A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #8712  by Tigzy
 Fri Sep 23, 2011 4:45 pm
Hello

I'm trying to Enum loaded Drivers, and their Devices.
For Drivers, no problem. I'm trying to get the devices by walking throught the DRIVER_OBJECT struct (DeviceObject and then NextDevice from DEVICE_OBJECT)
To get the device name, I'm using IoGetDeviceProperty with DevicePropertyPhysicalDeviceObjectName value.
The problem is weird, cause sometimes it works, but sometimes not. But the device is always at the good value (verified with DeviceTree)

Here's my code
Code: Select all
void DropDevices ()
{
	OBJECT_ATTRIBUTES attributes;
	UNICODE_STRING name;
	HANDLE directory;
	BYTE buf[1000];
	WCHAR driverName[512];
	WCHAR deviceName[512];
	DWORD idx, len;
	ULONG outBytes = 0;
	NTSTATUS status;
	
	PDEVICE_OBJECT device;
	PDRIVER_OBJECT driverobj;

	RtlInitUnicodeString(&name, L"\\Driver");
	InitializeObjectAttributes(&attributes, &name, OBJ_CASE_INSENSITIVE, NULL, NULL);
	ZwOpenDirectoryObject(&directory, DIRECTORY_QUERY, &attributes);
	ZwQueryDirectoryObject(directory, buf, sizeof(buf), TRUE, TRUE, &idx, &len);
	do
	{
		OBJECT_NAMETYPE_INFO *p = (OBJECT_NAMETYPE_INFO *)buf;
		
		//Get driver name
		wcscpy(driverName, L"\\Driver\\");
		wcscat(driverName, p->ObjectName.Buffer);			
		DbgPrint("%S\n", driverName);		
		
		//Get devices
		RtlInitUnicodeString(&name, driverName);
		ObReferenceObjectByName(&name, 0, NULL, 0, IoDriverObjectType, KernelMode, NULL, &driverobj);
				
		if (driverobj != NULL)
		{			
			for (device = driverobj->DeviceObject; device != NULL; device = device->NextDevice)
			{		
				wcscpy(deviceName, L"");
				status = IoGetDeviceProperty(device, DevicePropertyPhysicalDeviceObjectName, 512, deviceName, &outBytes);			
				DbgPrint("[0x%x]devobj: %08X : %ws (%d)\n", status, device, deviceName, outBytes);
			}
			ObDereferenceObject(driverobj);
		}	
	}
	while(NT_SUCCESS(ZwQueryDirectoryObject(directory, buf, sizeof(buf), TRUE, FALSE, &idx, &len)));	
}

And what I'm getting in DbgView
00000000 0.00000000 DriverEntry Called
00000001 0.00005839 Running on Windows XP
00000002 0.00008521 \Driver\Beep
00000003 0.00011873 [0xc0000010]devobj: 82544578 : (0)
00000004 0.00013745 \Driver\NDIS
00000005 0.00015672 [0xc0000010]devobj: 82789F18 : (0)
00000006 0.00017516 \Driver\KSecDD
00000007 0.00019416 [0xc0000010]devobj: 8276C6A8 : (0)
00000008 0.00021260 \Driver\Mouclass
00000009 0.00023159 [0xc0000010]devobj: 824CFC60 : (0)
00000010 0.00024947 [0xc0000010]devobj: 826483E0 : (0)
00000011 0.00026791 \Driver\Raspti
00000012 0.00028663 [0xc0000010]devobj: 82611538 : (0)
00000013 0.00030479 \Driver\Fips
