Comments on: The kernel object namespace and Win32, part 3

By: KeithKlean

KeithKlean — Tue, 02 Dec 2008 17:58:00 +0000

You can look at the hierarchy with an “Object View” utility, there are many such available as Freeware on the Worldwide Web. The Namespace will have many entries, organized as a tree rooted at “\”. One of the directories in that hierarchy is \device, which contains every device visible by the system. When DriverEntry creates a DeviceObject named “cdriver”, for example, an entry for that object will be created at \device\cdriver . However, this is not the name that is seen by the application: what the app really sees is a link to the \device\cdriver name. For example, the name “C:” is really a link into the \device entry for drive C.

By: Skywing

Skywing — Thu, 13 Sep 2007 21:31:39 +0000

Assumming that you are speaking of “winstation” == “window station” and not “terminal server session” (which are internally called “winstations”, not to be confused with “window stations”), the supported way to do that is to start a process in the target session that uses EnumWindowStations / EnumDesktops. You could try to get something working with traversing the object directory, permissions allowing, but this is of course undocumented and subject to change without notice.

But it might first be better to examine why you want to do that in the first place. There might be a better means to what you’re really trying to do…

By: Remko

Remko — Thu, 13 Sep 2007 21:04:48 +0000

How can we enumerate winstations and desktops from a specific terminal session? I presume NTQueryDirectoryObject? Can you help…

By: Alex Ionescu

Alex Ionescu — Thu, 23 Nov 2006 01:41:01 +0000

Wonderful series, thanks!

I’ve been trying to understand some of the new stuff in 2003 and it still confuses me (In the Object Manager Parsing Callback). LUID Object Directories, “Shadow” DOS Device Table…