下列提出两种获取对象名的方式
- 通过_OBJECT_TYPE::Name获取对象名称，通过_OBJECT_TYPE::Index获取对象索引；
- 通过NtQueryObject的方式获取，r0与r3通用，代码如下：
typedef enum _OBJECT_INFORMATION_CLASS {ObjectBasicInformation,ObjectNameInformation,ObjectTypeInformation,ObjectTypesInformation,ObjectHandleFlagInformation,ObjectSessionInformation,
} OBJECT_INFORMATION_CLASS;typedef struct _UNICODE_STRING {USHORT Length;USHORT MaximumLength;PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;typedef struct _OBJECT_TYPE_INFORMATION
{UNICODE_STRING TypeName;ULONG TotalNumberOfObjects;ULONG TotalNumberOfHandles;ULONG TotalPagedPoolUsage;ULONG TotalNonPagedPoolUsage;ULONG TotalNamePoolUsage;ULONG TotalHandleTableUsage;ULONG HighWaterNumberOfObjects;ULONG HighWaterNumberOfHandles;ULONG HighWaterPagedPoolUsage;ULONG HighWaterNonPagedPoolUsage;ULONG HighWaterNamePoolUsage;ULONG HighWaterHandleTableUsage;ULONG InvalidAttributes;GENERIC_MAPPING GenericMapping;ULONG ValidAccessMask;BOOLEAN SecurityRequired;BOOLEAN MaintainHandleCount;UCHAR TypeIndex; // since WINBLUECHAR ReservedByte;ULONG PoolType;ULONG DefaultPagedPoolCharge;ULONG DefaultNonPagedPoolCharge;
} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;typedef struct _OBJECT_TYPES_INFORMATION {LONG NumberOfTypes;OBJECT_TYPE_INFORMATION TypeInformation [1];
} OBJECT_TYPES_INFORMATION, *POBJECT_TYPES_INFORMATION;typedef NTSTATUS (__stdcall* typedef_NtQueryObject)(HANDLE Handle,OBJECT_INFORMATION_CLASS ObjectInformationClass,PVOID ObjectInformation,ULONG ObjectInformationLength,PULONG ReturnLength);#define PAD_8(p) (((p) + 7) & ~7)int main(void) {HMODULE hNtDLL = GetModuleHandleW(L"ntdll.dll");if (!hNtDLL) {return -1;}typedef_NtQueryObject myNtQueryObject = (typedef_NtQueryObject)GetProcAddress(hNtDLL, "NtQueryObject");if (!myNtQueryObject) {return -1;}NTSTATUS status = STATUS_SUCCESS;POBJECT_TYPES_INFORMATION TypesInfo = NULL;ULONG BufferLength = 0;// 如果需要获取指定Handle的对象类型，可以把第一个参数的NULL换成Handle值status = myNtQueryObject(NULL, ObjectTypesInformation, NULL, 0, &BufferLength);if (status != STATUS_INFO_LENGTH_MISMATCH) {return -1;}while (status == STATUS_INFO_LENGTH_MISMATCH) {ULONG StartBufferLength = BufferLength; if (TypesInfo) {free(TypesInfo);TypesInfo = NULL;}TypesInfo = (POBJECT_TYPES_INFORMATION)malloc(StartBufferLength);memset(TypesInfo, 0, StartBufferLength);if (!TypesInfo) {return -1;}status = myNtQueryObject(NULL, ObjectTypesInformation, TypesInfo, StartBufferLength, &BufferLength);}POBJECT_TYPE_INFORMATION TypeInfoIterator = &TypesInfo->TypeInformation[0];for (LONG i = 0; i < TypesInfo->NumberOfTypes; i++) {std::wstring typeName;typeName.resize(TypeInfoIterator->TypeName.Length / sizeof(WCHAR));memcpy_s(&typeName[0], TypeInfoIterator->TypeName.Length, TypeInfoIterator->TypeName.Buffer, TypeInfoIterator->TypeName.Length);std::wcout << "TypeIdx=" << i << ", TypeName=" << typeName.c_str() << std::endl;// 注意：这里的结构在x64上必须按照8字节对齐TypeInfoIterator = (POBJECT_TYPE_INFORMATION)(PAD_8((ULONG_PTR)TypeInfoIterator->TypeName.Buffer + TypeInfoIterator->TypeName.MaximumLength));}free(TypesInfo);TypesInfo = NULL;system("pause");return 0;
}
运行结果：
