1897 lines
48 KiB
Plaintext
1897 lines
48 KiB
Plaintext
Here is a breakdown of what each module exports
|
||
|
||
obinit.c KMUTANT ObpInitKillMutant;
|
||
UNICODE_STRING ObpDosDevicesShortName;
|
||
ULARGE_INTEGER ObpDosDevicesShortNamePrefix;
|
||
ULARGE_INTEGER ObpDosDevicesShortNameRoot
|
||
PDEVICE_MAP ObSystemDeviceMap
|
||
|
||
ObInitSystem (
|
||
ObDupHandleProcedure (
|
||
ObAuditInheritedHandleProcedure (
|
||
ObInitProcess (
|
||
ObInitProcess2 (
|
||
ObDestroyHandleProcedure (
|
||
ObKillProcess (
|
||
ObFindHandleForObject (
|
||
|
||
obcreate.c ObCreateObject (
|
||
ObDeleteCapturedInsertInfo (
|
||
ObFreeObjectCreateInfoBuffer (
|
||
ObpCaptureObjectCreateInformation (
|
||
ObpCaptureObjectName (
|
||
ObpFreeObjectNameBuffer (
|
||
ObpAllocateObject (
|
||
ObpFreeObject (
|
||
|
||
obhandle.c NtDuplicateObject (
|
||
ObGetHandleInformation (
|
||
ObpIncrPointerCount (
|
||
ObpDecrPointerCountWithResult (
|
||
ObpIncrementHandleCount (
|
||
ObpDecrementHandleCount (
|
||
ObpCreateHandle (
|
||
ObpCreateUnnamedHandle (
|
||
ObpTranslateGrantedAccessIndex (
|
||
|
||
obinsert.c ObInsertObject (
|
||
|
||
obref.c ObGetObjectPointerCount (
|
||
ObOpenObjectByName (
|
||
ObOpenObjectByPointer (
|
||
ObReferenceObjectByHandle (
|
||
ObReferenceObjectByName (
|
||
ObReferenceObjectByPointer (
|
||
ObDereferenceObject (
|
||
ObfReferenceObject (
|
||
ObpDeleteNameCheck (
|
||
|
||
obse.c NtSetSecurityObject (
|
||
NtQuerySecurityObject (
|
||
ObCheckObjectAccess (
|
||
ObCheckCreateObjectAccess (
|
||
ObAssignObjectSecurityDescriptor (
|
||
ObGetObjectSecurity (
|
||
ObReleaseObjectSecurity (
|
||
ObValidateSecurityQuota (
|
||
ObAssignSecurity (
|
||
ObSetSecurityDescriptorInfo (
|
||
ObpCheckObjectReference (
|
||
ObpCheckTraverseAccess (
|
||
ObpValidateAccessMask (
|
||
|
||
obtype.c ObCreateObjectType (
|
||
ObEnumerateObjectsByType(
|
||
ObGetObjectInformation(
|
||
|
||
obdir.c NtCreateDirectoryObject (
|
||
NtOpenDirectoryObject (
|
||
NtQueryDirectoryObject (
|
||
ObpLookupDirectoryEntry (
|
||
ObpInsertDirectoryEntry (
|
||
ObpDeleteDirectoryEntry (
|
||
ObpLookupObjectName (
|
||
|
||
obdevmap.c ObSetDeviceMap (
|
||
ObQueryDeviceMapInformation (
|
||
ObInheritDeviceMap (
|
||
ObDereferenceDeviceMap (
|
||
|
||
oblink.c NtCreateSymbolicLinkObject (
|
||
NtOpenSymbolicLinkObject (
|
||
NtQuerySymbolicLinkObject (
|
||
ObpParseSymbolicLink (
|
||
ObpDeleteSymbolicLinkName (
|
||
ObpCreateSymbolicLinkName (
|
||
|
||
obclose.c NtClose (
|
||
NtMakeTemporaryObject (
|
||
ObMakeTemporaryObject (
|
||
|
||
obquery.c NtQueryObject (
|
||
NtSetInformationObject (
|
||
ObGetObjectName (
|
||
ObQueryNameString (
|
||
ObQueryTypeName (
|
||
ObQueryTypeInfo (
|
||
ObQueryObjectAuditingByHandle (
|
||
|
||
obsdata.c ObpInitSecurityDescriptorCache (
|
||
ObpLogSecurityDescriptor (
|
||
ObpReferenceSecurityDescriptor (
|
||
ObDeassignSecurity (
|
||
ObpDereferenceSecurityDescriptor (
|
||
ObpAcquireDescriptorCacheReadLock (
|
||
ObpReleaseDescriptorCacheLock (
|
||
|
||
obwait.c NtSignalAndWaitForSingleObject (
|
||
NtWaitForSingleObject (
|
||
NtWaitForMultipleObjects (
|
||
ObWaitForSingleObject (
|
||
|
||
Module Name:
|
||
|
||
obinit.c
|
||
|
||
Global variables and who references them
|
||
|
||
GENERIC_MAPPING ObpTypeMapping = ...
|
||
|
||
obinit.c\ObInitSystem
|
||
|
||
GENERIC_MAPPING ObpDirectoryMapping = ...
|
||
|
||
obinit.c\ObInitSystem
|
||
|
||
GENERIC_MAPPING ObpSymbolicLinkMapping = ...
|
||
|
||
obinit.c\ObInitSystem
|
||
|
||
extern EPROCESS_QUOTA_BLOCK PspDefaultQuotaBlock;
|
||
|
||
obinit.c\ObInitSystem
|
||
|
||
KMUTANT ObpInitKillMutant;
|
||
|
||
obhandle.c\NtDuplicateObject
|
||
obinit.c\ObInitSystem
|
||
obinit.c\ObInitProcess
|
||
obinit.c\ObKillProcess
|
||
obinit.c\ObFindHandleForObject
|
||
|
||
ULONG ObpProtectionMode;
|
||
|
||
obinit.c\ObpGetDosDevicesProtection
|
||
|
||
ULONG ObpAuditBaseDirectories;
|
||
|
||
obinit.c\ObInitSystem
|
||
|
||
ULONG ObpAuditBaseObjects
|
||
|
||
obinit.c\ObInitSystem
|
||
|
||
UNICODE_STRING ObpDosDevicesShortName;
|
||
|
||
obdir.c\ObpLookupObjectName
|
||
obinit.c\ObpCreateDosDevicesDirectory
|
||
|
||
ULARGE_INTEGER ObpDosDevicesShortNamePrefix;
|
||
|
||
obdir.c\ObpLookupObjectName
|
||
obinit.c\ObpCreateDosDevicesDirectory
|
||
|
||
ULARGE_INTEGER ObpDosDevicesShortNameRoot
|
||
|
||
obdir.c\ObpLookupObjectName
|
||
obinit.c\ObpCreateDosDevicesDirectory
|
||
|
||
PDEVICE_MAP ObSystemDeviceMap
|
||
|
||
obdevmap.c\ObSetDeviceMap
|
||
obdevmap.c\ObQueryDeviceMapInformation
|
||
obdevmap.c\ObInheritDeviceMap
|
||
|
||
Procedures
|
||
|
||
BOOLEAN
|
||
ObInitSystem (
|
||
VOID
|
||
)
|
||
|
||
Called By:
|
||
|
||
It calls: GENERIC_MAPPING ObpTypeMapping = ...
|
||
GENERIC_MAPPING ObpDirectoryMapping = ...
|
||
GENERIC_MAPPING ObpSymbolicLinkMapping = ...