00000014 0.00032350 [0xc0000010]devobj: 825426C8 : (0)
00000015 0.00034222 \Driver\Kbdclass
00000016 0.00036094 [0xc0000010]devobj: 824909B0 : (0)
00000017 0.00037882 [0xc0000010]devobj: 826495C0 : (0)
00000018 0.00039698 \Driver\VgaSave
00000019 0.00041597 [0xc0000010]devobj: 8267B790 : (0)
00000020 0.00043441 \Driver\NDProxy
00000021 0.00045760 [0xc0000010]devobj: 82477ED8 : (0)
00000022 0.00047604 \Driver\Compbatt
00000023 0.00049531 [0xc0000010]devobj: 827D1898 : (0)
00000024 0.00051375 \Driver\Ptilink
00000025 0.00053247 [0xc0000010]devobj: 82611D98 : (0)
00000026 0.00055035 [0xc0000010]devobj: 82611030 : (0)
00000027 0.00056823 [0xc0000010]devobj: 8260D738 : (0)
00000028 0.00058639 \Driver\MountMgr
00000029 0.00060538 [0xc0000010]devobj: 827D0D90 : (0)
00000030 0.00062382 \Driver\wdmaud
00000031 0.00064282 [0xc0000010]devobj: 82506F10 : (0)
00000032 0.00066126 \Driver\VBoxGuest
00000033 0.00067997 [0xc0000010]devobj: 8276C308 : (0)
00000034 0.00069841 \Driver\dmload
00000035 0.00071713 [0xc0000010]devobj: 827CFF10 : (0)
00000036 0.00073557 \Driver\isapnp
00000037 0.00075624 [0x0]devobj: 827D2D20 : \Device\00000038 (34)
00000038 0.00077412 [0xc0000010]devobj: 827D2E30 : (0)
00000039 0.00079256 \Driver\atapi
00000040 0.00081435 [0x0]devobj: 827C8D98 : \Device\Ide\IdeDeviceP1T0L0-e (60)
00000041 0.00083335 [0x0]devobj: 8278EB00 : \Device\Ide\IdeDeviceP0T0L0-3 (60)
00000042 0.00085542 [0xc0000010]devobj: 8276F030 : (0)
00000043 0.00087330 [0xc0000010]devobj: 8278F030 : (0)
00000044 0.00089201 \Driver\IpNat
00000045 0.00091520 [0xc0000010]devobj: 825917A0 : (0)
00000046 0.00094286 \Driver\RasAcd
00000047 0.00096185 [0xc0000010]devobj: 82537398 : (0)
00000048 0.00098057 \Driver\PSched
00000049 0.00099957 [0xc0000010]devobj: 82476938 : (0)
00000050 0.00101745 [0xc0000010]devobj: 8260D9D0 : (0)
00000051 0.00103505 [0xc0000010]devobj: 8260D030 : (0)
00000052 0.00105377 \Driver\VBoxMouse
00000053 0.00107276 [0xc0000010]devobj: 826485F8 : (0)
00000054 0.00109092 \Driver\dmio
00000055 0.00110992 [0xc0000010]devobj: 827DFEC8 : (0)
00000056 0.00112780 [0xc0000010]devobj: 827CF9E0 : (0)
00000057 0.00114540 [0xc0000010]devobj: 827CFB48 : (0)
00000058 0.00116300 [0xc0000010]devobj: 827CFCB0 : (0)
00000059 0.00118144 \Driver\audstub
00000060 0.00120015 [0xc0000010]devobj: 826155C0 : (0)
00000061 0.00121775 [0xc0000010]devobj: 826156D0 : (0)
00000062 0.00123535 [0xc0000010]devobj: 826157E0 : (0)
00000063 0.00125295 [0xc0000010]devobj: 826158F0 : (0)
00000064 0.00127027 [0xc0000010]devobj: 82615A00 : (0)
00000065 0.00128899 \Driver\usbohci
00000066 0.00130910 [0x0]devobj: 82596360 : \Device\USBPDO-1 (34)
00000067 0.00133117 [0xc0000010]devobj: 82629028 : (0)
