So assuming like you said, you have the linear address of your device object, use the windbg extension
!object 0xlinearaddress. Based on your windows build, it will display the linear address of the object header. Which in memory exists right below the object.
Use windbg to parse the
OBJECT_HEADER structure for you. Starting with Windows 7 you are going to have a member called
InfoMask, earlier versions have
If you have an earlier build,
NameInfoOffset is subtracted from the linear base of the object header, to get you the base of an
OBJECT_HEADER_NAME_INFO structure for that object.
If you have a Windows 7 build or later,
InfoMask is a bitmask describing other creator structures that exist before the beginning of the header. It is computed using the
ObInfoMaskToOffsetTable which contains the offset to the
OBJECT_HEADER_NAME_INFO structure for the object. It is always at a constant location but the
InfoMask should be used to determine if the object is named, because not all objects are required to be named.
So a quick example for you, let's say you have a device object at
fffffa8001234560. Let's also presume you are using Windows 7 x64.
Your name info would be:
dt nt!_object_header_name_info fffffa8001234560-0x30-0x20
-0x30 to base of header
-0x20 because in this case
InfoMask used in the table has an index value of 0x20.
This structure contains the name relative to it's object directory.
Also have a look at the exported kernel routine