|
||
extern EPROCESS_QUOTA_BLOCK PspDefaultQuotaBlock;
|
||
KMUTANT ObpInitKillMutant;
|
||
ULONG ObpAuditBaseDirectories;
|
||
ULONG ObpAuditBaseObjects;
|
||
|
||
obinit.c\ObpCreateDosDevicesDirectory (
|
||
obref.c\ObReferenceObjectByHandle (
|
||
obtype.cObCreateObjectType (
|
||
obdir.c\NtCreateDirectoryObject (
|
||
obdir.c\ObpLookupDirectoryEntry (
|
||
obdir.c\ObpInsertDirectoryEntry (
|
||
oblink.c\ObpParseSymbolicLink (
|
||
obclose.c\NtClose (
|
||
obsdata.c\ObpInitSecurityDescriptorCache (
|
||
|
||
BOOLEAN
|
||
ObDupHandleProcedure (
|
||
PEPROCESS Process,
|
||
PVOID HandleTableEntry
|
||
)
|
||
|
||
Called By: obinit.c\ObInitProcess
|
||
|
||
It calls: obhandle.c\ObpIncrPointerCount (
|
||
obhandle.c\ObpIncrementHandleCount (
|
||
obhandle.c\ObpTranslateGrantedAccessIndex (
|
||
|
||
BOOLEAN
|
||
ObAuditInheritedHandleProcedure (
|
||
IN PVOID HandleTableEntry,
|
||
IN PVOID HandleId,
|
||
IN PVOID EnumParameter
|
||
)
|
||
|
||
Called By: obinit.c\ObInitProcess
|
||
|
||
It Calls:
|
||
|
||
NTSTATUS
|
||
ObInitProcess (
|
||
PEPROCESS ParentProcess OPTIONAL,
|
||
PEPROCESS NewProcess
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obinit.c\KMUTANT ObpInitKillMutant;
|
||
|
||
obinit.c\ObDupHandleProcedure (
|
||
obinit.c\ObAuditInheritedHandleProcedure (
|
||
|
||
VOID
|
||
ObInitProcess2 (
|
||
PEPROCESS NewProcess
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls:
|
||
|
||
VOID
|
||
ObDestroyHandleProcedure (
|
||
IN HANDLE HandleIndex,
|
||
IN PVOID HandleTableEntry
|
||
)
|
||
|
||
Called By: obinit.c\ObKillProcess
|
||
|
||
It Calls:
|
||
|
||
VOID
|
||
ObKillProcess (
|
||
BOOLEAN AcquireLock,
|
||
PEPROCESS Process
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obinit.c\KMUTANT ObpInitKillMutant;
|
||
|
||
obinit.c\ObDestroyHandleProcedure (
|
||
|
||
BOOLEAN
|
||
ObpEnumFindHandleProcedure (
|
||
PVOID HandleTableEntry,
|
||
PVOID HandleId,
|
||
PVOID EnumParameter
|
||
)
|
||
|
||
Called By: obinit.c\ObFindHandleForObject
|
||
|
||
It Calls: obhandle.c\ObpTranslateGrantedAccessIndex (
|
||
|
||
BOOLEAN
|
||
ObFindHandleForObject (
|
||
IN PEPROCESS Process,
|
||
IN PVOID Object OPTIONAL,
|
||
IN POBJECT_TYPE ObjectType OPTIONAL,
|
||
IN POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL,
|
||
OUT PHANDLE Handle
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obinit.c\KMUTANT ObpInitKillMutant;
|
||
|
||
obinit.c\ObpEnumFindHandleProcedure (
|
||
|
||
NTSTATUS
|
||
ObpCreateDosDevicesDirectory (
|
||
VOID
|
||
)
|
||
|
||
Called By: obinit.c\ObInitSystem
|
||
|
||
It Calls: obinit.c\UNICODE_STRING ObpDosDevicesShortName;
|
||
obinit.c\ULARGE_INTEGER ObpDosDevicesShortNamePrefix;
|
||
obinit.c\ULARGE_INTEGER ObpDosDevicesShortNameRoot;
|
||
|
||
obinit.c\ObpGetDosDevicesProtection (
|
||
obinit.c\ObpFreeDosDevicesProtection (
|
||
obdir.c\NtCreateDirectoryObject (
|
||
obdevmap.c\ObSetDeviceMap (
|
||
oblink.c\NtCreateSymbolicLinkObject (
|
||
obclose.c\NtClose (
|
||
|
||
NTSTATUS
|
||
ObpGetDosDevicesProtection (
|
||
PSECURITY_DESCRIPTOR SecurityDescriptor
|
||
)
|
||
|
||
Called By: obinit.c\ObpCreateDosDevicesDirectory
|
||
|
||
It Calls: ULONG ObpProtectionMode;
|
||
|
||
VOID
|
||
ObpFreeDosDevicesProtection (
|
||
PSECURITY_DESCRIPTOR SecurityDescriptor
|
||
)
|
||
|
||
Called By: obinit.c\ObpCreateDosDevicesDirectory
|
||
|
||
It Calls:
|
||
|
||
Module Name:
|
||
|
||
obcreate.c
|
||
|
||
Global variables and who references them
|
||
|
||
BOOLEAN ObpShowAllocAndFree;
|
||
|
||
obcreate.c\ObpAllocateObject
|
||
obcreate.c\ObpFreeObject
|
||
|
||
ULONG ObpObjectsCreated;
|
||
|
||
obcreate.c\ObpAllocateObject
|
||
|
||
ULONG ObpObjectsWithPoolQuota;
|
||
|
||
obcreate.c\ObpAllocateObject
|
||
|
||
ULONG ObpObjectsWithHandleDB;
|
||
|
||
obcreate.c\ObpAllocateObject
|
||
|
||
ULONG ObpObjectsWithName;
|
||
|
||
obcreate.c\ObpAllocateObject
|
||
|
||
ULONG ObpObjectsWithCreatorInfo;
|
||
|
||
obcreate.c\ObpAllocateObject
|
||
|
||
Procedures
|
||
|
||
NTSTATUS
|
||
ObCreateObject (
|
||
IN KPROCESSOR_MODE ProbeMode,
|
||
IN POBJECT_TYPE ObjectType,
|
||
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
|
||
IN KPROCESSOR_MODE OwnershipMode,
|
||
IN OUT PVOID ParseContext OPTIONAL,
|
||
IN ULONG ObjectBodySize,
|
||
IN ULONG PagedPoolCharge,
|
||
IN ULONG NonPagedPoolCharge,
|
||
OUT PVOID *Object
|
||
)
|
||
|
||
Called By: obdir.c\NtCreateDirectoryObject
|
||
oblink.c\NtCreateSymbolicLinkObject
|
||
|
||
It Calls: obcreate.c\ObpCaptureObjectCreateInformation (
|
||
obcreate.c\ObpFreeObjectNameBuffer (
|
||
obcreate.c\ObpAllocateObject (
|
||
obcreate.c\ObpFreeObject (
|
||
|
||
NTSTATUS
|
||
ObpCaptureObjectCreateInformation (
|
||
IN POBJECT_TYPE ObjectType OPTIONAL,
|
||
IN KPROCESSOR_MODE ProbeMode,
|
||
IN POBJECT_ATTRIBUTES ObjectAttributes,
|
||
IN OUT PUNICODE_STRING CapturedObjectName,
|
||
IN POBJECT_CREATE_INFORMATION ObjectCreateInfo,
|
||
IN LOGICAL UseLookaside
|
||
)
|
||
|
||
Called By: obcreate.c\ObCreateObject
|
||
obref.c\ObOpenObjectByName
|
||
|
||
It Calls: obcreate.c\ObpCaptureObjectName (
|
||
|
||
NTSTATUS
|
||
ObpCaptureObjectName (
|
||
IN KPROCESSOR_MODE ProbeMode,
|
||
IN PUNICODE_STRING ObjectName,
|
||
IN OUT PUNICODE_STRING CapturedObjectName,
|
||
IN LOGICAL UseLookaside
|
||
)
|
||
|
||
Called By: obcreate.c\ObpCaptureObjectCreateInformation
|
||
obref.c\ObReferenceObjectByName
|
||
|
||
It Calls: obcreate.c\ObpAllocateObjectNameBuffer (
|
||
|
||
PWCHAR
|
||
ObpAllocateObjectNameBuffer (
|
||
IN ULONG Length,
|
||
IN LOGICAL UseLookaside,
|
||
IN OUT PUNICODE_STRING ObjectName
|
||
)
|
||
|
||
Called By: obcreate.c\ObpCaptureObjectName
|
||
|
||
It Calls:
|
||
|
||
VOID
|
||
FASTCALL
|
||
ObpFreeObjectNameBuffer (
|
||
OUT PUNICODE_STRING ObjectName
|
||
)
|
||
|
||
Called By: obcreate.c\ObCreateObject