00000068 0.00135017 \Driver\Win32k
00000069 0.00137001 \Driver\usbhub
00000070 0.00139319 [0xc0000010]devobj: 8248E030 : (0)
00000071 0.00141107 [0xc0000010]devobj: 82481A88 : (0)
00000072 0.00143733 \Driver\swenum
00000073 0.00145801 [0x0]devobj: 82516880 : \Device\KSENUM#0000000a (48)
00000074 0.00147700 [0x0]devobj: 8259B378 : \Device\KSENUM#00000002 (48)
00000075 0.00149600 [0x0]devobj: 824B5760 : \Device\KSENUM#00000001 (48)
00000076 0.00151360 [0xc0000010]devobj: 8248FF10 : (0)
00000077 0.00153232 \Driver\rdpdr
00000078 0.00155104 [0xc0000010]devobj: 82491418 : (0)
00000079 0.00156891 [0xc0000010]devobj: 82490030 : (0)
00000080 0.00159098 [0xc0000010]devobj: 82491538 : (0)
00000081 0.00160998 \Driver\HTTP
00000082 0.00162870 [0xc0000010]devobj: 824AE960 : (0)
00000083 0.00164630 [0xc0000010]devobj: 824AFAF8 : (0)
00000084 0.00166390 [0xc0000010]devobj: 8272A030 : (0)
00000085 0.00168234 \Driver\RDPCDD
00000086 0.00170608 [0xc0000010]devobj: 823E8490 : (0)
00000087 0.00172508 \Driver\Update
00000088 0.00174408 [0xc0000010]devobj: 8248FA38 : (0)
00000089 0.00176307 \Driver\RasPppoe
00000090 0.00178207 [0xc0000010]devobj: 82613680 : (0)
00000091 0.00180051 \Driver\TermDD
00000092 0.00181951 [0xc0000010]devobj: 824CF030 : (0)
00000093 0.00183738 [0xc0000010]devobj: 82490DA0 : (0)
00000094 0.00185582 [0xc0000010]devobj: 82490F10 : (0)
00000095 0.00187426 \Driver\Ftdisk
00000096 0.00189465 [0x0]devobj: 827C8900 : \Device\HarddiskVolume1 (48)
00000097 0.00191253 [0xc0000010]devobj: 827D0888 : (0)
00000098 0.00193153 \Driver\sysaudio
00000099 0.00195025 [0xc0000010]devobj: 8249AE10 : (0)
00000100 0.00196924 \Driver\Rasl2tp
00000101 0.00198796 [0xc0000010]devobj: 82614030 : (0)
00000102 0.00200724 \Driver\ParVdm
00000103 0.00202596 [0xc0000010]devobj: 822E8C60 : (0)
00000104 0.00204495 \Driver\PptpMiniport
00000105 0.00206395 [0xc0000010]devobj: 826109D0 : (0)
00000106 0.00209189 \Driver\WMIxWDM
00000107 0.00211088 [0xc0000010]devobj: 827E5580 : (0)
00000108 0.00212988 \Driver\ACPI_HAL
00000109 0.00215446 [0x0]devobj: 827E5960 : \Device\00000033 (34)
00000110 0.00217234 [0xc0000010]devobj: 827E5A80 : (0)
00000111 0.00219106 \Driver\PCnet
00000112 0.00221006 [0xc0000010]devobj: 82632950 : (0)
00000113 0.00222933 \Driver\NetBT
00000114 0.00224805 [0xc0000010]devobj: 8267A460 : (0)
00000115 0.00226593 [0xc0000010]devobj: 82582030 : (0)
00000116 0.00228353 [0xc0000010]devobj: 8266AAA8 : (0)
00000117 0.00230253 \Driver\Cdrom
00000118 0.00232124 [0xc0000010]devobj: 82635998 : (0)
00000119 0.00234024 \Driver\mssmbios
00000120 0.00235924 [0xc0000010]devobj: 8248F430 : (0)
00000121 0.00237824 \Driver\kmixer
