IopCaptureObjectName
PWCHAR __stdcall IopCaptureObjectName(PVOID Object){
WCHAR *v1;
UINT8 *PoolWithTag;
int ReturnLength[4];
struct _OBJECT_NAME_INFORMATION ObjectNameInfo;
ReturnLength[0] = 0;
v1 = 0i64;
if( (int)ObQueryNameString(Object, &ObjectNameInfo, 0x200ui64, (UINT64 *)ReturnLength) >= 0 )
{
if( ObjectNameInfo.Name.Buffer )
{
PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(NonPagedPoolNx, ObjectNameInfo.Name.Length + 2i64, 0x72775044ui64);
v1 = (WCHAR *)PoolWithTag;
if( PoolWithTag )
{
memmove(PoolWithTag, (UINT8 *)ObjectNameInfo.Name.Buffer, ObjectNameInfo.Name.Length);
v1[(unsigned __int64)ObjectNameInfo.Name.Length >> 1] = 0;
}
}
}
return v1;
}Referenced by:
IoBuildPoDeviceNotifyList