I was using NtOpenDirectoryObject -> NtQueryDirectoryObject (retrieving multiple records) for "\Driver" & "\Device" but it (1) doesn't return all entries I can see in Winobj and (2) the entries it returns are inconsistent across versions? Anyone have any insights?

is there a possibility of obj names containing console control characters that gets parsed, though messing up output?
-
-
No no I don't think so, the buffer is a set of OBJECT_DIRECTORY_INFORMATION structures where the last one has NULL pointers and that all checks out, it just doesn't return all of them. Maybe I will rewrite the function to loop single objects as per
@hFireF0X suggestion. -
https://pastebin.com/t4gCGz5B that is how I do it, not production grade code, just what I myself currently use, maybe usefull for inspiration
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.