|
||
obref.c\ObOpenObjectByName
|
||
obref.c\ObReferenceObjectByName
|
||
|
||
It Calls:
|
||
|
||
NTKERNELAPI
|
||
VOID
|
||
ObDeleteCapturedInsertInfo (
|
||
IN PVOID Object
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls:
|
||
|
||
NTSTATUS
|
||
ObpAllocateObject (
|
||
IN POBJECT_CREATE_INFORMATION ObjectCreateInfo,
|
||
IN KPROCESSOR_MODE OwnershipMode,
|
||
IN POBJECT_TYPE ObjectType OPTIONAL,
|
||
IN PUNICODE_STRING ObjectName,
|
||
IN ULONG ObjectBodySize,
|
||
OUT POBJECT_HEADER *ReturnedObjectHeader
|
||
)
|
||
|
||
Called By: obcreate.c\ObCreateObject
|
||
obtype.c\ObCreateObjectType
|
||
|
||
It Calls: obcreate.c\BOOLEAN ObpShowAllocAndFree;
|
||
obcreate.c\ULONG ObpObjectsCreated;
|
||
obcreate.c\ULONG ObpObjectsWithPoolQuota;
|
||
obcreate.c\ULONG ObpObjectsWithHandleDB;
|
||
obcreate.c\ULONG ObpObjectsWithName;
|
||
obcreate.c\ULONG ObpObjectsWithCreatorInfo;
|
||
|
||
VOID
|
||
FASTCALL
|
||
ObpFreeObject (
|
||
IN PVOID Object
|
||
)
|
||
|
||
Called By: obcreate.c\ObCreateObject
|
||
obref.c\ObRemoveObjectRoutine
|
||
|
||
It Calls: obcreate.c\BOOLEAN ObpShowAllocAndFree;
|
||
|
||
VOID
|
||
FASTCALL
|
||
ObFreeObjectCreateInfoBuffer (
|
||
IN POBJECT_CREATE_INFORMATION ObjectCreateInfo
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls:
|
||
|
||
|
||
Module Name:
|
||
|
||
obhandle.c
|
||
|
||
Global variables and who references them
|
||
|
||
extern KMUTANT ObpInitKillMutant;
|
||
|
||
Procedures
|
||
|
||
VOID
|
||
FASTCALL
|
||
ObpIncrPointerCount (
|
||
IN POBJECT_HEADER ObjectHeader
|
||
)
|
||
|
||
Called By: obdir.c\ObpLookupObjectName
|
||
obhandle.c\ObpCreateHandle
|
||
obhandle.c\ObpCreateUnnamedHandle
|
||
obinit.c\ObDupHandleProcedure
|
||
obref.c\ObReferenceObjectByHandle
|
||
obref.c\ObfReferenceObject
|
||
obref.c\ObReferenceObjectByPointer
|
||
obwait.c\NtWaitForMultipleObjects
|
||
|
||
It Calls:
|
||
|
||
VOID
|
||
FASTCALL
|
||
ObpDecrPointerCount (
|
||
IN POBJECT_HEADER ObjectHeader
|
||
)
|
||
|
||
Called By: obhandle.c\ObpCreateHandle
|
||
obhandle.c\ObpCreateUnnamedHandle
|
||
|
||
It Calls:
|
||
|
||
BOOLEAN
|
||
FASTCALL
|
||
ObpDecrPointerCountWithResult (
|
||
IN POBJECT_HEADER ObjectHeader
|
||
)
|
||
|
||
Called By: obref.c\ObfDereferenceObject
|
||
|
||
It Calls:
|
||
|
||
VOID
|
||
FASTCALL
|
||
ObpIncrHandleCount (
|
||
IN POBJECT_HEADER ObjectHeader
|
||
)
|
||
|
||
Called By: obhandle.c\ObpIncrementHandleCount
|
||
obhandle.c\ObpIncrementUnnamedHandleCount
|
||
|
||
It Calls:
|
||
|
||
BOOLEAN
|
||
FASTCALL
|
||
ObpDecrHandleCount (
|
||
IN POBJECT_HEADER ObjectHeader
|
||
)
|
||
|
||
Called By: obhandle.c\ObpDecrementHandleCount
|
||
|
||
It Calls:
|
||
|
||
POBJECT_HANDLE_COUNT_ENTRY
|
||
ObpInsertHandleCount (
|
||
POBJECT_HEADER ObjectHeader
|
||
)
|
||
|
||
Called By: obhandle.c\ObpIncrementHandleDataBase
|
||
|
||
It Calls:
|
||
|
||
NTSTATUS
|
||
ObpIncrementHandleDataBase (
|
||
IN POBJECT_HEADER ObjectHeader,
|
||
IN PEPROCESS Process,
|
||
OUT PULONG NewProcessHandleCount
|
||
)
|
||
|
||
Called By: obhandle.c\ObpIncrementHandleCount
|
||
obhandle.c\ObpIncrementUnnamedHandleCount
|
||
|
||
It Calls: obhandle.c\ObpInsertHandleCount (
|
||
|
||
NTSTATUS
|
||
ObpIncrementHandleCount (
|
||
OB_OPEN_REASON OpenReason,
|
||
PEPROCESS Process,
|
||
PVOID Object,
|
||
POBJECT_TYPE ObjectType,
|
||
PACCESS_STATE AccessState OPTIONAL,
|
||
KPROCESSOR_MODE AccessMode,
|
||
ULONG Attributes
|
||
)
|
||
|
||
Called By: obhandle.c\ObpCreateHandle
|
||
obhandle.c\NtDuplicateObject
|
||
obinit.c\ObDupHandleProcedure
|
||
|
||
It Calls: obhandle.c\ObpIncrHandleCount (
|
||
obhandle.c\ObpIncrementHandleDataBase (
|
||
obhandle.c\ObpChargeQuotaForObject (
|
||
obse.c\ObCheckObjectAccess (
|
||
|
||
NTSTATUS
|
||
ObpIncrementUnnamedHandleCount (
|
||
PACCESS_MASK DesiredAccess,
|
||
PEPROCESS Process,
|
||
PVOID Object,
|
||
POBJECT_TYPE ObjectType,
|
||
KPROCESSOR_MODE AccessMode,
|
||
ULONG Attributes
|
||
)
|
||
|
||
Called By: obhandle.c\ObpCreateUnnamedHandle
|
||
|
||
It Calls: obhandle.c\ObpIncrHandleCount (
|
||
obhandle.c\ObpIncrementHandleDataBase (
|
||
obhandle.c\ObpChargeQuotaForObject (
|
||
|
||
NTSTATUS
|
||
ObpChargeQuotaForObject (
|
||
IN POBJECT_HEADER ObjectHeader,
|
||
IN POBJECT_TYPE ObjectType,
|
||
OUT PBOOLEAN NewObject
|
||
)
|
||
|
||
Called By: obhandle.c\ObpIncrementHandleCount
|
||
obhandle.c\ObpIncrementUnnamedHandleCount
|
||
|
||
It Calls:
|
||
|
||
VOID
|
||
ObpDecrementHandleCount (
|
||
PEPROCESS Process,
|
||
POBJECT_HEADER ObjectHeader,
|
||
POBJECT_TYPE ObjectType,
|
||
ACCESS_MASK GrantedAccess
|
||
)
|
||
|
||
Called By: obclose.c\NtClose
|
||
obhandle.c\ObpCreateHandle
|
||
obhandle.c\ObpCreateUnnamedHandle
|
||
obhandle.c\NtDuplicateObject
|
||
|
||
It Calls: obhandle.c\ObpDecrHandleCount (
|
||
obref.c\ObpDeleteNameCheck (
|
||
|
||
NTSTATUS
|
||
ObpCreateHandle (
|
||
IN OB_OPEN_REASON OpenReason,
|
||
IN PVOID Object,
|
||
IN POBJECT_TYPE ExpectedObjectType OPTIONAL,
|
||
IN PACCESS_STATE AccessState,
|
||
IN ULONG ObjectPointerBias OPTIONAL,
|
||
IN ULONG Attributes,
|
||
IN BOOLEAN DirectoryLocked,
|
||
IN KPROCESSOR_MODE AccessMode,
|
||
OUT PVOID *ReferencedNewObject OPTIONAL,
|
||
OUT PHANDLE Handle
|
||
)
|
||
|
||
Called By: obinsert.c\ObInsertObject
|
||
obref.c\ObOpenObjectByName
|
||
obref.c\ObOpenObjectByPointer
|
||
|
||
It Calls: obhandle.c\ObpIncrPointerCount (
|
||
obhandle.c\ObpDecrPointerCount (
|
||
obhandle.c\ObpIncrementHandleCount (
|
||
obhandle.c\ObpDecrementHandleCount (
|
||
obhandle.c\ObpComputeGrantedAccessIndex (
|
||
|
||
NTSTATUS
|
||
ObpCreateUnnamedHandle (
|
||
IN PVOID Object,
|
||
IN ACCESS_MASK DesiredAccess,
|
||
IN ULONG ObjectPointerBias OPTIONAL,
|
||
IN ULONG Attributes,
|
||
IN KPROCESSOR_MODE AccessMode,
|
||
OUT PVOID *ReferencedNewObject OPTIONAL,
