ObDereferenceObject routine
The ObDereferenceObject routine decrements the given object's reference count and performs retention checks.
ObDereferenceObject 例程减少指定对象的引用计数,并执行retention check.
语法:
VOID ObDereferenceObject(
_In_ PVOID Object
);
参数:
Object [in]
Pointer to the object's body.
指向对象实体的指针。
返回值:
ObDereferenceObject returns a value that is reserved for system use. Drivers must treat this value as VOID.
ObDereferenceObject例程的返回值保留给系统使用,驱动程序必须将此值视为VOID。
备注:
ObDereferenceObject decreases the reference count of an object by one.
ObdereferenceObject将一个对象的引用计数减一。
If the object was created as temporary (the OBJ_PERMANENT flag was not specified on creation), and the reference count reaches zero,
the object can be deleted by the system.
如果对象创建为临时对象(创建时未指定OBJ_PERMANENT标志位),当引用计数为 0 时,对象将被系统删除。
A driver can delete a temporary object it created by decreasing its reference count to zero.
驱动程序可以通过将一个临时对象的引用计数减为0 来删除一个对象。
A driver must never attempt to delete an object it did not create.
驱动程序不能尝试删除一个未创建的对象。
An object is permanent if it was created with the OBJ_PERMANENT object attribute flag specified.
创建对象时,若指定了OBJ_PERMANENT属性标志,对象将是持久对象。
(For more information about object attributes, see InitializeObjectAttributes.)
更多信息,请参见InitializeObjectAttributes例程。
A permanent object is created with a reference count of one, so it is not deleted when the driver dereferences it.
持久对象创建后,引用计数为1,所以驱动解除引用时,对象也不会被删除。
A driver can only delete a permanent object it created by using the ZwMakeTemporaryObject routine to make it temporary.
驱动程序删除一个持久对象的惟一方法,是通过调用ZwMakeTemporaryObject例程,将对象转换为临时对象。
Use the following steps to delete a permanent object that you created:
使用下列步骤删除一个创建的持久对象:
1 Call ObDereferenceObject.
调用ObdereferenceObject。
2. Call the appropriate ZwOpenXxx or ZwCreateXxx routine to get a handle for the object, if necessary.
调用相应的ZwOpenXxx 或者 ZwCreateXxx 例程获取一个对象句柄。
3. Call ZwMakeTemporaryObject with the handle obtained in step 2.
使用第二步获取的句柄调用ZwMakeTemporaryObject。
4. Call ZwClose with the handle obtained in step 2.
使用第二步获取的句柄调用ZwClose。
Important Use ObDereferenceObjectDeferDelete instead of ObDereferenceObject for any object,
particularly Kernel Transaction Manager (KTM) objects,
when the immediate deletion by the current thread of the object (by using ObDereferenceObject) might result in a deadlock.
这句话,Google翻译的我不懂...
依赖项:
操作系统 : Windows 2000 and later versions of Windows
头文件: Wdm.h (include Wdm.h, Ntddk.h, Ntifs.h, or Fltkernel.h)
库: Ntoskrnl.lib.
IRQL: <= DISPATCH_LEVEL
DDI compliance rules HwStorPortProhibitedDDIs(http://msdn.microsoft.com/en-us/library/windows/hardware/hh454220(v=vs.85).aspx)