获取内核对象的引用计数

正规的方法可以用 ZwQueryObject 。但是该函数用起来比较麻烦。

事实上还有一个方便的函数

VOID ObReferenceObject(

_In_ PVOID Object

);

Return value

ObReferenceObject returns a value that is reserved for system use. Drivers must treat this value as VOID.

打开反汇编一看：

nt!ObfReferenceObject:

8086bf7c 803de0088a8000 cmp byte ptr [nt!KiEnableTimerWatchdog+0xafc (808a08e0)],0

8086bf83 56 push esi

8086bf84 8d71e8 lea esi,[ecx-18h]

8086bf87 7408 je nt!ObfReferenceObject+0x15 (8086bf91)

8086bf89 6a01 push 1

8086bf8b 56 push esi

8086bf8c e8a3feffff call nt!NtFreeVirtualMemory+0x14ea2 (8086be34)

8086bf91 33c0 xor eax,eax

8086bf93 40 inc eax

8086bf94 f00fc106 lock xadd dword ptr [esi],eax

8086bf98 40 inc eax

8086bf99 5e pop esi

8086bf9a c3 ret //eax = new reference count

虽然该函数的返回值声明为void，事实上 就是引用计数。