|
||
OUT PHANDLE Handle
|
||
)
|
||
|
||
Called By: obinsert.c\ObInsertObject
|
||
|
||
It Calls: obhandle.c\ObpIncrPointerCount (
|
||
obhandle.c\ObpDecrPointerCount (
|
||
obhandle.c\ObpIncrementUnnamedHandleCount (
|
||
obhandle.c\ObpDecrementHandleCount (
|
||
obhandle.c\ObpComputeGrantedAccessIndex (
|
||
|
||
NTSTATUS
|
||
NtDuplicateObject (
|
||
IN HANDLE SourceProcessHandle,
|
||
IN HANDLE SourceHandle,
|
||
IN HANDLE TargetProcessHandle OPTIONAL,
|
||
OUT PHANDLE TargetHandle OPTIONAL,
|
||
IN ACCESS_MASK DesiredAccess,
|
||
IN ULONG HandleAttributes,
|
||
IN ULONG Options
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obinit.c\KMUTANT ObpInitKillMutant;
|
||
|
||
obhandle.c\ObpIncrementHandleCount (
|
||
obhandle.c\ObpDecrementHandleCount (
|
||
obhandle.c\ObpValidateDesiredAccess (
|
||
obhandle.c\ObpComputeGrantedAccessIndex (
|
||
obref.c\ObReferenceObjectByHandle (
|
||
obref.c\ObDereferenceObject (
|
||
obclose.c\NtClose (
|
||
|
||
NTSTATUS
|
||
ObpValidateDesiredAccess (
|
||
IN ACCESS_MASK DesiredAccess
|
||
)
|
||
|
||
Called By: obhandle.c\NtDuplicateObject
|
||
|
||
It Calls:
|
||
|
||
NTSTATUS
|
||
ObpCaptureHandleInformation (
|
||
IN OUT PSYSTEM_HANDLE_TABLE_ENTRY_INFO *HandleEntryInfo,
|
||
IN HANDLE UniqueProcessId,
|
||
IN PVOID HandleTableEntry,
|
||
IN HANDLE HandleIndex,
|
||
IN ULONG Length,
|
||
IN OUT PULONG RequiredLength
|
||
)
|
||
|
||
Called By: obhandle.c\ObGetHandleInformation
|
||
|
||
It Calls: obhandle.c\ObpTranslateGrantedAccessIndex (
|
||
|
||
NTSTATUS
|
||
ObGetHandleInformation (
|
||
OUT PSYSTEM_HANDLE_INFORMATION HandleInformation,
|
||
IN ULONG Length,
|
||
OUT PULONG ReturnLength OPTIONAL
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obhandle.c\ObpCaptureHandleInformation (
|
||
|
||
Global variables and who references them
|
||
|
||
ULONG ObpXXX1;
|
||
|
||
obhandle.c\ObpComputeGrantedAccessIndex
|
||
|
||
ULONG ObpXXX2;
|
||
|
||
obhandle.c\ObpComputeGrantedAccessIndex
|
||
|
||
ULONG ObpXXX3;
|
||
|
||
obhandle.c\ObpTranslateGrantedAccessIndex
|
||
|
||
Procedures
|
||
|
||
USHORT
|
||
ObpComputeGrantedAccessIndex (
|
||
ACCESS_MASK GrantedAccess
|
||
)
|
||
|
||
Called By: obhandle.c\ObpCreateHandle
|
||
obhandle.c\ObpCreateUnnamedHandle
|
||
obhandle.c\NtDuplicateObject
|
||
|
||
It Calls: obhandle.c\ULONG ObpXXX1;
|
||
obhandle.c\ULONG ObpXXX2;
|
||
|
||
ACCESS_MASK
|
||
ObpTranslateGrantedAccessIndex (
|
||
USHORT GrantedAccessIndex
|
||
)
|
||
|
||
Called By: obclose.c\NtClose
|
||
obhandle.c\ObpCaptureHandleInformation
|
||
obinit.c\ObDupHandleProcedure
|
||
obinit.c\ObpEnumFindHandleProcedure
|
||
obref.c\ObReferenceObjectByHandle
|
||
obwait.c\NtWaitForMultipleObjects
|
||
|
||
It Calls: obhandle.c\ULONG ObpXXX3;
|
||
|
||
|
||
Module Name:
|
||
|
||
obinsert.c
|
||
|
||
Procedures
|
||
|
||
NTSTATUS
|
||
ObInsertObject (
|
||
IN PVOID Object,
|
||
IN PACCESS_STATE AccessState OPTIONAL,
|
||
IN ACCESS_MASK DesiredAccess OPTIONAL,
|
||
IN ULONG ObjectPointerBias,
|
||
OUT PVOID *NewObject OPTIONAL,
|
||
OUT PHANDLE Handle
|
||
)
|
||
|
||
Called By: obdir.c\NtCreateDirectoryObject
|
||
oblink.c\NtCreateSymbolicLinkObject
|
||
|
||
It Calls: obhandle.c\ObpCreateHandle (
|
||
obhandle.c\ObpCreateUnnamedHandle (
|
||
obref.c\ObpDeleteNameCheck (
|
||
obref.c\ObDereferenceObject (
|
||
obse.c\ObGetObjectSecurity (
|
||
obse.c\ObReleaseObjectSecurity (
|
||
obse.c\ObAssignSecurity (
|
||
obse.c\ObpValidateAccessMask (
|
||
obdir.c\ObpDeleteDirectoryEntry (
|
||
obdir.c\ObpLookupObjectName (
|
||
oblink.c\ObpCreateSymbolicLinkName (
|
||
|
||
|
||
Module Name:
|
||
|
||
obref.c
|
||
|
||
Global variables and who references them
|
||
|
||
BOOLEAN ObpRemoveQueueActive;
|
||
|
||
obref.c\ObfDereferenceObject
|
||
obref.c\ObpProcessRemoveObjectQueue
|
||
|
||
Procedures
|
||
|
||
ULONG
|
||
ObGetObjectPointerCount (
|
||
IN PVOID Object
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls:
|
||
|
||
NTSTATUS
|
||
ObOpenObjectByName (
|
||
IN POBJECT_ATTRIBUTES ObjectAttributes,
|
||
IN POBJECT_TYPE ObjectType OPTIONAL,
|
||
IN KPROCESSOR_MODE AccessMode,
|
||
IN OUT PACCESS_STATE AccessState OPTIONAL,
|
||
IN ACCESS_MASK DesiredAccess OPTIONAL,
|
||
IN OUT PVOID ParseContext OPTIONAL,
|
||
OUT PHANDLE Handle
|
||
)
|
||
|
||
Called By: obdir.c\NtOpenDirectoryObject
|
||
oblink.c\NtOpenSymbolicLinkObject
|
||
|
||
It Calls: obcreate.c\ObpCaptureObjectCreateInformation (
|
||
obcreate.c\ObpFreeObjectNameBuffer (
|
||
obhandle.c\ObpCreateHandle (
|
||
obref.c\ObDereferenceObject (
|
||
obse.c\ObpValidateAccessMask (
|
||
obdir.c\ObpLookupObjectName (
|
||
|
||
NTSTATUS ObOpenObjectByPointer (
|
||
IN PVOID Object,
|
||
IN ULONG HandleAttributes,
|
||
IN PACCESS_STATE PassedAccessState OPTIONAL,
|
||
IN ACCESS_MASK DesiredAccess,
|
||
IN POBJECT_TYPE ObjectType OPTIONAL,
|
||
IN KPROCESSOR_MODE AccessMode,
|
||
OUT PHANDLE Handle
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obhandle.c\ObpCreateHandle (
|
||
obref.c\ObReferenceObjectByPointer (
|
||
obref.c\ObDereferenceObject (
|
||
|
||
NTSTATUS
|
||
ObReferenceObjectByHandle (
|
||
IN HANDLE Handle,
|
||
IN ACCESS_MASK DesiredAccess,
|
||
IN POBJECT_TYPE ObjectType OPTIONAL,
|
||
IN KPROCESSOR_MODE AccessMode,
|
||
OUT PVOID *Object,
|
||
OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL
|
||
)
|
||
|
||
Called By: obclose.c\NtMakeTemporaryObject
|
||
obdevmap.c\ObSetDeviceMap
|
||
obdir.c\ObpLookupObjectName
|
||
obdir.c\NtQueryDirectoryObject
|
||
obhandle.c\NtDuplicateObject
|
||
obinit.c\ObInitSystem
|
||
oblink.c\NtQuerySymbolicLinkObject
|
||
obquery.c\NtQueryObject
|
||
obse.c\NtSetSecurityObject
|
||
obse.c\NtQuerySecurityObject
|
||
obwait.c\NtSignalAndWaitForSingleObject
|
||
obwait.c\NtWaitForSingleObject
|
||
obwait.c\ObWaitForSingleObject
|
||
|
||
