#include <stdio.h> #include <ntddk.h> #include <ntifs.h>
BOOLEAN EventOperationSample() { BOOLEAN bSucc = FALSE; HANDLE hCreateEvent = NULL; PVOID pCrateEventObject = NULL; HANDLE hOpenEvent = NULL; PVOID pOpenEventObject = NULL;
do { OBJECT_ATTRIBUTES ObjAttr = { 0 }; UNICODE_STRING uNameString = { 0 }; RtlInitUnicodeString(&uNameString, L"\\BaseNameObjects\\TestEvent"); InitializeObjectAttributes(&ObjAttr, &uNameString, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, NULL); ZwCreateEvent(&hCreateEvent, EVENT_ALL_ACCESS, &ObjAttr, SynchronizationEvent, FALSE); if (hCreateEvent == NULL) { break; }
ObReferenceObjectByHandle(hCreateEvent, EVENT_ALL_ACCESS, *ExEventObjectType, KernelMode, &pCrateEventObject, NULL); if (hOpenEvent == NULL) { break; }
ObReferenceObjectByHandle(hOpenEvent, EVENT_ALL_ACCESS, *ExEventObjectType, KernelMode, &pCrateEventObject, NULL);
if (pOpenEventObject == NULL) { break; }
DbgPrint("Create Handle: %p, Create Pointer = %p\n", hCreateEvent, pCrateEventObject); DbgPrint("Open Handle: %p, Open Pointer = %p\n", hOpenEvent, pOpenEventObject); bSucc = TRUE; } while (FALSE); if (pCrateEventObject != NULL) { ObDereferenceObject(pCrateEventObject); pCrateEventObject = NULL; }
if (hCreateEvent != NULL) { ZwClose(hCreateEvent); hCreateEvent = NULL; }
if (pOpenEventObject != NULL) { ObDereferenceObject(pOpenEventObject); pOpenEventObject = NULL; }
if (hOpenEvent != NULL) { ZwClose(hOpenEvent); hOpenEvent = NULL; }
return bSucc; }
|