)
00000131 0.00256234 \Driver\mnmdd
00000132 0.00258580 [0xc0000010]devobj: 825D8B78 : (0)
00000133 0.00260508 \Driver\DBGV
00000134 0.00262408 [0xc0000010]devobj: 824A0040 : (0)
00000135 0.00264307 \Driver\VolSnap
00000136 0.00266207 [0xc0000010]devobj: 8276ED80 : (0)
00000137 0.00268079 \Driver\Null
00000138 0.00269951 [0xc0000010]devobj: 82576958 : (0)
00000139 0.00271934 \Driver\usbehci
00000140 0.00273973 [0x0]devobj: 82470618 : \Device\USBPDO-0 (34)
00000141 0.00276180 [0xc0000010]devobj: 8261E028 : (0)
00000142 0.00278108 \Driver\IPSec
00000143 0.00279980 [0xc0000010]devobj: 825DA490 : (0)
00000144 0.00281907 \Driver\PCI
00000145 0.00284366 [0x0]devobj: 827D6030 : \Device\NTPNP_PCI0008 (44)
00000146 0.00286684 [0x0]devobj: 827D74A8 : \Device\NTPNP_PCI0007 (44)
00000147 0.00288668 [0x0]devobj: 827D77E0 : \Device\NTPNP_PCI0006 (44)
00000148 0.00290596 [0x0]devobj: 827D7B18 : \Device\NTPNP_PCI0005 (44)
00000149 0.00292495 [0x0]devobj: 827D7E50 : \Device\NTPNP_PCI0004 (44)
00000150 0.00294423 [0x0]devobj: 827C7058 : \Device\NTPNP_PCI0003 (44)
00000151 0.00296323 [0x0]devobj: 827C7390 : \Device\NTPNP_PCI0002 (44)
00000152 0.00298194 [0x0]devobj: 827C7570 : \Device\NTPNP_PCI0001 (44)
00000153 0.00300094 [0x0]devobj: 827C7750 : \Device\NTPNP_PCI0000 (44)
00000154 0.00301854 [0xc0000010]devobj: 827E9020 : (0)
00000155 0.00303782 \Driver\Disk
00000156 0.00305681 [0xc0000010]devobj: 827CCC68 : (0)
00000157 0.00307469 [0xc0000010]devobj: 827E3AB8 : (0)
00000158 0.00309397 \Driver\VBoxVideo
00000159 0.00311883 [0x0]devobj: 826566F0 : \Device\VideoPdo0 (36)
00000160 0.00313699 [0xc0000010]devobj: 82633038 : (0)
00000161 0.00315627 \Driver\NdisTapi
00000162 0.00317526 [0xc0000010]devobj: 82614DD0 : (0)
00000163 0.00319482 \Driver\NdisWan
00000164 0.00321382 [0xc0000010]devobj: 82477370 : (0)
00000165 0.00323142 [0xc0000010]devobj: 826121F8 : (0)
00000166 0.00325097 \Driver\PartMgr
00000167 0.00326969 [0xc0000010]devobj: 827E2900 : (0)
00000168 0.00328897 \Driver\Gpc
00000169 0.00330768 [0xc0000010]devobj: 8260E030 : (0)
00000170 0.00332724 \Driver\ACPI
00000171 0.00334763 [0x0]devobj: 827D2690 : \Device\0000003e (34)
00000172 0.00336635 [0x0]devobj: 827D27A8 : \Device\0000003d (34)
00000173 0.00338507 [0x0]devobj: 827D28C0 : \Device\0000003c (34)
00000174 0.00340351 [0x0]devobj: 827D29D8 : \Device\0000003b (34)
00000175 0.00342222 [0x0]devobj: 827D2AF0 : \Device\0000003a (34)
00000176 0.00344066 [0x0]devobj: 827D2C08 : \Device\00000039 (34)
00000177 0.00345854 [0xc0000010]devobj: 827D6E00 : (0)
00000178 0.00347698 [0x0]devobj: 827D6F18 : \Device\00000036 (34)
00000179 0.00349570 [0x0]devobj: 827E5300 : \Device\00000035 (34)
00000180 0.00351441 [0x0]devobj: 827E9F18 : \Device\00000034 (34)
00000181 0.00353229 [0xc0000010]devobj: 827E4B48 : (0)
00000182 0.00355185 \Driver\RKRevealer
00000183 0.00357057 [0xc0000010]devobj: 8249F900 : (0)
00000184 0.00358984 \Driver\ac97intc
00000185 0.00360856 [0xc0000010]devobj: 82636030 : (0)
00000186 0.00362811 \Driver\PnpManager
00000187 0.00364851 [0x0]devobj: 827E5F10 : \Device\00000031 (34)
00000188 0.00367170 [0x0]devobj: 827AC190 : \Device\00000030 (34)
00000189 0.00369069 [0x0]devobj: 827AC3D0 : \Device\0000002f (34)
00000190 0.00370941 [0x0]devobj: 827AC610 : \Device\0000002e (34)
00000191 0.00372813 [0x0]devobj: 827AC850 : \Device\0000002d (34)
00000192 0.00374712 [0x0]devobj: 827ACA90 : \Device\0000002c (34)
00000193 0.00376584 [0x0]devobj: 827ACCD0 : \Device\0000002b (34)
00000194 0.00378484 [0x0]devobj: 827ACF10 : \Device\0000002a (34)