It Calls: obhandle.c\ObpIncrPointerCount (
|
||
obhandle.c\ObpTranslateGrantedAccessIndex (
|
||
|
||
NTSTATUS
|
||
ObReferenceObjectByName (
|
||
IN PUNICODE_STRING ObjectName,
|
||
IN ULONG Attributes,
|
||
IN PACCESS_STATE AccessState OPTIONAL,
|
||
IN ACCESS_MASK DesiredAccess OPTIONAL,
|
||
IN POBJECT_TYPE ObjectType,
|
||
IN KPROCESSOR_MODE AccessMode,
|
||
IN OUT PVOID ParseContext OPTIONAL,
|
||
OUT PVOID *Object
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obcreate.c\ObpCaptureObjectName (
|
||
obcreate.c\ObpFreeObjectNameBuffer (
|
||
obse.c\ObpCheckObjectReference (
|
||
obdir.c\ObpLookupObjectName (
|
||
|
||
|
||
VOID
|
||
FASTCALL
|
||
ObfReferenceObject (
|
||
IN PVOID Object
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obhandle.c\ObpIncrPointerCount (
|
||
|
||
NTSTATUS
|
||
ObReferenceObjectByPointer (
|
||
IN PVOID Object,
|
||
IN ACCESS_MASK DesiredAccess,
|
||
IN POBJECT_TYPE ObjectType,
|
||
IN KPROCESSOR_MODE AccessMode
|
||
)
|
||
|
||
Called By: obdir.c\ObpLookupObjectName
|
||
oblink.c\ObpParseSymbolicLink
|
||
obref.c\ObOpenObjectByPointer
|
||
|
||
It Calls: obhandle.c\ObpIncrPointerCount (
|
||
|
||
VOID
|
||
FASTCALL
|
||
ObfDereferenceObject (
|
||
IN PVOID Object
|
||
)
|
||
|
||
Called By: obref.c\ObDereferenceObject
|
||
|
||
It Calls: obref.c\BOOLEAN ObpRemoveQueueActive;
|
||
|
||
obhandle.c\ObpDecrPointerCountWithResult (
|
||
obref.c\ObpProcessRemoveObjectQueue (
|
||
obref.c\ObpRemoveObjectRoutine (
|
||
|
||
VOID
|
||
ObpProcessRemoveObjectQueue (
|
||
PVOID Parameter
|
||
)
|
||
|
||
Called By: obref.c\ObfDereferenceObject
|
||
|
||
It Calls: obref.c\BOOLEAN ObpRemoveQueueActive;
|
||
|
||
obref.c\ObpRemoveObjectRoutine (
|
||
|
||
VOID
|
||
ObpRemoveObjectRoutine (
|
||
PVOID Object
|
||
)
|
||
|
||
Called By: obref.c\ObfDereferenceObject
|
||
obref.c\ObpProcessRemoveObjectQueue
|
||
|
||
It Calls:
|
||
|
||
VOID
|
||
ObpDeleteNameCheck (
|
||
IN PVOID Object,
|
||
IN BOOLEAN TypeMutexHeld
|
||
)
|
||
|
||
Called By: obclose.c\ObMakeTemporaryObject
|
||
obhandle.c\ObpDecrementHandleCount
|
||
obinsert.c\ObInsertObject
|
||
|
||
It Calls: obref.c\ObDereferenceObject (
|
||
obdir.c\ObpLookupDirectoryEntry (
|
||
obdir.c\ObpDeleteDirectoryEntry (
|
||
oblink.c\ObpDeleteSymbolicLinkName (
|
||
|
||
VOID
|
||
ObDereferenceObject (
|
||
IN PVOID Object
|
||
)
|
||
|
||
Called By: obclose.c\NtClose
|
||
obclose.c\NtMakeTemporaryObject
|
||
obdevmap.c\ObSetDeviceMap
|
||
obdevmap.c\ObDereferenceDeviceMap
|
||
obdir.c\ObpLookupObjectName
|
||
obdir.c\NtQueryDirectoryObject
|
||
obhandle.c\NtDuplicateObject
|
||
obinsert.c\ObInsertObject
|
||
oblink.c\ObpProcessDosDeviceSymbolicLink
|
||
oblink.c\NtCreateSymbolicLinkObject
|
||
oblink.c\NtQuerySymbolicLinkObject
|
||
obquery.c\NtQueryObject
|
||
obref.c\ObOpenObjectByName
|
||
obref.c\ObOpenObjectByPointer
|
||
obref.c\ObpDeleteNameCheck
|
||
obse.c\NtSetSecurityObject
|
||
obse.c\NtQuerySecurityObject
|
||
obwait.c\NtSignalAndForSingleObject
|
||
obwait.c\NtWaitForSingleObject
|
||
obwait.c\NtWaitForMultipleObjects
|
||
obwait.c\ObWaitForSingleObject
|
||
|
||
It Calls: obref.c\ObfDereferenceObject (
|
||
|
||
|
||
Module Name:
|
||
|
||
obse.c
|
||
|
||
Procedures
|
||
|
||
NTSTATUS
|
||
NtSetSecurityObject (
|
||
IN HANDLE Handle,
|
||
IN SECURITY_INFORMATION SecurityInformation,
|
||
IN PSECURITY_DESCRIPTOR SecurityDescriptor
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obref.c\ObReferenceObjectByHandle (
|
||
obref.c\ObDereferenceObject (
|
||
|
||
NTSTATUS
|
||
NtQuerySecurityObject (
|
||
IN HANDLE Handle,
|
||
IN SECURITY_INFORMATION SecurityInformation,
|
||
OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
|
||
IN ULONG Length,
|
||
OUT PULONG LengthNeeded
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obref.c\ObReferenceObjectByHandle (
|
||
obref.c\ObDereferenceObject (
|
||
|
||
BOOLEAN
|
||
ObCheckObjectAccess (
|
||
IN PVOID Object,
|
||
IN OUT PACCESS_STATE AccessState,
|
||
IN BOOLEAN TypeMutexLocked,
|
||
IN KPROCESSOR_MODE AccessMode,
|
||
OUT PNTSTATUS AccessStatus
|
||
)
|
||
|
||
Called By: obhandle.c\ObpIncrementHandleCount
|
||
|
||
It Calls: obse.c\ObGetObjectSecurity (
|
||
obse.c\ObReleaseObjectSecurity (
|
||
|
||
BOOLEAN
|
||
ObpCheckObjectReference (
|
||
IN PVOID Object,
|
||
IN OUT PACCESS_STATE AccessState,
|
||
IN BOOLEAN TypeMutexLocked,
|
||
IN KPROCESSOR_MODE AccessMode,
|
||
OUT PNTSTATUS AccessStatus
|
||
)
|
||
|
||
Called By: obref.c\ObReferenceObjectByName
|
||
|
||
It Calls: obse.c\ObGetObjectSecurity (
|
||
obse.c\ObReleaseObjectSecurity (
|
||
|
||
BOOLEAN
|
||
ObpCheckTraverseAccess (
|
||
IN PVOID DirectoryObject,
|
||
IN ACCESS_MASK TraverseAccess,
|
||
IN PACCESS_STATE AccessState OPTIONAL,
|
||
IN BOOLEAN TypeMutexLocked,
|
||
IN KPROCESSOR_MODE PreviousMode,
|
||
OUT PNTSTATUS AccessStatus
|
||
)
|
||
|
||
Called By: obdir.c\ObpLookupObjectName
|
||
|
||
It Calls: obse.c\ObGetObjectSecurity (
|
||
obse.c\ObReleaseObjectSecurity (
|
||
|
||
BOOLEAN
|
||
ObCheckCreateObjectAccess (
|
||
IN PVOID DirectoryObject,
|
||
IN ACCESS_MASK CreateAccess,
|
||
IN PACCESS_STATE AccessState,
|
||
IN PUNICODE_STRING ComponentName,
|
||
IN BOOLEAN TypeMutexLocked,
|
||
IN KPROCESSOR_MODE PreviousMode,
|
||
OUT PNTSTATUS AccessStatus
|
||
)
|
||
|
||
Called By: obdir.c\ObpLookupObjectName
|
||
|
||
It Calls: obse.c\ObGetObjectSecurity (
|
||
obse.c\ObReleaseObjectSecurity (
|
||
|
||
NTSTATUS
|
||
ObAssignObjectSecurityDescriptor (
|
||
IN PVOID Object,
|
||
IN PSECURITY_DESCRIPTOR SecurityDescriptor OPTIONAL,
|
||
IN POOL_TYPE PoolType
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obsdata.c\ObpLogSecurityDescriptor (
|
||
|
||
NTSTATUS
|
||
ObGetObjectSecurity (
|
||
IN PVOID Object,
|
||
OUT PSECURITY_DESCRIPTOR *SecurityDescriptor,
|
||
