FltCreate and ObReferenceObjectByHandle

NTFSD
1

Hi,

I have seen in the archives that after doing FltCreate and ObReferenceObjectByHandle, Fltclose is done and then ObDereferenceObject.

Is this the Correct way OR first Dereference the Object and then Close the Handle ?

Thanks in Advance
Anand.

2

ObReferenceObjectByHandle() returns a pointer to a body of an object that a handle refers to, and increments reference count on this object. Any function that returns a handle increments reference count on the underlying object. Therefore, if you call FltCreateFile() and then ObReferenceObjectByHandle(), you increment reference count on the underlying FILE_OBJECT twice, so that it just does not matter in which order you call ObDereferenceObject() and FltClose() - FILE_OBJECT will stay in memory until its reference count goes down to zero.

Anton Bassov