SKETCH OF HOW RESEARCH MIGHT CONTINUE AND RESULTS BE PRESENTED

OB_QUERYNAME_METHOD

The OB_QUERYNAME_METHOD type is a pointer to a routine that can be defined for all objects of the same type. It is specified as the QueryNameProcedure member of the OBJECT_TYPE_INITIALIZER structure when creating the object type. It is then retained in this structure as nested into the OBJECT_TYPE structure.

Declaration

The modern declaration starts with the version 5.2 from Windows Server 2003 SP1:

typedef 
NTSTATUS 
(*OB_QUERYNAME_METHOD) (
    PVOID Object, 
    BOOLEAN HasObjectName, 
    OBJECT_NAME_INFORMATION *ObjectNameInfo, 
    ULONG Length, 
    ULONG *ReturnLength, 
    KPROCESSOR_MODE Mode);

In earlier versions, the function has one fewer argument:

typedef 
NTSTATUS 
(*OB_QUERYNAME_METHOD) (
    PVOID Object, 
    BOOLEAN HasObjectName, 
    OBJECT_NAME_INFORMATION *ObjectNameInfo, 
    ULONG Length, 
    ULONG *ReturnLength);