When using ObQueryNameString in a driver, you should note that under some circumstances it will return STATUS_INFO_LENGTH_MISMATCH. This is because some of the subroutines called require that the output buffer be at least as large as the OBJECT_NAME_INFORMATION buffer.
This is an issue for drivers that attempt to call with a zero-length buffer in order to determine the buffer size - it does not work in all circumstances, and this call does not tell you how big to make the buffer.
The solution to this is to use a buffer that is at least sizeof(OBJECT_NAME_INFORMATION) large on the initial call - this will ensure that the returned length is the necessary size.
Post Your Comment