00000122 0.00239695 [0xc0000010]devobj: 8231F708 : (0)
00000123 0.00241623 \Driver\Wanarp
00000124 0.00243495 [0xc0000010]devobj: 824F4438 : (0)
00000125 0.00245394 \Driver\Tcpip
00000126 0.00247294 [0xc0000010]devobj: 82538438 : (0)
00000127 0.00249054 [0xc0000010]devobj: 82475498 : (0)
00000128 0.00250814 [0xc0000010]devobj: 82481970 : (0)
00000129 0.00252574 [0xc0000010]devobj: 826A3C38 : (0)
00000130 0.00254362 [0xc0000010]devobj: 825D44D8 : (0)
00000131 0.00256234 \Driver\mnmdd
00000132 0.00258580 [0xc0000010]devobj: 825D8B78 : (0)
00000133 0.00260508 \Driver\DBGV
00000134 0.00262408 [0xc0000010]devobj: 824A0040 : (0)
00000135 0.00264307 \Driver\VolSnap
00000136 0.00266207 [0xc0000010]devobj: 8276ED80 : (0)
00000137 0.00268079 \Driver\Null
00000138 0.00269951 [0xc0000010]devobj: 82576958 : (0)
00000139 0.00271934 \Driver\usbehci
00000140 0.00273973 [0x0]devobj: 82470618 : \Device\USBPDO-0 (34)
00000141 0.00276180 [0xc0000010]devobj: 8261E028 : (0)
00000142 0.00278108 \Driver\IPSec
00000143 0.00279980 [0xc0000010]devobj: 825DA490 : (0)
00000144 0.00281907 \Driver\PCI
00000145 0.00284366 [0x0]devobj: 827D6030 : \Device\NTPNP_PCI0008 (44)
00000146 0.00286684 [0x0]devobj: 827D74A8 : \Device\NTPNP_PCI0007 (44)
00000147 0.00288668 [0x0]devobj: 827D77E0 : \Device\NTPNP_PCI0006 (44)
00000148 0.00290596 [0x0]devobj: 827D7B18 : \Device\NTPNP_PCI0005 (44)
00000149 0.00292495 [0x0]devobj: 827D7E50 : \Device\NTPNP_PCI0004 (44)
00000150 0.00294423 [0x0]devobj: 827C7058 : \Device\NTPNP_PCI0003 (44)
00000151 0.00296323 [0x0]devobj: 827C7390 : \Device\NTPNP_PCI0002 (44)
00000152 0.00298194 [0x0]devobj: 827C7570 : \Device\NTPNP_PCI0001 (44)
00000153 0.00300094 [0x0]devobj: 827C7750 : \Device\NTPNP_PCI0000 (44)
00000154 0.00301854 [0xc0000010]devobj: 827E9020 : (0)
00000155 0.00303782 \Driver\Disk
00000156 0.00305681 [0xc0000010]devobj: 827CCC68 : (0)
00000157 0.00307469 [0xc0000010]devobj: 827E3AB8 : (0)
00000158 0.00309397 \Driver\VBoxVideo
00000159 0.00311883 [0x0]devobj: 826566F0 : \Device\VideoPdo0 (36)
00000160 0.00313699 [0xc0000010]devobj: 82633038 : (0)
00000161 0.00315627 \Driver\NdisTapi
00000162 0.00317526 [0xc0000010]devobj: 82614DD0 : (0)
00000163 0.00319482 \Driver\NdisWan
00000164 0.00321382 [0xc0000010]devobj: 82477370 : (0)
00000165 0.00323142 [0xc0000010]devobj: 826121F8 : (0)
00000166 0.00325097 \Driver\PartMgr
00000167 0.00326969 [0xc0000010]devobj: 827E2900 : (0)
00000168 0.00328897 \Driver\Gpc
00000169 0.00330768 [0xc0000010]devobj: 8260E030 : (0)
00000170 0.00332724 \Driver\ACPI
00000171 0.00334763 [0x0]devobj: 827D2690 : \Device\0000003e (34)
00000172 0.00336635 [0x0]devobj: 827D27A8 : \Device\0000003d (34)
