内核中的_OBJECT_INFORMATION_CLASS 结构

最新推荐文章于 2021-05-27 14:59:17 发布

小驹

最新推荐文章于 2021-05-27 14:59:17 发布

阅读量5.5k

点赞数

分类专栏：内核开发

本文链接：https://blog.youkuaiyun.com/xiaocaiju/article/details/40736729

版权

内核开发专栏收录该内容

21 篇文章

订阅专栏

实际上这个枚举类型有5种

   
   
    
    
     
     typedef enum _OBJECT_INFORMATION_CLASS {
    
    
    
    
     
         ObjectBasicInformation,
    
    
    
    
     
         ObjectNameInformation,
    
    
    
    
     
         ObjectTypeInformation,
    
    
    
    
     
         ObjectAllInformation,
    
    
    
    
     
         ObjectDataInformation
    
    
    
    
     
     } OBJECT_INFORMATION_CLASS, *POBJECT_INFORMATION_CLASS;

但在microsoft的文档中只有两项

   
   
    
    
     
     OBJECT_INFORMATION_CLASS
    
    
    
    
     
     
    
    
    
    
     
     The OBJECT_INFORMATION_CLASS enumeration type represents the type of information to supply about an object.
    
    
    
    
     
     
    
    
    
    
     
     typedef enum _OBJECT_INFORMATION_CLASS {
    
    
    
    
     
       ObjectBasicInformation=0,
    
    
    
    
     
       ObjectTypeInformation=2,
    
    
    
    
     
     } OBJECT_INFORMATION_CLASS;
    
    
    
    
     
     
    
    
    
    
     
     
    
    
    
    
     
     
    
    
    
    
     
     Values
    
    
    
    
     
     ObjectBasicInformation 
    
    
    
    
     
     A PUBLIC_OBJECT_BASIC_INFORMATION structure is supplied. 
    
    
    
    
     
     ObjectTypeInformation 
    
    
    
    
     
     A PUBLIC_OBJECT_TYPE_INFORMATION structure is supplied. 
    
    
    
    
     
     Requirements
    
    
    
    
     
     Versions: Available starting with Microsoft Windows 2000.
    
    
    
    
     
     
    
    
    
    
     
     Headers: Defined in Ntifs.h. Include Ntifs.h or Fltkernel.h.

同样的对于第一种信息类型 ObjectBasicInformation,它的真实的结构是这样的:

   
   
    
    
     
     typedef struct _OBJECT_BASIC_INFORMATION {
    
    
    
    
     
       ULONG                   Attributes;
    
    
    
    
     
       ACCESS_MASK             DesiredAccess;
    
    
    
    
     
       ULONG                   HandleCount;
    
    
    
    
     
       ULONG                   ReferenceCount;
    
    
    
    
     
       ULONG                   PagedPoolUsage;
    
    
    
    
     
       ULONG                   NonPagedPoolUsage;
    
    
    
    
     
       ULONG                   Reserved[3];
    
    
    
    
     
       ULONG                   NameInformationLength;
    
    
    
    
     
       ULONG                   TypeInformationLength;
    
    
    
    
     
       ULONG                   SecurityDescriptorLength;
    
    
    
    
     
       LARGE_INTEGER           CreationTime;
    
    
    
    
     
     } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;

而同样的,这个结构在官方文档有部分没有声明,以下为官方的文档:

   
   
    
    
     
     typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION {
    
    
    
    
     
     ULONG Attributes;
    
    
    
    
     
     ACCESS_MASK GrantedAccess;
    
    
    
    
     
     ULONG HandleCount;
    
    
    
    
     
     ULONG PointerCount;
    
    
    
    
     
     ULONG Reserved[10];
    
    
    
    
     
     } PUBLIC_OBJECT_BASIC_INFORMATION; PPUBLIC_OBJECT_BASIC_INFORMATION