c++ - To compare two DRIVER_OBJECT for equality? -
i 2 instances of driver_object. use obreferenceobjectbyname() on driver name obtained registry 1 driver_object. second device_object structure. want check if 2 driver_objects equal, in order understand whether driver read registry same loaded device.
warning
this answer may not accurate, going old memory of hooks written in wee hours many years ago:
if knows better , have made mistake kindly drop me note below , i'll fix.
disclaimer
obreferenceobjectbyname undocumented , risky, shouldn't using (e.g. fail under windows 7) without understanding limitations.
answer
driver object is:
typedef struct { short type; short size; pdevice_object deviceobject; ulong flags; pvoid driverstart; ulong driversize; pvoid driversection; pdriver_extension driverextension; unicode_string drivername; punicode_string hardwaredatabase; pfast_io_dispatch fastiodispatch; long * driverinit; pvoid driverstartio; pvoid driverunload; long * majorfunction[28]; } driver_object;
compare driverstart (length specified driversize) see if map same memory addresses , see if anywhere.
however if trying remain compatible think better off see if driverinit, driverstartio , driverunload in each of objects point same addresses. driversection / driversize / driverstart undocumented , should avoided.
hope helps.
Comments
Post a Comment