00000173 0.00338507 [0x0]devobj: 827D28C0 : \Device\0000003c (34)
00000174 0.00340351 [0x0]devobj: 827D29D8 : \Device\0000003b (34)
00000175 0.00342222 [0x0]devobj: 827D2AF0 : \Device\0000003a (34)
00000176 0.00344066 [0x0]devobj: 827D2C08 : \Device\00000039 (34)
00000177 0.00345854 [0xc0000010]devobj: 827D6E00 : (0)
00000178 0.00347698 [0x0]devobj: 827D6F18 : \Device\00000036 (34)
00000179 0.00349570 [0x0]devobj: 827E5300 : \Device\00000035 (34)
00000180 0.00351441 [0x0]devobj: 827E9F18 : \Device\00000034 (34)
00000181 0.00353229 [0xc0000010]devobj: 827E4B48 : (0)
00000182 0.00355185 \Driver\RKRevealer
00000183 0.00357057 [0xc0000010]devobj: 8249F900 : (0)
00000184 0.00358984 \Driver\ac97intc
00000185 0.00360856 [0xc0000010]devobj: 82636030 : (0)
00000186 0.00362811 \Driver\PnpManager
00000187 0.00364851 [0x0]devobj: 827E5F10 : \Device\00000031 (34)
00000188 0.00367170 [0x0]devobj: 827AC190 : \Device\00000030 (34)
00000189 0.00369069 [0x0]devobj: 827AC3D0 : \Device\0000002f (34)
00000190 0.00370941 [0x0]devobj: 827AC610 : \Device\0000002e (34)
00000191 0.00372813 [0x0]devobj: 827AC850 : \Device\0000002d (34)
00000192 0.00374712 [0x0]devobj: 827ACA90 : \Device\0000002c (34)
00000193 0.00376584 [0x0]devobj: 827ACCD0 : \Device\0000002b (34)
00000194 0.00378484 [0x0]devobj: 827ACF10 : \Device\0000002a (34)
00000195 0.00380775 [0x0]devobj: 827E6190 : \Device\00000029 (34)
00000196 0.00384267 [0x0]devobj: 827E63D0 : \Device\00000028 (34)
00000197 0.00386250 [0x0]devobj: 827E6610 : \Device\00000027 (34)
00000198 0.00388150 [0x0]devobj: 827E6850 : \Device\00000026 (34)
00000199 0.00390050 [0x0]devobj: 827E6A90 : \Device\00000025 (34)
00000200 0.00391921 [0x0]devobj: 827E6CD0 : \Device\00000024 (34)
00000201 0.00394743 [0x0]devobj: 827E6F10 : \Device\00000023 (34)
00000202 0.00396643 [0x0]devobj: 827AD258 : \Device\00000022 (34)
00000203 0.00398486 [0x0]devobj: 827AD498 : \Device\00000021 (34)
00000204 0.00400358 [0x0]devobj: 827AD6D8 : \Device\00000020 (34)
00000205 0.00402230 [0x0]devobj: 827AD970 : \Device\0000001f (34)
00000206 0.00404130 [0x0]devobj: 827ADBB0 : \Device\0000001e (34)
00000207 0.00406001 [0x0]devobj: 827ADDF0 : \Device\0000001d (34)
00000208 0.00407873 [0x0]devobj: 827AD030 : \Device\0000001c (34)
00000209 0.00409745 [0x0]devobj: 827E72B0 : \Device\0000001b (34)
00000210 0.00411589 [0x0]devobj: 827E74F0 : \Device\0000001a (34)
00000211 0.00413516 [0x0]devobj: 827E7730 : \Device\00000019 (34)
00000212 0.00415416 [0x0]devobj: 827E7970 : \Device\00000018 (34)
00000213 0.00417288 [0x0]devobj: 827E7BB0 : \Device\00000017 (34)
00000214 0.00419159 [0x0]devobj: 827E7DF0 : \Device\00000016 (34)
00000215 0.00421031 [0x0]devobj: 827E7030 : \Device\00000015 (34)