OUT PBOOLEAN MemoryAllocated
|
||
)
|
||
|
||
Called By: obinsert.c\ObInsertObject
|
||
oblink.c\ObpProcessDosDeviceSymbolicLink
|
||
obse.c\ObCheckObjectAccess
|
||
obse.c\ObpCheckObjectReference
|
||
obse.c\ObpCheckTraverseAccess
|
||
obse.c\ObCheckCreateObjectAccess
|
||
|
||
It Calls: obsdata.c\ObpReferenceSecurityDescriptor (
|
||
|
||
VOID
|
||
ObReleaseObjectSecurity (
|
||
IN PSECURITY_DESCRIPTOR SecurityDescriptor,
|
||
IN BOOLEAN MemoryAllocated
|
||
)
|
||
|
||
Called By: obinsert.c\ObInsertObject
|
||
obse.c\ObCheckObjectAccess
|
||
obse.c\ObpCheckObjectReference
|
||
obse.c\ObpCheckTraverseAccess
|
||
obse.c\ObCheckCreateObjectAccess
|
||
|
||
It Calls: obsdata.c\ObpDereferenceSecurityDescriptor (
|
||
|
||
NTSTATUS
|
||
ObValidateSecurityQuota (
|
||
IN PVOID Object,
|
||
IN ULONG NewSize
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls:
|
||
|
||
NTSTATUS
|
||
ObAssignSecurity (
|
||
IN PACCESS_STATE AccessState,
|
||
IN PSECURITY_DESCRIPTOR ParentDescriptor OPTIONAL,
|
||
IN PVOID Object,
|
||
IN POBJECT_TYPE ObjectType
|
||
)
|
||
|
||
Called By: obinsert.c\ObInsertObject
|
||
|
||
It Calls:
|
||
|
||
NTSTATUS
|
||
ObSetSecurityDescriptorInfo (
|
||
IN PVOID Object,
|
||
IN PSECURITY_INFORMATION SecurityInformation,
|
||
IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
|
||
IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,
|
||
IN POOL_TYPE PoolType,
|
||
IN PGENERIC_MAPPING GenericMapping
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obsdata.c\ObpLogSecurityDescriptor (
|
||
obsdata.c\ObpDereferenceSecurityDescriptor (
|
||
obsdata.c\ObpAcquireDescriptorCacheReadLock (
|
||
obsdata.c\ObpReleaseDescriptorCacheLock (
|
||
|
||
NTSTATUS
|
||
ObpValidateAccessMask (
|
||
PACCESS_STATE AccessState
|
||
)
|
||
|
||
Called By: obinsert.c\ObInsertObject
|
||
obref.c\ObOpenObjectByName
|
||
|
||
It Calls:
|
||
|
||
|
||
Module Name:
|
||
|
||
obtype.c
|
||
|
||
Procedures
|
||
|
||
NTSTATUS
|
||
ObCreateObjectType (
|
||
IN PUNICODE_STRING TypeName,
|
||
IN POBJECT_TYPE_INITIALIZER ObjectTypeInitializer,
|
||
IN PSECURITY_DESCRIPTOR SecurityDescriptor OPTIONAL,
|
||
OUT POBJECT_TYPE *ObjectType
|
||
)
|
||
|
||
Called By: obinit.c\ObInitSystem
|
||
|
||
It Calls: obcreate.c\ObpAllocateObject (
|
||
obdir.c\ObpLookupDirectoryEntry (
|
||
obdir.c\ObpInsertDirectoryEntry (
|
||
|
||
NTSTATUS
|
||
ObEnumerateObjectsByType(
|
||
IN POBJECT_TYPE ObjectType,
|
||
IN OB_ENUM_OBJECT_TYPE_ROUTINE EnumerationRoutine,
|
||
IN PVOID Parameter
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls:
|
||
|
||
NTSTATUS
|
||
ObGetObjectInformation(
|
||
IN PCHAR UserModeBufferAddress,
|
||
OUT PSYSTEM_OBJECTTYPE_INFORMATION ObjectInformation,
|
||
IN ULONG Length,
|
||
OUT PULONG ReturnLength OPTIONAL
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obquery.c\ObQueryNameString (
|
||
|
||
|
||
Module Name:
|
||
|
||
obdir.c
|
||
|
||
Procedures
|
||
|
||
NTSTATUS
|
||
NtCreateDirectoryObject (
|
||
OUT PHANDLE DirectoryHandle,
|
||
IN ACCESS_MASK DesiredAccess,
|
||
IN POBJECT_ATTRIBUTES ObjectAttributes
|
||
)
|
||
|
||
Called By: obinit.c\ObInitSystem
|
||
obinit.c\ObpCreateDosDevicesDirectory
|
||
|
||
It Calls: obcreate.c\ObCreateObject (
|
||
obinsert.c\ObInsertObject (
|
||
|
||
NTSTATUS
|
||
NtOpenDirectoryObject (
|
||
OUT PHANDLE DirectoryHandle,
|
||
IN ACCESS_MASK DesiredAccess,
|
||
IN POBJECT_ATTRIBUTES ObjectAttributes
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obref.c\ObOpenObjectByName (
|
||
|
||
PVOID
|
||
ObpLookupDirectoryEntry (
|
||
IN POBJECT_DIRECTORY Directory,
|
||
IN PUNICODE_STRING Name,
|
||
IN ULONG Attributes
|
||
)
|
||
|
||
Called By: obdir.c\ObpLookupObjectName
|
||
obinit.c\ObInitSystem
|
||
oblink.c\ObpProcessDosDeviceSymbolicLink
|
||
obref.c\ObpDeleteNameCheck
|
||
obtype.c\ObCreateObjectType
|
||
|
||
It Calls:
|
||
|
||
BOOLEAN
|
||
ObpInsertDirectoryEntry (
|
||
IN POBJECT_DIRECTORY Directory,
|
||
IN PVOID Object
|
||
)
|
||
|
||
Called By: obdir.c\ObpLookupObjectName
|
||
obinit.c\ObInitSystem
|
||
obtype.c\ObCreateObjectType
|
||
|
||
It Calls: obinit.c\ObInitSystem (
|
||
|
||
BOOLEAN
|
||
ObpDeleteDirectoryEntry (
|
||
IN POBJECT_DIRECTORY Directory
|
||
)
|
||
|
||
Called By: obinsert.c\ObInsertObject
|
||
obref.c\ObpDeleteNameCheck
|
||
|
||
It Calls:
|
||
|
||
NTSTATUS
|
||
ObpLookupObjectName (
|
||
IN HANDLE RootDirectoryHandle,
|
||
IN PUNICODE_STRING ObjectName,
|
||
IN ULONG Attributes,
|
||
IN POBJECT_TYPE ObjectType,
|
||
IN KPROCESSOR_MODE AccessMode,
|
||
IN PVOID ParseContext OPTIONAL,
|
||
IN PSECURITY_QUALITY_OF_SERVICE SecurityQos OPTIONAL,
|
||
IN PVOID InsertObject OPTIONAL,
|
||
IN OUT PACCESS_STATE AccessState,
|
||
OUT PBOOLEAN DirectoryLocked,
|
||
OUT PVOID *FoundObject
|
||
)
|
||
|
||
Called By: obinsert.c\ObInsertObject
|
||
obref.c\ObOpenObjectByName
|
||
obref.c\ObReferenceObjectByName
|
||
|
||
It Calls: obinit.c\UNICODE_STRING ObpDosDevicesShortName;
|
||
obinit.c\ULARGE_INTEGER ObpDosDevicesShortNamePrefix;
|
||
obinit.c\ULARGE_INTEGER ObpDosDevicesShortNameRoot
|
||
|
||
obhandle.c\ObpIncrPointerCount (
|
||
obref.c\ObReferenceObjectByHandle (
|
||
obref.c\ObReferenceObjectByPointer (
|
||
obref.c\ObDereferenceObject (
|
||
obse.c\ObpCheckTraverseAccess (
|
||
obse.c\ObCheckCreateObjectAccess (
|
||
obdir.c\ObpLookupDirectoryEntry (
|
||
obdir.c\ObpInsertDirectoryEntry (
|
||
|
||
NTSTATUS
|
||
NtQueryDirectoryObject (
|
||
IN HANDLE DirectoryHandle,
|
||
OUT PVOID Buffer,
|
||
IN ULONG Length,
|
||
IN BOOLEAN ReturnSingleEntry,
|
||
IN BOOLEAN RestartScan,
|
||
IN OUT PULONG Context,
|
||
OUT PULONG ReturnLength OPTIONAL
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obref.c\ObReferenceObjectByHandle (
|
||
obref.c\ObDereferenceObject (
|
||
|
||
|
||
Module Name:
|
||
|
||
