Find the kernel structure that contains device name

Question

I'm using WinDbg to try enumerate drivers and their associated devices. Getting the driver name is very easy. It is found in the _DRIVER_OBJECT structure. Unfortunately, the _DEVICE_OBJECT does not contain the name of the device.

Using the !devobj command I can see the name of the device, but I would like to find the table/structure that contains the name.

Answer 1

So assuming like you said, you have the linear address of your device object, use the windbg extension !object 0xlinearaddress. Based on your windows build, it will display the linear address of the object header. Which in memory exists right below the object.

Use windbg to parse the OBJECT_HEADER structure for you. Starting with Windows 7 you are going to have a member called InfoMask, earlier versions have NameInfoOffset.

If you have an earlier build, NameInfoOffset is subtracted from the linear base of the object header, to get you the base of an OBJECT_HEADER_NAME_INFO structure for that object.

If you have a Windows 7 build or later, InfoMask is a bitmask describing other creator structures that exist before the beginning of the header. It is computed using the ObInfoMaskToOffsetTable which contains the offset to the OBJECT_HEADER_NAME_INFO structure for the object. It is always at a constant location but the InfoMask should be used to determine if the object is named, because not all objects are required to be named.

So a quick example for you, let's say you have a device object at fffffa8001234560. Let's also presume you are using Windows 7 x64.

Your name info would be:

dt nt!_object_header_name_info fffffa8001234560-0x30-0x20

-0x30 to base of header -0x20 because in this case InfoMask used in the table has an index value of 0x20.

This structure contains the name relative to it's object directory.

Also have a look at the exported kernel routine ObQueryNameInfo.

Answer 2

From what I remember, both XP and Win7 always had this format:

object_directory_followed by object_header whose _QUAD part (opaque do not use this field) points to the OBJECT

If you did dt nt!_Object_header_name_info <address of object> - 0x28:

kd> !devobj \Device\Beep;dt nt!_OBJECT_HEADER_NAME_INFO 86884db8-28
Device object (86884db8) is for:
 Beep \Driver\Beep DriverObject 86e703b8
Current Irp 00000000 RefCount 0 Type 00000001 Flags 00000044
Dacl e1020c34 DevExt 86884e70 DevObjExt 86884ec8 
ExtensionFlags (0000000000)  
Device queue is not busy.
   +0x000 Directory        : 0xe100d670 _OBJECT_DIRECTORY
   +0x004 Name             : _UNICODE_STRING "Beep"
   +0x00c QueryReferences  : 1
kd> !devobj \Device\00000013
Device object (86fe7cd0) is for:
 00000013 \Driver\PnpManager DriverObject 86fe9328
Current Irp 00000000 RefCount 0 Type 00000004 Flags 00001040
Dacl e1020c34 DevExt 86fe7d88 DevObjExt 86fe7d90 DevNode 86fe7b88 
ExtensionFlags (0x00000010)  DOE_START_PENDING
Device queue is not busy.
kd> dt nt!_OBJECT_HEADER_NAME_INFO 86fe7cd0-28
   +0x000 Directory        : 0xe100d670 _OBJECT_DIRECTORY
   +0x004 Name             : _UNICODE_STRING "00000013"
   +0x00c QueryReferences  : 1