00000216 0.00422931 [0x0]devobj: 827AE2B0 : \Device\00000014 (34)
00000217 0.00424803 [0x0]devobj: 827AE4F0 : \Device\00000013 (34)
00000218 0.00426702 [0x0]devobj: 827AE730 : \Device\00000012 (34)
00000219 0.00428574 [0x0]devobj: 827AE970 : \Device\00000011 (34)
00000220 0.00430446 [0x0]devobj: 827AEBB0 : \Device\00000010 (34)
00000221 0.00432318 [0x0]devobj: 827AEDF0 : \Device\0000000f (34)
00000222 0.00434189 [0x0]devobj: 827AE030 : \Device\0000000e (34)
00000223 0.00436117 [0x0]devobj: 827E82B0 : \Device\0000000d (34)
00000224 0.00438491 [0x0]devobj: 827E84F0 : \Device\0000000c (34)
00000225 0.00440419 [0x0]devobj: 827E8730 : \Device\0000000b (34)
00000226 0.00442291 [0x0]devobj: 827E8970 : \Device\0000000a (34)
00000227 0.00444191 [0x0]devobj: 827E8BB0 : \Device\00000009 (34)
00000228 0.00447599 [0x0]devobj: 827E8DF0 : \Device\00000008 (34)
00000229 0.00449471 [0x0]devobj: 827E8030 : \Device\00000007 (34)
00000230 0.00451370 [0x0]devobj: 827AF478 : \Device\00000006 (34)
00000231 0.00453270 [0x0]devobj: 827AF730 : \Device\00000005 (34)
00000232 0.00455114 [0x0]devobj: 827AF970 : \Device\00000004 (34)
00000233 0.00456985 [0x0]devobj: 827AFBB0 : \Device\00000003 (34)
00000234 0.00458885 [0x0]devobj: 827AFDF0 : \Device\00000002 (34)
00000235 0.00460757 [0x0]devobj: 827E9848 : \Device\00000001 (34)
00000236 0.00462545 [0x0]devobj: 827E9D28 : (0)
00000237 0.00464640 \Driver\AFD
00000238 0.00466596 [0xc0000010]devobj: 8257EAF0 : (0)
00000239 0.00468579 \Driver\Parport
00000240 0.00470618 [0x0]devobj: 824802D0 : \Device\Parallel0 (36)
00000241 0.00472490 [0xc0000010]devobj: 82637C08 : (0)
00000242 0.00474530 \Driver\i8042prt
00000243 0.00477351 [0xc0000010]devobj: 82648740 : (0)
00000244 0.00479111 [0xc0000010]devobj: 826497A8 : (0)
00000245 0.00481067 \Driver\CmBatt
00000246 0.00482994 [0xc0000010]devobj: 82615E40 : (0)
00000247 0.00484950 \Driver\IntelIde
00000248 0.00487045 [0x0]devobj: 827D1400 : \Device\Ide\PciIde0Channel1-1 (60)
00000249 0.00488973 [0x0]devobj: 827D15D0 : \Device\Ide\PciIde0Channel0-0 (60)
00000250 0.00490733 [0xc0000010]devobj: 827D0030 : (0)
00000251 0.00510959 ntdll : 0x7c910000
00000262 0.10019961 Drv_Unload Called
 #8727  by Alex
 Sat Sep 24, 2011 5:06 pm
You can extract device's object name directly from OBJECT_HEADER_NAME_INFO. And here is a pseudo code:
Code: Select all
ObjectHeader = OBJECT_TO_OBJECT_HEADER(DeviceObject);
if(ObjectHeader->NameInfoOffset)
{
ObjectNameInfo = (OBJECT_HEADER_NAME_INFO *)(ObjectHeader - ObjectHeader->NameInfoOffset);
if(ObjectNameInfo->Name.Buffer)
DeviceName = ObjectNameInfo->Name.Buffer;
}
 #8739  by Tigzy
 Mon Sep 26, 2011 8:26 am
It doesn't works....
