Module Description

Module and Object initialization.

Classes
struct	PACKED_OBJ_ATTRIBUTES

Typedefs
typedef struct _PACKED_OBJ_ATTRIBUTES *	PPACKED_OBJ_ATTRIBUTES

Functions
bool	InitNtFunc ()
	InitNtFunc must be called before any of the NTDLL functions can be used. More...

bool	_InitializeObjectAttributes (OUT POBJECT_ATTRIBUTES pObjAttr, IN HANDLE BaseObj, IN PUNICODE_STRING ObjName, IN ULONG Attrib, OPTIN PSECURITY_DESCRIPTOR SecurityDesc, OPTIN PSECURITY_QUALITY_OF_SERVICE SecurityQoS)

PACKED_OBJ_ATTRIBUTES *	AllocPackedObjAttributes (HANDLE BaseObj, PCWSTR ObjName, ULONG Attributes, PSECURITY_DESCRIPTOR SecurityDesc, PSECURITY_QUALITY_OF_SERVICE SecurityQoS)

Class Documentation

◆ PACKED_OBJ_ATTRIBUTES

struct PACKED_OBJ_ATTRIBUTES

Packed OBJECT_ATTRIBUTES struct. See AllocPackedObjAttributes().

Definition at line 93 of file NtFunc.h.

Class Members
OBJECT_ATTRIBUTES	oa	Object attributes.
UNICODE_STRING	uName	Name struct referenced by oa.
WCHAR	NameBuf[1]	Variable length name buffer for uName.

Typedef Documentation

◆ PPACKED_OBJ_ATTRIBUTES

typedef struct _PACKED_OBJ_ATTRIBUTES * PPACKED_OBJ_ATTRIBUTES

Packed OBJECT_ATTRIBUTES struct. See AllocPackedObjAttributes().

Function Documentation

◆ InitNtFunc()

bool InitNtFunc ( )

InitNtFunc must be called before any of the NTDLL functions can be used.

InitNtFunc() dynalinks the NTDLL functions to the pointers in this module.
Currently, this includes only the functions declared in the NDK.
Any pointer that remain NULL after this call means your NTDLL doesn't export that function.
Note: Calling InitNtFunc again does not waste time re-initializing the lot.

Returns: Returns false if an API was missing (or NTDLL missing), else true.
If false, you need to check the API pointers you want to use.

Definition at line 336 of file NtFunc.cpp.

◆ _InitializeObjectAttributes()

bool _InitializeObjectAttributes	(	OUT POBJECT_ATTRIBUTES	pObjAttr,
		IN HANDLE	BaseObj,
		IN PUNICODE_STRING	ObjName,
		IN ULONG	Attrib,
		OPTIN PSECURITY_DESCRIPTOR	SecurityDesc,
		OPTIN PSECURITY_QUALITY_OF_SERVICE	SecurityQoS
	)

This function equivalent of the DDK/NDK macro provides
better clarity. The leading underscore if for disambiguation.

Parameters

BaseObj	Base directory/key/obj for relative ObjName.
ObjName	Must be full path if BaseObj is NULL.

◆ AllocPackedObjAttributes()

PACKED_OBJ_ATTRIBUTES* AllocPackedObjAttributes	(	HANDLE	BaseObj,
		PCWSTR	ObjName,
		ULONG	Attributes,
		PSECURITY_DESCRIPTOR	SecurityDesc,
		PSECURITY_QUALITY_OF_SERVICE	SecurityQoS
	)

Allocate and initialize a packed OBJECT_ATTRIBUTES struct.
Return NULL on failure. Deallocate it with free().
See also _InitializeObjectAttributes().

Definition at line 45 of file NtFunc.cpp.