c++ - To compare two DRIVER_OBJECT for equality? -

i 2 instances of driver_object. use obreferenceobjectbyname() on driver name obtained registry 1 driver_object. second device_object structure. want check if 2 driver_objects equal, in order understand whether driver read registry same loaded device.

warning

this answer may not accurate, going old memory of hooks written in wee hours many years ago:

if knows better , have made mistake kindly drop me note below , i'll fix.

disclaimer

obreferenceobjectbyname undocumented , risky, shouldn't using (e.g. fail under windows 7) without understanding limitations.

answer

driver object is:

typedef struct  {      short type;      short size;      pdevice_object deviceobject;      ulong flags;      pvoid driverstart;      ulong driversize;      pvoid driversection;      pdriver_extension driverextension;      unicode_string drivername;      punicode_string hardwaredatabase;      pfast_io_dispatch fastiodispatch;      long * driverinit;      pvoid driverstartio;      pvoid driverunload;      long * majorfunction[28]; } driver_object; 

compare driverstart (length specified driversize) see if map same memory addresses , see if anywhere.

however if trying remain compatible think better off see if driverinit, driverstartio , driverunload in each of objects point same addresses. driversection / driversize / driverstart undocumented , should avoided.

hope helps.