00000195 0.00380775 [0x0]devobj: 827E6190 : \Device\00000029 (34)
00000196 0.00384267 [0x0]devobj: 827E63D0 : \Device\00000028 (34)
00000197 0.00386250 [0x0]devobj: 827E6610 : \Device\00000027 (34)
00000198 0.00388150 [0x0]devobj: 827E6850 : \Device\00000026 (34)
00000199 0.00390050 [0x0]devobj: 827E6A90 : \Device\00000025 (34)
00000200 0.00391921 [0x0]devobj: 827E6CD0 : \Device\00000024 (34)
00000201 0.00394743 [0x0]devobj: 827E6F10 : \Device\00000023 (34)
00000202 0.00396643 [0x0]devobj: 827AD258 : \Device\00000022 (34)
00000203 0.00398486 [0x0]devobj: 827AD498 : \Device\00000021 (34)
00000204 0.00400358 [0x0]devobj: 827AD6D8 : \Device\00000020 (34)
00000205 0.00402230 [0x0]devobj: 827AD970 : \Device\0000001f (34)
00000206 0.00404130 [0x0]devobj: 827ADBB0 : \Device\0000001e (34)
00000207 0.00406001 [0x0]devobj: 827ADDF0 : \Device\0000001d (34)
00000208 0.00407873 [0x0]devobj: 827AD030 : \Device\0000001c (34)
00000209 0.00409745 [0x0]devobj: 827E72B0 : \Device\0000001b (34)
00000210 0.00411589 [0x0]devobj: 827E74F0 : \Device\0000001a (34)
00000211 0.00413516 [0x0]devobj: 827E7730 : \Device\00000019 (34)
00000212 0.00415416 [0x0]devobj: 827E7970 : \Device\00000018 (34)
00000213 0.00417288 [0x0]devobj: 827E7BB0 : \Device\00000017 (34)
00000214 0.00419159 [0x0]devobj: 827E7DF0 : \Device\00000016 (34)
00000215 0.00421031 [0x0]devobj: 827E7030 : \Device\00000015 (34)
00000216 0.00422931 [0x0]devobj: 827AE2B0 : \Device\00000014 (34)
00000217 0.00424803 [0x0]devobj: 827AE4F0 : \Device\00000013 (34)
00000218 0.00426702 [0x0]devobj: 827AE730 : \Device\00000012 (34)
00000219 0.00428574 [0x0]devobj: 827AE970 : \Device\00000011 (34)
00000220 0.00430446 [0x0]devobj: 827AEBB0 : \Device\00000010 (34)
00000221 0.00432318 [0x0]devobj: 827AEDF0 : \Device\0000000f (34)
00000222 0.00434189 [0x0]devobj: 827AE030 : \Device\0000000e (34)
00000223 0.00436117 [0x0]devobj: 827E82B0 : \Device\0000000d (34)
00000224 0.00438491 [0x0]devobj: 827E84F0 : \Device\0000000c (34)
00000225 0.00440419 [0x0]devobj: 827E8730 : \Device\0000000b (34)
00000226 0.00442291 [0x0]devobj: 827E8970 : \Device\0000000a (34)
00000227 0.00444191 [0x0]devobj: 827E8BB0 : \Device\00000009 (34)
00000228 0.00447599 [0x0]devobj: 827E8DF0 : \Device\00000008 (34)
00000229 0.00449471 [0x0]devobj: 827E8030 : \Device\00000007 (34)
00000230 0.00451370 [0x0]devobj: 827AF478 : \Device\00000006 (34)
00000231 0.00453270 [0x0]devobj: 827AF730 : \Device\00000005 (34)
00000232 0.00455114 [0x0]devobj: 827AF970 : \Device\00000004 (34)
00000233 0.00456985 [0x0]devobj: 827AFBB0 : \Device\00000003 (34)
00000234 0.00458885 [0x0]devobj: 827AFDF0 : \Device\00000002 (34)
00000235 0.00460757 [0x0]devobj: 827E9848 : \Device\00000001 (34)
00000236 0.00462545 [0x0]devobj: 827E9D28 : (0)
00000237 0.00464640 \Driver\AFD
00000238 0.00466596 [0xc0000010]devobj: 8257EAF0 : (0)
00000239 0.00468579 \Driver\Parport
00000240 0.00470618 [0x0]devobj: 824802D0 : \Device\Parallel0 (36)
00000241 0.00472490 [0xc0000010]devobj: 82637C08 : (0)
00000242 0.00474530 \Driver\i8042prt
00000243 0.00477351 [0xc0000010]devobj: 82648740 : (0)
00000244 0.00479111 [0xc0000010]devobj: 826497A8 : (0)
00000245 0.00481067 \Driver\CmBatt
00000246 0.00482994 [0xc0000010]devobj: 82615E40 : (0)
00000247 0.00484950 \Driver\IntelIde
00000248 0.00487045 [0x0]devobj: 827D1400 : \Device\Ide\PciIde0Channel1-1 (60)
00000249 0.00488973 [0x0]devobj: 827D15D0 : \Device\Ide\PciIde0Channel0-0 (60)
00000250 0.00490733 [0xc0000010]devobj: 827D0030 : (0)
00000251 0.00510959 ntdll : 0x7c910000
00000262 0.10019961 Drv_Unload Called