obdevmap.c
|
||
|
||
Procedures
|
||
|
||
NTSTATUS
|
||
ObSetDeviceMap (
|
||
IN PEPROCESS TargetProcess,
|
||
IN HANDLE DirectoryHandle
|
||
)
|
||
|
||
Called By: obinit.c\ObpCreateDosDevicesDirectory
|
||
|
||
It Calls: obinit.c\PDEVICE_MAP ObSystemDeviceMap
|
||
|
||
obref.c\ObReferenceObjectByHandle (
|
||
obref.c\ObDereferenceObject (
|
||
|
||
NTSTATUS
|
||
ObQueryDeviceMapInformation (
|
||
IN PEPROCESS TargetProcess,
|
||
OUT PPROCESS_DEVICEMAP_INFORMATION DeviceMapInformation
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obinit.c\PDEVICE_MAP ObSystemDeviceMap
|
||
|
||
VOID
|
||
ObInheritDeviceMap (
|
||
IN PEPROCESS NewProcess,
|
||
IN PEPROCESS ParentProcess
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obinit.c\PDEVICE_MAP ObSystemDeviceMap
|
||
|
||
VOID
|
||
ObDereferenceDeviceMap (
|
||
IN PEPROCESS Process
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obref.c\ObDereferenceObject (
|
||
|
||
|
||
Module Name:
|
||
|
||
oblink.c
|
||
|
||
Global variables and who references them
|
||
|
||
extern POBJECT_TYPE IoDeviceObjectType;
|
||
|
||
oblink.c\ObpProcessDosDeviceSymbolicLink
|
||
|
||
Procedures
|
||
|
||
NTSTATUS
|
||
ObpParseSymbolicLink (
|
||
IN PVOID ParseObject,
|
||
IN PVOID ObjectType,
|
||
IN PACCESS_STATE AccessState,
|
||
IN KPROCESSOR_MODE AccessMode,
|
||
IN ULONG Attributes,
|
||
IN OUT PUNICODE_STRING CompleteName,
|
||
IN OUT PUNICODE_STRING RemainingName,
|
||
IN OUT PVOID Context OPTIONAL,
|
||
IN PSECURITY_QUALITY_OF_SERVICE SecurityQos OPTIONAL,
|
||
OUT PVOID *Object
|
||
)
|
||
|
||
Called By: obinit.c\ObInitSystem
|
||
|
||
It Calls: obref.c\ObReferenceObjectByPointer (
|
||
|
||
VOID
|
||
ObpProcessDosDeviceSymbolicLink (
|
||
POBJECT_SYMBOLIC_LINK SymbolicLink,
|
||
ULONG Action
|
||
)
|
||
|
||
Called By: oblink.c\ObpDeleteSymbolicLinkName
|
||
oblink.c\ObpCreateSymbolicLinkName
|
||
|
||
It Calls: oblink.c\extern POBJECT_TYPE IoDeviceObjectType;
|
||
|
||
obref.c\ObDereferenceObject (
|
||
obse.c\ObGetObjectSecurity (
|
||
obdir.c\ObpLookupDirectoryEntry (
|
||
|
||
VOID
|
||
ObpDeleteSymbolicLinkName (
|
||
POBJECT_SYMBOLIC_LINK SymbolicLink
|
||
)
|
||
|
||
Called By: obref.c\ObpDeleteNameCheck
|
||
|
||
It Calls: oblink.c\ObpProcessDosDeviceSymbolicLink (
|
||
|
||
VOID
|
||
ObpCreateSymbolicLinkName (
|
||
POBJECT_SYMBOLIC_LINK SymbolicLink
|
||
)
|
||
|
||
Called By: obinsert.c\ObInsertObject
|
||
|
||
It Calls: oblink.c\ObpProcessDosDeviceSymbolicLink (
|
||
|
||
NTSTATUS
|
||
NtCreateSymbolicLinkObject (
|
||
OUT PHANDLE LinkHandle,
|
||
IN ACCESS_MASK DesiredAccess,
|
||
IN POBJECT_ATTRIBUTES ObjectAttributes,
|
||
IN PUNICODE_STRING LinkTarget
|
||
)
|
||
|
||
Called By: obinit.c\ObpCreateDosDevicesDirectory
|
||
|
||
It Calls: obcreate.c\ObCreateObject (
|
||
obinset.c\ObInsertObject (
|
||
obref.c\ObDereferenceObject (
|
||
|
||
NTSTATUS
|
||
NtOpenSymbolicLinkObject (
|
||
OUT PHANDLE LinkHandle,
|
||
IN ACCESS_MASK DesiredAccess,
|
||
IN POBJECT_ATTRIBUTES ObjectAttributes
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obref.c\ObOpenObjectByName (
|
||
|
||
NTSTATUS
|
||
NtQuerySymbolicLinkObject (
|
||
IN HANDLE LinkHandle,
|
||
IN OUT PUNICODE_STRING LinkTarget,
|
||
OUT PULONG ReturnedLength OPTIONAL
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obref.c\ObReferenceObjectByHandle (
|
||
obref.c\ObDereferenceObject (
|
||
|
||
|
||
Module Name:
|
||
|
||
obclose.c
|
||
|
||
Global variables and who references them
|
||
|
||
extern BOOLEAN SepAdtAuditingEnabled;
|
||
|
||
obclose.c\NtClose
|
||
|
||
Procedures
|
||
|
||
NTSTATUS
|
||
NtClose (
|
||
IN HANDLE Handle
|
||
)
|
||
|
||
Called By: obhandle.c\NtDuplicateObject
|
||
obinit.c\ObInitSystem
|
||
obinit.c\ObpCreateDosDevicesDirectory
|
||
|
||
It Calls: obclose.c\extern BOOLEAN SepAdtAuditingEnabled;
|
||
|
||
obhandle.c\ObpDecrementHandleCount (
|
||
obhandle.c\ObpTranslateGrantedAccessIndex (
|
||
obref.c\ObDereferenceObject (
|
||
|
||
NTSTATUS
|
||
NtMakeTemporaryObject (
|
||
IN HANDLE Handle
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obref.c\ObReferenceObjectByHandle (
|
||
obref.c\ObDereferenceObject (
|
||
obclose.c\ObMakeTemporaryObject (
|
||
|
||
VOID
|
||
ObMakeTemporaryObject (
|
||
IN PVOID Object
|
||
)
|
||
|
||
Called By: obclose.c\NtMakeTemporaryObject
|
||
|
||
It Calls: obref.c\ObpDeleteNameCheck (
|
||
|
||
|
||
Module Name:
|
||
|
||
obquery.c
|
||
|
||
Procedures
|
||
|
||
NTSTATUS
|
||
NtQueryObject (
|
||
IN HANDLE Handle,
|
||
IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
|
||
OUT PVOID ObjectInformation,
|
||
IN ULONG ObjectInformationLength,
|
||
OUT PULONG ReturnLength OPTIONAL
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obref.c\ObReferenceObjectByHandle (
|
||
obref.c\ObDereferenceObject (
|
||
obquery.c\ObQueryNameString (
|
||
obquery.c\ObQueryTypeInfo (
|
||
|
||
PUNICODE_STRING
|
||
ObGetObjectName (
|
||
IN PVOID Object
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls:
|
||
|
||
NTSTATUS
|
||
ObQueryNameString (
|
||
IN PVOID Object,
|
||
OUT POBJECT_NAME_INFORMATION ObjectNameInfo,
|
||
IN ULONG Length,
|
||
OUT PULONG ReturnLength
|
||
)
|
||
|
||
Called By: obquery.c\NtQueryObject
|
||
obtype.c\ObGetObjectInformation
|
||
|
||
It Calls:
|
||
|
||
NTSTATUS
|
||
ObQueryTypeName (
|
||
IN PVOID Object,
|
||
PUNICODE_STRING ObjectTypeName,
|
||
IN ULONG Length,
|
||
OUT PULONG ReturnLength
|
||
)
|
||
|
||
Called By: obtype.c\ObGetObjectInformation
|
||
|
||
It Calls:
|
||
|
||
NTSTATUS
|
||
ObQueryTypeInfo (
|
||
IN POBJECT_TYPE ObjectType,
|
||
OUT POBJECT_TYPE_INFORMATION ObjectTypeInfo,
|
||
IN ULONG Length,
|
||
OUT PULONG ReturnLength
|
||
)
|
||
|
||
Called By: obquery.c\NtQueryObject
|
||
|
||
It Calls:
|
||
|
||
NTSTATUS
|
||
ObQueryObjectAuditingByHandle (
|
||
IN HANDLE Handle,
