Getting driver name from PDRIVER_OBJECT

NTDEV
1

Hello,

I am working on a USB filter driver that tries to see if the driver loaded on a controller or hub is a TI driver or MSFTs driver to implement workarounds on certain tasks.

We were doing this filtering by accessing the driver name from PDRIVER_OBJECT and comparing it with strings such as “\Driver\tihub3”

Running code analysis on the driver code throws error C28175: Specified member of struct should not be accessed and I did find that drivername is an undocumented element in the struct.

Is there an alternative way of finding the driver name from the driver object (an API perhaps. I had no luck finding one).

Things tried:
I tried using ObReferenceObjectByName and thought of comparing the pointer to driver object returned by the API with the pointer I have to conclude if a particular driver is loaded but ObReferenceObjectByName is unsupported and I am pretty sure Code analysis is not going to be happy with that approach either.

Thanks,
Prasanna

2

I haven’t tried this in a long time but how about using ObQueryNameString on
the driver object? At one point this worked fine to get the driver name.

Don Burn
Windows Driver Consulting
Website: http://www.windrvr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@gmail.com
Sent: Tuesday, April 05, 2016 6:37 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Getting driver name from PDRIVER_OBJECT

Hello,

I am working on a USB filter driver that tries to see if the driver loaded
on a controller or hub is a TI driver or MSFTs driver to implement
workarounds on certain tasks.

We were doing this filtering by accessing the driver name from
PDRIVER_OBJECT and comparing it with strings such as “\Driver\tihub3”

Running code analysis on the driver code throws error C28175: Specified
member of struct should not be accessed and I did find that drivername is an
undocumented element in the struct.

Is there an alternative way of finding the driver name from the driver
object (an API perhaps. I had no luck finding one).

Things tried:
I tried using ObReferenceObjectByName and thought of comparing the pointer
to driver object returned by the API with the pointer I have to conclude if
a particular driver is loaded but ObReferenceObjectByName is unsupported and
I am pretty sure Code analysis is not going to be happy with that approach
either.

Thanks,
Prasanna

NTDEV is sponsored by OSR

Visit the list online at:
http:

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software
drivers!
Details at http:

To unsubscribe, visit the List Server section of OSR Online at
http:</http:></http:></http:>

3

Hi Don,

Thanks for the quick response. That worked!