I can see diver sources, and ObDereferenceObject ObfDereferenceObject calls.
What’s the difference?
C Source: ObDereferenceObject included.
As compiled. ObfDereferenceObject.
This parameter is not stacked pass.
: 00011B74 mov 8B480C ECx, dword ptr [EAX +0 C]
: 00011B77 FF154C130100 Call dword ptr [0001134C] * Reference To: ntoskrnl.ObfDereferenceObject, Ord: 032Ch
I develop assembly language, and therefore interested in the transfer parameters.
wrote in message news:xxxxx@ntdev…
>
> I can see diver sources, and ObDereferenceObject ObfDereferenceObject
> calls.
> What’s the difference?
>
> C Source: ObDereferenceObject included.
> As compiled. ObfDereferenceObject.
…
> This parameter is not stacked pass.
The “f” variant is internal function that uses alternative calling method
(fastcall).
> I develop assembly language, and therefore interested in the transfer
> parameters.
Sorry, but the API is presented in C language.
With anything else you’re in the Undocumented Wonderland, on your own risk.
– pa