I need to get the object name from a (usermode) handle.
ObQueryNameString does this for me most of the time, but sometimes it
returns strange or invalid data that I can’t understand.
A question: is ObQueryNameString always equivalent to
ZwQueryInformationXXX with XXXNameInformation class for all object
types? Are there types or situations when specific functions
(ZwQueryInformationFile, ZwQueryKey etc.)
should be used rather than ObQueryNameString?
Regards,
– pa