How to check the validity of an FILE_OBJECT or a handle in driver?

NTDEV
1

All,

I wish to check the validity of a pointer to FILE_OBJECT (or a related
handle) in driver? Can anyone advise how to do this? Thank you very
much!

Best Regards
Raymond Zhang

2

Pointer or handle? There’s a huge difference between the two.

Pointers to objects can’t be verified. You have to assume the caller
who handed you the file object gave you a good one. If you’re trying to
sniff around in some undocumented structure and think you’ve found a
file object then you’re doing something bad and should stop.

Handles can be verified quite easily. Just call
ObReferenceObjectByHandle.

-p

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zhang, Raymond
Sent: Wednesday, June 15, 2005 5:41 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] How to check the validity of an FILE_OBJECT or a handle
in driver?

All,

I wish to check the validity of a pointer to FILE_OBJECT (or a related
handle) in driver? Can anyone advise how to do this? Thank you very
much!

Best Regards
Raymond Zhang

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

A handle you can validate with ObReferenceObjectByHandle and pass the
Irp->RequestorMode for the AccessMode and *IoFileObjectType for the
ObjectType. This will return a PFILE_OBJECT.

If you have a PFILE_OBJECT from somewhere else, there is no way to
validate it. You have to trust it.

d

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zhang, Raymond
Sent: Wednesday, June 15, 2005 5:41 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] How to check the validity of an FILE_OBJECT or a handle
in driver?

All,

I wish to check the validity of a pointer to FILE_OBJECT (or a related
handle) in driver? Can anyone advise how to do this? Thank you very
much!

Best Regards
Raymond Zhang

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com