|
||
OUT PBOOLEAN GenerateOnClose
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls:
|
||
|
||
BOOLEAN
|
||
ObpSetHandleAttributes (
|
||
IN OUT PVOID TableEntry,
|
||
IN ULONG Parameter
|
||
)
|
||
|
||
Called By: obquery.c\NtSetInformationObject
|
||
|
||
It Calls:
|
||
|
||
NTSTATUS
|
||
NTAPI
|
||
NtSetInformationObject (
|
||
IN HANDLE Handle,
|
||
IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
|
||
IN PVOID ObjectInformation,
|
||
IN ULONG ObjectInformationLength
|
||
)
|
||
|
||
Called By: obquery.c\ObpSetHandleAttributes (
|
||
|
||
It Calls:
|
||
|
||
|
||
Module Name:
|
||
|
||
obsdata.c
|
||
|
||
Global variables and who references them
|
||
|
||
ULONG ObsDebugFlags = 0;
|
||
|
||
ULONG ObsTotalCacheEntries = 0;
|
||
|
||
PLIST_ENTRY *ObsSecurityDescriptorCache = NULL;
|
||
|
||
ERESOURCE ObsSecurityDescriptorCacheLock;
|
||
|
||
Procedures
|
||
|
||
NTSTATUS
|
||
ObpInitSecurityDescriptorCache (
|
||
VOID
|
||
)
|
||
|
||
Called By: obinit.c\ObInitSystem
|
||
|
||
It Calls:
|
||
|
||
ULONG
|
||
ObpHashSecurityDescriptor (
|
||
PSECURITY_DESCRIPTOR SecurityDescriptor
|
||
)
|
||
|
||
Called By: obsdata.c\ObpLogSecurityDescriptor
|
||
|
||
It Calls: obsdata.c\ObpHashBuffer (
|
||
|
||
ULONG
|
||
ObpHashBuffer (
|
||
PVOID Data,
|
||
ULONG Length
|
||
)
|
||
|
||
Called By: obsdata.c\ObpHashSecurityDescriptor
|
||
|
||
It Calls:
|
||
|
||
NTSTATUS
|
||
ObpLogSecurityDescriptor (
|
||
IN PSECURITY_DESCRIPTOR InputSecurityDescriptor,
|
||
OUT PSECURITY_DESCRIPTOR *OutputSecurityDescriptor
|
||
)
|
||
|
||
Called By: obse.c\ObAssignObjectSecurityDescriptor
|
||
obse.c\ObSetSecurityDescriptorInfo
|
||
|
||
It Calls: obsdata.c\ObpHashSecurityDescriptor (
|
||
obsdata.c\ObpCreateCacheEntry (
|
||
obsdata.c\ObpCompareSecurityDescriptors (
|
||
obsdata.c\ObpAcquireDescriptorCacheWriteLock (
|
||
obsdata.c\ObpReleaseDescriptorCacheLock (
|
||
|
||
PSECURITY_DESCRIPTOR_HEADER
|
||
ObpCreateCacheEntry (
|
||
PSECURITY_DESCRIPTOR InputSecurityDescriptor,
|
||
ULONG FullHash
|
||
)
|
||
|
||
Called By: obsdata.c\ObpLogSecurityDescriptor
|
||
|
||
It Calls:
|
||
|
||
PSECURITY_DESCRIPTOR
|
||
ObpReferenceSecurityDescriptor (
|
||
PVOID Object
|
||
)
|
||
|
||
Called By: obse.c\ObGetObjectSecurity
|
||
|
||
It Calls: obsdata.c\ObpAcquireDescriptorCacheWriteLock (
|
||
obsdata.c\ObpReleaseDescriptorCacheLock (
|
||
|
||
NTSTATUS
|
||
ObDeassignSecurity (
|
||
IN OUT PSECURITY_DESCRIPTOR *SecurityDescriptor
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obsdata.c\ObpDereferenceSecurityDescriptor (
|
||
|
||
VOID
|
||
ObpDereferenceSecurityDescriptor (
|
||
PSECURITY_DESCRIPTOR SecurityDescriptor
|
||
)
|
||
|
||
Called By: obsdata.c\ObDeassignSecurity
|
||
obse.c\ObReleaseObjectSecurity
|
||
obse.c\ObSetSecurityDescriptorInfo
|
||
|
||
It Calls: obsdata.c\ObpDestroySecurityDescriptorHeader (
|
||
obsdata.c\ObpAcquireDescriptorCacheWriteLock (
|
||
obsdata.c\ObpReleaseDescriptorCacheLock (
|
||
|
||
VOID
|
||
ObpDestroySecurityDescriptorHeader (
|
||
IN PSECURITY_DESCRIPTOR_HEADER Header
|
||
)
|
||
|
||
Called By: obsdata.c\ObpDereferenceSecurityDescriptor
|
||
|
||
It Calls:
|
||
|
||
BOOLEAN
|
||
ObpCompareSecurityDescriptors (
|
||
IN PSECURITY_DESCRIPTOR SD1,
|
||
IN PSECURITY_DESCRIPTOR SD2
|
||
)
|
||
|
||
Called By: obsdata.c\ObpLogSecurityDescriptor
|
||
|
||
It Calls:
|
||
|
||
VOID
|
||
ObpAcquireDescriptorCacheWriteLock (
|
||
VOID
|
||
)
|
||
|
||
Called By: obsdata.c\ObpLogSecurityDescriptor
|
||
obsdata.c\ObpReferenceSecurityDescriptor
|
||
obsdata.c\ObpDereferenceSecurityDescriptor
|
||
|
||
It Calls:
|
||
|
||
VOID
|
||
ObpAcquireDescriptorCacheReadLock (
|
||
VOID
|
||
)
|
||
|
||
Called By: obse.c\ObSetSecurityDescriptorInfo
|
||
|
||
It Calls:
|
||
|
||
VOID
|
||
ObpReleaseDescriptorCacheLock (
|
||
VOID
|
||
)
|
||
|
||
Called By: obsdata.c\ObpLogSecurityDescriptor
|
||
obsdata.c\ObpReferenceSecurityDescriptor
|
||
obsdata.c\ObpDereferenceSecurityDescriptor
|
||
obse.c\ObSetSecurityDescriptorInfo
|
||
|
||
It Calls:
|
||
|
||
|
||
Module Name:
|
||
|
||
obwait.c
|
||
|
||
Global variables and who references them
|
||
|
||
extern POBJECT_TYPE ExEventObjectType;
|
||
|
||
obwait.c\NtSignalAndWaitForSingleObject
|
||
|
||
extern POBJECT_TYPE ExMutantObjectType;
|
||
|
||
obwait.c\NtSignalAndWaitForSingleObject
|
||
|
||
extern POBJECT_TYPE ExSemaphoreObjectType;
|
||
|
||
obwait.c\NtSignalAndWaitForSingleObject
|
||
|
||
Procedures
|
||
|
||
NTSTATUS
|
||
NtSignalAndWaitForSingleObject (
|
||
IN HANDLE SignalHandle,
|
||
IN HANDLE WaitHandle,
|
||
IN BOOLEAN Alertable,
|
||
IN PLARGE_INTEGER Timeout OPTIONAL
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obwait.c\extern POBJECT_TYPE ExEventObjectType;
|
||
obwait.c\extern POBJECT_TYPE ExSemaphoreObjectType;
|
||
obwait.c\extern POBJECT_TYPE ExMutantObjectType;
|
||
|
||
obref.c\ObReferenceObjectByHandle (
|
||
obref.c\ObDereferenceObject (
|
||
|
||
NTSTATUS
|
||
NtWaitForSingleObject (
|
||
IN HANDLE Handle,
|
||
IN BOOLEAN Alertable,
|
||
IN PLARGE_INTEGER Timeout OPTIONAL
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obref.c\ObReferenceObjectByHandle (
|
||
obref.c\ObDereferenceObject (
|
||
|
||
NTSTATUS
|
||
NtWaitForMultipleObjects (
|
||
IN ULONG Count,
|
||
IN HANDLE Handles[],
|
||
IN WAIT_TYPE WaitType,
|
||
IN BOOLEAN Alertable,
|
||
IN PLARGE_INTEGER Timeout OPTIONAL
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obhandle.c\ObpIncrPointerCount (
|
||
obhandle.c\ObpTranslateGrantedAccessIndex (
|
||
obref.c\ObDereferenceObject (
|
||
|
||
NTSTATUS
|
||
ObWaitForSingleObject (
|
||
IN HANDLE Handle,
|
||
IN BOOLEAN Alertable,
|
||
IN PLARGE_INTEGER Timeout OPTIONAL
|
||
)
|
||
|
||
Called By:
|
||
|
||
It Calls: obref.c\ObReferenceObjectByHandle (
|
||
obref.c\ObDereferenceObject (
|