内核中的_OBJECT_INFORMATION_CLASS 结构

最新推荐文章于 2025-06-19 12:28:58 发布

原创最新推荐文章于 2025-06-19 12:28:58 发布 · 5.5k 阅读

1 ·

CC 4.0 BY-SA版权

内核开发专栏收录该内容

21 篇文章

订阅专栏

本文详细介绍了枚举类型_OBJECT_INFORMATION_CLASS的定义及使用方法，并对比了实际定义与Microsoft文档中的差异。特别关注ObjectBasicInformation结构体的实现细节及其与官方文档中的PUBLIC_OBJECT_BASIC_INFORMATION结构体的不同之处。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

实际上这个枚举类型有5种

typedef enum _OBJECT_INFORMATION_CLASS {
    ObjectBasicInformation,
    ObjectNameInformation,
    ObjectTypeInformation,
    ObjectAllInformation,
    ObjectDataInformation
} OBJECT_INFORMATION_CLASS, *POBJECT_INFORMATION_CLASS;

但在microsoft的文档中只有两项

OBJECT_INFORMATION_CLASS
The OBJECT_INFORMATION_CLASS enumeration type represents the type of information to supply about an object.
typedef enum _OBJECT_INFORMATION_CLASS {
  ObjectBasicInformation=0,
  ObjectTypeInformation=2,
} OBJECT_INFORMATION_CLASS;
Values
ObjectBasicInformation 
A PUBLIC_OBJECT_BASIC_INFORMATION structure is supplied. 
ObjectTypeInformation 
A PUBLIC_OBJECT_TYPE_INFORMATION structure is supplied. 
Requirements
Versions: Available starting with Microsoft Windows 2000.
Headers: Defined in Ntifs.h. Include Ntifs.h or Fltkernel.h.

同样的对于第一种信息类型ObjectBasicInformation,它的真实的结构是这样的:

typedef struct _OBJECT_BASIC_INFORMATION {
  ULONG                   Attributes;
  ACCESS_MASK             DesiredAccess;
  ULONG                   HandleCount;
  ULONG                   ReferenceCount;
  ULONG                   PagedPoolUsage;
  ULONG                   NonPagedPoolUsage;
  ULONG                   Reserved[3];
  ULONG                   NameInformationLength;
  ULONG                   TypeInformationLength;
  ULONG                   SecurityDescriptorLength;
  LARGE_INTEGER           CreationTime;
} OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;

而同样的,这个结构在官方文档有部分没有声明,以下为官方的文档:

typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION {
ULONG Attributes;
ACCESS_MASK GrantedAccess;
ULONG HandleCount;
ULONG PointerCount;
ULONG Reserved[10];
} PUBLIC_OBJECT_BASIC_INFORMATION; PPUBLIC_OBJECT_BASIC_INFORMATION

可见一个LARGE_INTEGER占2个ULONG