ObInit会被调用两次,ObpInitializationPhase分别为TRUE和FALSE的时候。
在ObpInitializationPhase==TURE时,创建根目录\和\ObjectTypes
在ObpInitializationPhase==FALSE时,调用ObCreateObjectType,创建\ObjectTypes中下的的Type、Directory、SymbolicLink等。 根目录\和\ObjectTypes ObInit() { … // 创建根目录\/* Create the directory */
Status = NtCreateDirectoryObject(&Handle, DIRECTORY_ALL_ACCESS, &ObjectAttributes); … //将句柄转换成对象 Status = ObReferenceObjectByHandle(Handle, 0, ObDirectoryType, KernelMode, (PVOID*)&ObpRootDirectoryObject, NULL);…
// 创建根目录\ObjectTypes
Status = NtCreateDirectoryObject(&Handle, DIRECTORY_ALL_ACCESS, &ObjectAttributes);…
/* Get a handle to it */
Status = ObReferenceObjectByHandle(Handle, 0, ObDirectoryType, KernelMode, (PVOID*)&ObpTypeDirectoryObject, NULL);…
}