The Object have good adresses, but the name is not good.
Code: Select all
			for (device = driverobj->DeviceObject; device != NULL; device = device->NextDevice)
			{		
				wcscpy(deviceName, L"");
				
				ObjectHeader = OBJECT_TO_OBJECT_HEADER(device);
				if(ObjectHeader->NameInfoOffset)
				{
					ObjectNameInfo = (OBJECT_HEADER_NAME_INFO *)(ObjectHeader - ObjectHeader->NameInfoOffset);
					if(ObjectNameInfo->Name.Buffer)
						DbgPrint("name : %ws\n", ObjectNameInfo->Name.Buffer);						
						
				}
 #8745  by Alex
 Mon Sep 26, 2011 10:44 am
Try this macro and check string's length if it's OK than allocate kernel pool with length = ObjectNameInfo->Name.Length + sizeof(WCHAR), clean it and copy whole buffer:
Code: Select all
#define OBJECT_HEADER_TO_NAME_INFO(ObjectHeader) \
        ((POBJECT_HEADER_NAME_INFO) ((ObjectHeader)->NameInfoOffset == 0 ? NULL : \
        ((PCHAR)(ObjectHeader) - (ObjectHeader)->NameInfoOffset)))
 #8747  by Tigzy
 Mon Sep 26, 2011 12:21 pm
Thanks! Now working
SOLVED
Code: Select all
for (device = driverobj->DeviceObject; device != NULL; device = device->NextDevice)
			{
				ObjectHeader = OBJECT_TO_OBJECT_HEADER(device);
				ObjectNameInfo = OBJECT_HEADER_TO_NAME_INFO(ObjectHeader);
				if (ObjectNameInfo)
				{				
					wcscpy(deviceName, L"\\Device\\");
					buff = ExAllocatePoolWithTag(PagedPool, ObjectNameInfo->Name.Length + sizeof(WCHAR), 'mlst');
					RtlStringCbCopyW(buff, ObjectNameInfo->Name.Length + sizeof(WCHAR), ObjectNameInfo->Name.Buffer);					
					wcscat(deviceName, buff);
					ExFreePoolWithTag(buff, 'mlst');
					DbgPrint("--> %ws\n", deviceName);
				}
				
			}
			ObDereferenceObject(driverobj);
00000000 0.00000000 DriverEntry Called
00000001 0.00003129 Running on Windows XP
00000002 0.00004917 \Driver\Beep
00000003 0.00006509 --> \Device\Beep
00000004 0.00008018 \Driver\TMPassthruMP
00000005 0.00009582 --> \Device\TMPassthru
00000006 0.00011063 --> \Device\{0A3A70CE-7106-494E-AA60-30CC8CFEFF58}
00000007 0.00012543 --> \Device\{F43A3943-5586-4141-9F23-59637E32F646}
00000008 0.00013996 \Driver\NDIS
00000009 0.00015505 --> \Device\Ndis
00000010 0.00016985 \Driver\KSecDD
00000011 0.00018494 --> \Device\KsecDD
00000012 0.00020003 \Driver\Mouclass
00000013 0.00021539 --> \Device\PointerClass1
00000014 0.00022936 --> \Device\PointerClass0
00000015 0.00024417 \Driver\Raspti
00000016 0.00026372 --> \Device\{5E99EFBC-64AC-44A9-84D1-FD318FDF68AC}
00000017 0.00027853 \Driver\Fips
00000018 0.00029361 --> \Device\Fips
00000019 0.00030842 \Driver\Kbdclass
00000020 0.00032350 --> \Device\KeyboardClass1
00000021 0.00033775 --> \Device\KeyboardClass0
... and so on