Geoff Chappell - Software Analyst
SKETCH OF HOW RESEARCH MIGHT CONTINUE AND RESULTS BE PRESENTED
The OB_QUERYNAME_METHOD type is a pointer to a routine that can be defined for all objects of the same type. It is specified as the QueryNameProcedure member of the OBJECT_TYPE_INITIALIZER structure when creating the object type. It is then retained in this structure as nested into the OBJECT_TYPE structure.
The modern declaration starts with the version 5.2 from Windows Server 2003 SP1:
typedef NTSTATUS (*OB_QUERYNAME_METHOD) ( PVOID Object, BOOLEAN HasObjectName, OBJECT_NAME_INFORMATION *ObjectNameInfo, ULONG Length, ULONG *ReturnLength, KPROCESSOR_MODE Mode);
In earlier versions, the function has one fewer argument:
typedef NTSTATUS (*OB_QUERYNAME_METHOD) ( PVOID Object, BOOLEAN HasObjectName, OBJECT_NAME_INFORMATION *ObjectNameInfo, ULONG Length, ULONG *ReturnLength);